opencode-landstrip 0.18.35 → 0.18.36

package/README.md

@@ -20,8 +20,10 @@ OpenCode permissions authorize tool dispatch. Landstrip permissions authorize
 filesystem and network access. Agent approval never bypasses a sandbox hard
 denial, and requests without a live presenter are denied.
 
-`/sandbox` displays or toggles the policy. Persistent approvals update
-`.opencode/sandbox.json` or `~/.config/opencode/sandbox.json`.
+OpenCode intentionally exposes one plugin slash command: `/landstrip`, which
+opens the bottom management pane. Pi-only agent and task subcommands are not
+available. Persistent approvals update `.opencode/sandbox.json` or
+`~/.config/opencode/sandbox.json`.
 
 ## Configuration
 

package/index.ts

@@ -5,40 +5,35 @@ import type { Hooks, Plugin, PluginInput, PluginOptions } from '@opencode-ai/plu
 
 import { randomBytes } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { lookup } from 'node:dns/promises';
-import { existsSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import {
-  type AddressInfo,
-  BlockList,
-  connect as connectNet,
-  createServer,
-  isIP,
-  type Socket,
-} from 'node:net';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { type AddressInfo, connect as connectNet, createServer } from 'node:net';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';
-import { URL } from 'node:url';
+import { basename, join } from 'node:path';
+
+import { startFilterProxy } from '@landstrip/landstrip/proxy';
 
 import {
   type LandstripTrap,
   type SandboxConfig,
   type SandboxFilesystemConfig,
   allowsAllDomains,
+  canonicalizeGlobPattern,
+  canonicalizePath,
   controlResponseLine,
   decodeLandstripTrap,
   domainMatchesAny,
-  expandHomePath,
   extractDomainsFromCommand,
   formatLandstripTraps,
   getConfigPaths,
+  globToRegExp,
   isRecord,
   landstripBinaryPath,
   loadConfig,
   normalizeOptions,
+  normalizePathSeparators,
   parseLandstripTraps,
   permissionPatterns,
   permissionType,
-  sandboxSummary,
   readDiscoveryPort,
   trapSessionHelloLine,
 } from './shared.js';
@@ -79,121 +74,13 @@ const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 const DISCOVERY_CONNECT_TIMEOUT_MS = 250;
 
-const prohibitedProxyAddresses = new BlockList();
-
-for (const [network, prefix] of [
-  ['0.0.0.0', 8],
-  ['10.0.0.0', 8],
-  ['100.64.0.0', 10],
-  ['127.0.0.0', 8],
-  ['169.254.0.0', 16],
-  ['172.16.0.0', 12],
-  ['192.0.0.0', 24],
-  ['192.168.0.0', 16],
-  ['198.18.0.0', 15],
-  ['224.0.0.0', 4],
-  ['240.0.0.0', 4],
-] as const) {
-  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv4');
-}
-for (const [network, prefix] of [
-  ['::', 128],
-  ['::1', 128],
-  ['fc00::', 7],
-  ['fe80::', 10],
-  ['ff00::', 8],
-] as const) {
-  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv6');
-}
-
-function expandPath(filePath: string, baseDirectory: string): string {
-  const expanded = expandHomePath(filePath);
-  return resolve(isAbsolute(expanded) ? expanded : join(baseDirectory, expanded));
-}
-
 function configuredShellPath(config: unknown): string | undefined {
   if (!isRecord(config)) return undefined;
   return typeof config.shell === 'string' ? config.shell : undefined;
 }
 
-function canonicalizePath(filePath: string, baseDirectory: string): string {
-  const abs = expandPath(filePath, baseDirectory);
-
-  try {
-    return realpathSync.native(abs);
-  } catch {
-    const tail: string[] = [];
-    let probe = abs;
-
-    while (!existsSync(probe)) {
-      const parent = dirname(probe);
-      if (parent === probe) return abs;
-      tail.unshift(basename(probe));
-      probe = parent;
-    }
-
-    try {
-      return resolve(realpathSync.native(probe), ...tail);
-    } catch {
-      return abs;
-    }
-  }
-}
-
-function canonicalizeGlobPath(pattern: string, baseDirectory: string): string {
-  const abs = expandPath(pattern, baseDirectory);
-  const wildcardIndex = abs.indexOf('*');
-  if (wildcardIndex === -1) return canonicalizePath(abs, baseDirectory);
-
-  const prefixEnd = abs.lastIndexOf(sep, wildcardIndex);
-  const root = parse(abs).root;
-  const wildcardAtRoot = prefixEnd < root.length;
-  const prefix = wildcardAtRoot ? root : abs.slice(0, prefixEnd);
-  const suffixStart = wildcardAtRoot ? root.length : prefixEnd;
-  return canonicalizePath(prefix, baseDirectory) + abs.slice(suffixStart);
-}
-
 function normalizePathForMatch(filePath: string): string {
-  return process.platform === 'win32' ? filePath.replaceAll('\\', '/').toLowerCase() : filePath;
-}
-
-const globRegExpCache = new Map<string, RegExp>();
-
-/**
- * Translates an absolute glob pattern to a regular expression using standard
- * path semantics: `**` crosses directory boundaries (and `**​/` may match zero
- * segments), while a single `*` is confined to one path segment.
- */
-function globToRegExp(globPattern: string): RegExp {
-  const cached = globRegExpCache.get(globPattern);
-  if (cached) return cached;
-
-  let regex = '';
-
-  for (let i = 0; i < globPattern.length; i++) {
-    const char = globPattern.charAt(i);
-    if (char === '*') {
-      if (globPattern.charAt(i + 1) === '*') {
-        i++;
-        if (globPattern.charAt(i + 1) === '/') {
-          i++;
-          regex += '(?:.*/)?';
-        } else {
-          regex += '.*';
-        }
-      } else {
-        regex += '[^/]*';
-      }
-    } else if (/[.+^${}()|[\]\\]/.test(char)) {
-      regex += `\\${char}`;
-    } else {
-      regex += char;
-    }
-  }
-
-  const result = new RegExp(`^${regex}$`);
-  globRegExpCache.set(globPattern, result);
-  return result;
+  return process.platform === 'win32' ? normalizePathSeparators(filePath).toLowerCase() : filePath;
 }
 
 // Component count of an absolute path; "/" is 0. Used to rank how specific a
@@ -211,7 +98,7 @@ function matchDepth(filePath: string, patterns: string[], baseDirectory: string)
 
   for (const pattern of patterns) {
     if (pattern.includes('*')) {
-      const absPattern = normalizePathForMatch(canonicalizeGlobPath(pattern, baseDirectory));
+      const absPattern = normalizePathForMatch(canonicalizeGlobPattern(pattern, baseDirectory));
       if (globToRegExp(absPattern).test(abs)) depth = Math.max(depth, pathDepth(abs));
     } else {
       const absPattern = normalizePathForMatch(canonicalizePath(pattern, baseDirectory));
@@ -228,7 +115,7 @@ function matchDepth(filePath: string, patterns: string[], baseDirectory: string)
 function resolveFilesystemPatterns(patterns: string[], baseDirectory: string): string[] {
   return patterns.map((pattern) =>
     pattern.includes('*')
-      ? canonicalizeGlobPath(pattern, baseDirectory)
+      ? canonicalizeGlobPattern(pattern, baseDirectory)
       : canonicalizePath(pattern, baseDirectory),
   );
 }
@@ -450,76 +337,6 @@ function hasMinimumVersion(version: string, minimum: readonly [number, number, n
   return true;
 }
 
-function parseProxyPort(value: string | undefined, defaultPort: number): number | null {
-  const rawPort = value ?? String(defaultPort);
-  if (!/^\d+$/.test(rawPort)) return null;
-
-  const port = Number(rawPort);
-  return port >= 1 && port <= 65535 ? port : null;
-}
-
-function splitHostPort(target: string, defaultPort: number): { host: string; port: number } | null {
-  const bracketMatch = target.match(/^\[([^\]]+)\](?::(.*))?$/);
-  const host = bracketMatch?.[1];
-  if (host) {
-    const port = parseProxyPort(bracketMatch?.[2], defaultPort);
-    return port === null ? null : { host, port };
-  }
-
-  const lastColon = target.lastIndexOf(':');
-  if (lastColon > -1 && target.indexOf(':') === lastColon) {
-    const port = parseProxyPort(target.slice(lastColon + 1), defaultPort);
-    return port === null ? null : { host: target.slice(0, lastColon), port };
-  }
-
-  return { host: target, port: defaultPort };
-}
-
-function denyProxyRequest(client: Socket, status = '403 Forbidden'): void {
-  client.write(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`);
-  client.end();
-}
-
-function isPublicProxyAddress(address: string, family = isIP(address)): boolean {
-  if (family === 4) return !prohibitedProxyAddresses.check(address, 'ipv4');
-  if (family === 6) return !prohibitedProxyAddresses.check(address, 'ipv6');
-  return false;
-}
-
-async function resolveProxyEndpoint(host: string): Promise<{ address: string; family: 4 | 6 }> {
-  const literalFamily = isIP(host);
-  if (literalFamily === 4 || literalFamily === 6) {
-    if (!isPublicProxyAddress(host, literalFamily)) {
-      throw new Error(`Proxy destination is not public: ${host}`);
-    }
-    return { address: host, family: literalFamily };
-  }
-
-  const addresses = await lookup(host, { all: true, verbatim: true });
-  if (
-    addresses.length === 0 ||
-    addresses.some(({ address, family }) => !isPublicProxyAddress(address, family))
-  ) {
-    throw new Error(`Proxy destination resolves to a non-public address: ${host}`);
-  }
-
-  const endpoint = addresses[0];
-  if (!endpoint || (endpoint.family !== 4 && endpoint.family !== 6)) {
-    throw new Error(`Proxy could not resolve destination: ${host}`);
-  }
-  return { address: endpoint.address, family: endpoint.family };
-}
-
-function pipeSockets(client: Socket, upstream: Socket, initialData?: Buffer): void {
-  upstream.on('error', () => client.destroy());
-  client.on('error', () => upstream.destroy());
-
-  if (initialData?.length) upstream.write(initialData);
-
-  client.pipe(upstream);
-  upstream.pipe(client);
-}
-
 function buildLandstripPolicy(
   config: SandboxConfig,
   baseDirectory: string,
@@ -552,191 +369,6 @@ function writePolicyFile(
   return { dir, path };
 }
 
-function startProxy(
-  config: SandboxConfig,
-  authorization?: string,
-): Promise<{ port: number; stop: () => Promise<void> }> {
-  const sockets = new Set<Socket>();
-
-  // Track the upstream socket so stop() tears it down, and abandon a still-
-  // connecting upstream when its client goes away — otherwise a connect to a
-  // black-holed host lingers in SYN-retry (~2 min), leaking an fd per request.
-  function trackUpstream(upstream: Socket, client: Socket, settled: () => boolean): void {
-    sockets.add(upstream);
-    upstream.once('close', () => sockets.delete(upstream));
-    client.once('close', () => {
-      if (!settled()) upstream.destroy();
-    });
-  }
-
-  async function handleConnect(client: Socket, target: string, rest: Buffer): Promise<void> {
-    const endpoint = splitHostPort(target, 443);
-    if (!endpoint) {
-      denyProxyRequest(client, '400 Bad Request');
-      return;
-    }
-
-    if (!isDomainAllowed(endpoint.host, config)) {
-      denyProxyRequest(client);
-      return;
-    }
-
-    const resolved = await resolveProxyEndpoint(endpoint.host);
-    let settled = false;
-    const upstream = connectNet(
-      { host: resolved.address, port: endpoint.port, family: resolved.family },
-      () => {
-        settled = true;
-        client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-        pipeSockets(client, upstream, rest);
-      },
-    );
-    trackUpstream(upstream, client, () => settled);
-    upstream.once('error', () => {
-      if (settled) return;
-      settled = true;
-      denyProxyRequest(client, '502 Bad Gateway');
-    });
-  }
-
-  async function handleHttp(client: Socket, headerText: string, rest: Buffer): Promise<void> {
-    const lines = headerText.split(/\r?\n/);
-    const requestLine = lines[0];
-    if (!requestLine) {
-      denyProxyRequest(client, '400 Bad Request');
-      return;
-    }
-
-    const [method, rawTarget, version] = requestLine.split(' ');
-
-    if (!method || !rawTarget || !version) {
-      denyProxyRequest(client, '400 Bad Request');
-      return;
-    }
-
-    let url: URL;
-    try {
-      url = new URL(rawTarget);
-    } catch {
-      const host = lines
-        .find((line) => line.toLowerCase().startsWith('host:'))
-        ?.slice(5)
-        .trim();
-      if (!host) {
-        denyProxyRequest(client, '400 Bad Request');
-        return;
-      }
-      url = new URL(`http://${host}${rawTarget}`);
-    }
-
-    if (!isDomainAllowed(url.hostname, config)) {
-      denyProxyRequest(client);
-      return;
-    }
-
-    const port = parseProxyPort(url.port || undefined, url.protocol === 'https:' ? 443 : 80);
-    if (port === null) {
-      denyProxyRequest(client, '400 Bad Request');
-      return;
-    }
-
-    const path = `${url.pathname}${url.search}` || '/';
-    lines[0] = `${method} ${path} ${version}`;
-
-    const rewrittenHeader = lines
-      .filter(
-        (line) =>
-          !line.toLowerCase().startsWith('proxy-connection:') &&
-          !line.toLowerCase().startsWith('proxy-authorization:'),
-      )
-      .join('\r\n');
-    const resolved = await resolveProxyEndpoint(url.hostname);
-    let settled = false;
-    const upstream = connectNet({ host: resolved.address, port, family: resolved.family }, () => {
-      settled = true;
-      upstream.write(`${rewrittenHeader}\r\n\r\n`);
-      pipeSockets(client, upstream, rest);
-    });
-    trackUpstream(upstream, client, () => settled);
-    upstream.once('error', () => {
-      if (settled) return;
-      settled = true;
-      denyProxyRequest(client, '502 Bad Gateway');
-    });
-  }
-
-  function handleClient(client: Socket): void {
-    sockets.add(client);
-    client.on('close', () => sockets.delete(client));
-    client.on('error', () => sockets.delete(client));
-
-    let buffered = Buffer.alloc(0);
-
-    client.on('data', (chunk: Buffer) => {
-      buffered = Buffer.concat([buffered, chunk]);
-      const headerEnd = buffered.indexOf('\r\n\r\n');
-      if (headerEnd === -1) {
-        if (buffered.length > 65536) {
-          client.removeAllListeners('data');
-          client.pause();
-          denyProxyRequest(client, '431 Request Header Fields Too Large');
-        }
-        return;
-      }
-
-      client.pause();
-      client.removeAllListeners('data');
-
-      const header = buffered.subarray(0, headerEnd).toString('utf-8');
-      const rest = buffered.subarray(headerEnd + 4);
-      if (authorization) {
-        const supplied = header
-          .split(/\r?\n/)
-          .find((line) => line.toLowerCase().startsWith('proxy-authorization:'))
-          ?.slice('proxy-authorization:'.length)
-          .trim();
-        if (supplied !== authorization) {
-          denyProxyRequest(client, '407 Proxy Authentication Required');
-          return;
-        }
-      }
-      const firstLine = header.split(/\r?\n/, 1)[0];
-      const [method, target] = (firstLine ?? '').split(' ');
-
-      const task =
-        method?.toUpperCase() === 'CONNECT' && target
-          ? handleConnect(client, target, rest)
-          : handleHttp(client, header, rest);
-      task.catch(() => denyProxyRequest(client, '502 Bad Gateway'));
-    });
-  }
-
-  const server = createServer(handleClient);
-  let stopped = false;
-
-  return new Promise((resolvePromise, reject) => {
-    server.on('error', reject);
-    server.listen(0, '127.0.0.1', () => {
-      server.removeListener('error', reject);
-      const address = server.address() as AddressInfo;
-
-      resolvePromise({
-        port: address.port,
-        stop: () =>
-          new Promise<void>((done) => {
-            if (stopped) {
-              done();
-              return;
-            }
-            stopped = true;
-            for (const socket of sockets) socket.destroy();
-            server.close(() => done());
-          }),
-      });
-    });
-  });
-}
-
 function proxyEnv(
   port: number | null,
   proxyToken?: string | null,
@@ -1008,8 +640,12 @@ function evaluateToolPermissions(
   }
 
   if (tool === 'write' || tool === 'edit') {
-    const path = getToolPath(args);
-    return path ? [evaluateWritePermission(path, config, baseDirectory, effectiveAllowWrite)] : [];
+    const paths = Array.isArray(args.paths)
+      ? args.paths.filter((path): path is string => typeof path === 'string')
+      : [getToolPath(args)].filter((path): path is string => path !== undefined);
+    return paths.map((path) =>
+      evaluateWritePermission(path, config, baseDirectory, effectiveAllowWrite),
+    );
   }
 
   if (tool === 'apply_patch' && typeof args.patchText === 'string') {
@@ -1043,12 +679,20 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     return `${callID}:${kind}:${resource}`;
   }
 
-  function rememberCallAllowance(
+  function rememberCallAllowances(
     callID: string | undefined,
-    decision: SandboxPermissionDecision,
+    approvals: readonly SandboxPermissionDecision[],
   ): void {
-    if (!callID || decision.status === 'deny') return;
-    callAllowances.add(allowanceKey(callID, decision.kind, decision.resource));
+    if (!callID) return;
+    for (const approval of approvals) {
+      callAllowances.add(allowanceKey(callID, approval.kind, approval.resource));
+    }
+  }
+
+  function clearCallAllowances(callID: string): void {
+    for (const key of callAllowances) {
+      if (key.startsWith(`${callID}:`)) callAllowances.delete(key);
+    }
   }
 
   function hasCallAllowance(callID: string, decision: SandboxPermissionDecision): boolean {
@@ -1073,26 +717,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     reportBlocked(decision);
   }
 
-  function pushCommandText(
-    input: { sessionID: string },
-    output: { parts: unknown[] },
-    text: string,
-  ): void {
-    output.parts.push({
-      type: 'text',
-      text,
-      id: '',
-      sessionID: input.sessionID,
-      messageID: '',
-    });
-  }
-
-  function buildSandboxSummary(config: SandboxConfig): string {
-    const { globalPath, projectPath } = getConfigPaths(directory);
-    const report = sandboxSummary(config, globalPath, projectPath);
-    return ['# Sandbox Configuration', '', report].join('\n');
-  }
-
   client.app
     ?.log?.({
       body: {
@@ -1241,13 +865,10 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
   }
 
   async function cleanupBash(callID: string): Promise<void> {
+    clearCallAllowances(callID);
     const state = activeBash.get(callID);
     if (!state) return;
 
-    for (const key of callAllowances) {
-      if (key.startsWith(`${callID}:`)) callAllowances.delete(key);
-    }
-
     activeBash.delete(callID);
     if (state.stop) await state.stop().catch(() => undefined);
     if (state.trapServer) {
@@ -1323,7 +944,12 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       proxyToken === null
         ? undefined
         : `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString('base64')}`;
-    const proxy = allowNetwork ? null : await startProxy(effectiveConfig, proxyAuthorization);
+    const proxy = allowNetwork
+      ? null
+      : await startFilterProxy({
+          isDomainAllowed: (domain) => isDomainAllowed(domain, effectiveConfig),
+          ...(proxyAuthorization === undefined ? {} : { authorization: proxyAuthorization }),
+        });
     const proxyPort = proxy ? proxy.port : null;
     let policy: { dir: string; path: string };
 
@@ -1387,10 +1013,7 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
     'permission.ask': async (input, output) => {
       const config = await activeConfig();
-      if (!config) {
-        output.status = 'allow';
-        return;
-      }
+      if (!config) return;
 
       const request = input as Record<string, unknown>;
       const permission = permissionType(request);
@@ -1409,7 +1032,10 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       const args: Record<string, unknown> = { ...metadata };
       if (permission === 'read') args.paths = patterns;
       if (permission === 'edit') {
-        args.path = typeof metadata.filepath === 'string' ? metadata.filepath : patterns[0];
+        args.paths =
+          patterns.length > 0
+            ? patterns
+            : [metadata.filepath].filter((path): path is string => typeof path === 'string');
       }
       if (permission === 'bash' && typeof args.command !== 'string') args.command = patterns[0];
       const decisions = evaluateToolPermissions(
@@ -1421,13 +1047,17 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
         effectiveAllowWrite,
       );
 
-      const decision =
-        decisions.find((item) => item.status === 'deny') ??
-        decisions.find((item) => item.status === 'ask');
-      if (!decision) return;
+      const denied = decisions.find((item) => item.status === 'deny');
+      if (denied) {
+        output.status = 'deny';
+        return;
+      }
+
+      const approvals = decisions.filter((item) => item.status === 'ask');
+      if (approvals.length === 0) return;
 
-      output.status = decision.status;
-      rememberCallAllowance(callID, decision);
+      output.status = 'ask';
+      rememberCallAllowances(callID, approvals);
     },
 
     'tool.execute.before': async (input, output) => {
@@ -1464,7 +1094,10 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     },
 
     'tool.execute.after': async (input, output) => {
-      if (input.tool !== 'bash') return;
+      if (input.tool !== 'bash') {
+        clearCallAllowances(input.callID);
+        return;
+      }
 
       const state = activeBash.get(input.callID);
       if (!state) {
@@ -1521,50 +1154,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       await cleanupBash(input.callID);
     },
 
-    'command.execute.before': async (input, output) => {
-      // OpenCode strips the leading slash before dispatching commands, so the
-      // hook receives the bare name ("sandbox"); accept both forms so the
-      // handler matches whether invoked by name or via tui.executeCommand.
-      const command = input.command.trim().replace(/^\//, '');
-      if (command === 'sandbox') {
-        const config = loadConfig(directory, optionOverrides);
-        pushCommandText(input, output, buildSandboxSummary(config));
-        await client.tui
-          ?.showToast?.({
-            body: { title: 'Sandbox', message: `Config loaded for ${directory}`, variant: 'info' },
-          })
-          ?.catch?.(() => undefined);
-        return;
-      }
-
-      // Check domain and filesystem in user shell commands (commands starting with !)
-      if (input.command.startsWith('!')) {
-        const shellCommand = input.command.slice(1).trim();
-        const config = await activeConfig();
-        if (!config) return;
-
-        const effectiveAllowRead = config.filesystem.allowRead;
-        const effectiveAllowWrite = config.filesystem.allowWrite;
-
-        for (const path of extractCandidatePaths(shellCommand)) {
-          const readDecision = evaluateReadPermission(path, config, directory, effectiveAllowRead);
-          if (readDecision.status === 'deny') reportBlocked(readDecision);
-
-          const writeDecision = evaluateWritePermission(
-            path,
-            config,
-            directory,
-            effectiveAllowWrite,
-          );
-          if (writeDecision.status === 'deny') reportBlocked(writeDecision);
-        }
-
-        for (const decision of evaluateCommandDomains(shellCommand, config)) {
-          if (decision.status !== 'allow') reportBlocked(decision);
-        }
-      }
-    },
-
     dispose: async () => {
       await Promise.all([...activeBash.keys()].map((callID) => cleanupBash(callID)));
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.18.35",
+  "version": "0.18.36",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.18.35",
+    "@landstrip/landstrip": "^0.18.36",
     "@opentui/solid": ">=0.3.4",
     "solid-js": "1.9.12"
   },

package/shared.ts

@@ -9,14 +9,19 @@ import {
 
 import {
   allowsAllDomains,
+  canonicalizeGlobPattern,
+  canonicalizePath,
   controlResponseLine,
   decodeLandstripTrap,
   domainMatchesAny,
   domainMatchesPattern,
   expandHomePath,
+  expandPath,
+  globToRegExp,
   formatLandstripTrap,
   formatLandstripTraps,
   isRecord,
+  normalizePathSeparators,
   parseLandstripTraps,
   pathUnderDirectory,
   sessionAllows,
@@ -25,14 +30,19 @@ import {
 
 export {
   allowsAllDomains,
+  canonicalizeGlobPattern,
+  canonicalizePath,
   controlResponseLine,
   decodeLandstripTrap,
   domainMatchesAny,
   domainMatchesPattern,
   expandHomePath,
+  expandPath,
+  globToRegExp,
   formatLandstripTrap,
   formatLandstripTraps,
   isRecord,
+  normalizePathSeparators,
   parseLandstripTraps,
   pathUnderDirectory,
   sessionAllows,
@@ -93,57 +103,97 @@ export function list(values: string[]): string {
   return values.join(', ') || '(none)';
 }
 
-function stringArray(value: unknown): string[] | undefined {
-  if (!Array.isArray(value)) return undefined;
-  return value.every((item) => typeof item === 'string') ? [...value] : undefined;
+function rejectUnknownFields(
+  value: Record<string, unknown>,
+  fields: readonly string[],
+  prefix = '',
+): void {
+  for (const field of Object.keys(value)) {
+    if (!fields.includes(field)) throw new Error(`unknown sandbox field ${prefix}${field}`);
+  }
+}
+
+function booleanValue(value: unknown, field: string): boolean | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'boolean') throw new Error(`${field} must be a boolean`);
+  return value;
+}
+
+function stringArray(value: unknown, field: string): string[] | undefined {
+  if (value === undefined) return undefined;
+  if (!Array.isArray(value) || [...value].some((item) => typeof item !== 'string')) {
+    throw new Error(`${field} must be an array of strings`);
+  }
+  return [...value];
 }
 
 function normalizeNetworkConfig(value: unknown): Partial<SandboxNetworkConfig> | undefined {
-  if (!isRecord(value)) return undefined;
+  if (value === undefined) return undefined;
+  if (!isRecord(value)) throw new Error('network must be an object');
+  rejectUnknownFields(
+    value,
+    [
+      'allowNetwork',
+      'allowLocalBinding',
+      'allowAllUnixSockets',
+      'allowUnixSockets',
+      'allowedDomains',
+      'deniedDomains',
+    ],
+    'network.',
+  );
 
   const config: Partial<SandboxNetworkConfig> = {};
-  if (typeof value.allowNetwork === 'boolean') config.allowNetwork = value.allowNetwork;
-  if (typeof value.allowLocalBinding === 'boolean')
-    config.allowLocalBinding = value.allowLocalBinding;
-  if (typeof value.allowAllUnixSockets === 'boolean')
-    config.allowAllUnixSockets = value.allowAllUnixSockets;
+  const allowNetwork = booleanValue(value.allowNetwork, 'network.allowNetwork');
+  if (allowNetwork !== undefined) config.allowNetwork = allowNetwork;
+  const allowLocalBinding = booleanValue(value.allowLocalBinding, 'network.allowLocalBinding');
+  if (allowLocalBinding !== undefined) config.allowLocalBinding = allowLocalBinding;
+  const allowAllUnixSockets = booleanValue(
+    value.allowAllUnixSockets,
+    'network.allowAllUnixSockets',
+  );
+  if (allowAllUnixSockets !== undefined) config.allowAllUnixSockets = allowAllUnixSockets;
 
-  const allowUnixSockets = stringArray(value.allowUnixSockets);
+  const allowUnixSockets = stringArray(value.allowUnixSockets, 'network.allowUnixSockets');
   if (allowUnixSockets) config.allowUnixSockets = allowUnixSockets;
 
-  const allowedDomains = stringArray(value.allowedDomains);
+  const allowedDomains = stringArray(value.allowedDomains, 'network.allowedDomains');
   if (allowedDomains) config.allowedDomains = allowedDomains;
 
-  const deniedDomains = stringArray(value.deniedDomains);
+  const deniedDomains = stringArray(value.deniedDomains, 'network.deniedDomains');
   if (deniedDomains) config.deniedDomains = deniedDomains;
 
   return config;
 }
 
 function normalizeFilesystemConfig(value: unknown): Partial<SandboxFilesystemConfig> | undefined {
-  if (!isRecord(value)) return undefined;
+  if (value === undefined) return undefined;
+  if (!isRecord(value)) throw new Error('filesystem must be an object');
+  rejectUnknownFields(value, ['denyRead', 'allowRead', 'allowWrite', 'denyWrite'], 'filesystem.');
 
   const config: Partial<SandboxFilesystemConfig> = {};
-  const denyRead = stringArray(value.denyRead);
+  const denyRead = stringArray(value.denyRead, 'filesystem.denyRead');
   if (denyRead) config.denyRead = denyRead;
 
-  const allowRead = stringArray(value.allowRead);
+  const allowRead = stringArray(value.allowRead, 'filesystem.allowRead');
   if (allowRead) config.allowRead = allowRead;
 
-  const allowWrite = stringArray(value.allowWrite);
+  const allowWrite = stringArray(value.allowWrite, 'filesystem.allowWrite');
   if (allowWrite) config.allowWrite = allowWrite;
 
-  const denyWrite = stringArray(value.denyWrite);
+  const denyWrite = stringArray(value.denyWrite, 'filesystem.denyWrite');
   if (denyWrite) config.denyWrite = denyWrite;
 
   return config;
 }
 
 export function normalizeConfig(value: unknown): SandboxConfigOverrides {
-  if (!isRecord(value)) return {};
+  if (!isRecord(value)) throw new Error('sandbox config must be an object');
+  rejectUnknownFields(value, ['enabled', 'network', 'filesystem']);
 
   const config: SandboxConfigOverrides = {};
-  if (typeof value.enabled === 'boolean') config.enabled = value.enabled;
+  const enabled = booleanValue(value.enabled, 'enabled');
+  if (enabled !== undefined) config.enabled = enabled;
 
   const network = normalizeNetworkConfig(value.network);
   if (network) config.network = network;
@@ -156,7 +206,9 @@ export function normalizeConfig(value: unknown): SandboxConfigOverrides {
 
 export function normalizeOptions(options: unknown): SandboxConfigOverrides {
   if (!isRecord(options)) return {};
-  return normalizeConfig(isRecord(options.config) ? options.config : options);
+  if (options.config === undefined) return normalizeConfig(options);
+  if (!isRecord(options.config)) throw new Error('config must be an object');
+  return normalizeConfig(options.config);
 }
 
 function mergeArray(base: string[], override?: string[]): string[] {
@@ -194,15 +246,16 @@ export function getConfigPaths(baseDirectory: string): { globalPath: string; pro
   };
 }
 
-// Returns `{}` when the file is absent and `null` when it exists but cannot be
-// parsed, so callers can refuse to overwrite a corrupted config.
-export function readConfigFile(configPath: string): SandboxConfigOverrides | null {
+export function readConfigFile(configPath: string): SandboxConfigOverrides {
   if (!existsSync(configPath)) return {};
 
   try {
     return normalizeConfig(JSON.parse(readFileSync(configPath, 'utf-8')));
-  } catch {
-    return null;
+  } catch (error) {
+    throw new Error(
+      `Could not load ${configPath}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    );
   }
 }
 
@@ -219,17 +272,14 @@ export function loadConfig(
   }
 
   const templateConfig: SandboxConfig = JSON.parse(readFileSync(templatePath, 'utf-8'));
-  const globalOverrides = readConfigFile(globalPath) ?? {};
+  const globalOverrides = readConfigFile(globalPath);
   const baseConfig = deepMerge(templateConfig, globalOverrides);
 
-  return deepMerge(deepMerge(baseConfig, readConfigFile(projectPath) ?? {}), optionOverrides);
+  return deepMerge(deepMerge(baseConfig, readConfigFile(projectPath)), optionOverrides);
 }
 
 export function writeConfigFile(configPath: string, update: SandboxConfigOverrides): void {
   const current = readConfigFile(configPath);
-  if (current === null) {
-    throw new Error(`Config file ${configPath} is corrupted; refusing to overwrite`);
-  }
 
   const templateConfig: SandboxConfig = JSON.parse(
     readFileSync(join(packageDir, 'sandbox.json'), 'utf-8'),
@@ -482,7 +532,7 @@ export function discoveryFilePath(baseDirectory: string): string {
   return join(discoveryDir(), `port-${directoryHash(baseDirectory)}.json`);
 }
 
-// /sandbox toggles the persisted `enabled` flag. Write it where the setting
+// /landstrip toggles the persisted `enabled` flag. Write it where the setting
 // already lives — the project config if it sets `enabled`, otherwise the global
 // config — and return the scope written so the UI can report it.
 export function sandboxConfigTarget(baseDirectory: string): {
@@ -490,8 +540,7 @@ export function sandboxConfigTarget(baseDirectory: string): {
   path: string;
 } {
   const { globalPath, projectPath } = getConfigPaths(baseDirectory);
-  const projectConfig = readConfigFile(projectPath);
-  const useProject = projectConfig !== null && projectConfig.enabled !== undefined;
+  const useProject = readConfigFile(projectPath).enabled !== undefined;
   return useProject
     ? { scope: 'project', path: projectPath }
     : { scope: 'global', path: globalPath };
@@ -500,7 +549,12 @@ export function sandboxConfigTarget(baseDirectory: string): {
 export function setSandboxConfigEnabled(
   baseDirectory: string,
   enabled: boolean,
+  optionOverrides: SandboxConfigOverrides = {},
 ): 'project' | 'global' {
+  if (optionOverrides.enabled !== undefined) {
+    throw new Error('Sandbox state is managed by plugin options');
+  }
+
   const target = sandboxConfigTarget(baseDirectory);
   writeConfigFile(target.path, { enabled });
   return target.scope;

package/tui.ts

@@ -125,6 +125,7 @@ function selectedForeground(background: RGBA): RGBA {
 
 const tui: TuiPlugin = async (api, options, meta) => {
   const optionOverrides = normalizeOptions(options);
+  const enabledManagedByOptions = optionOverrides.enabled !== undefined;
 
   function LandstripPermissionPrompt(rawProps: Record<string, unknown>) {
     const props = rawProps as unknown as PermissionPromptProps<string>;
@@ -147,9 +148,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
       priority: 1000,
       bindings: [
         { key: 'left', desc: 'Previous permission option', group: 'Sandbox', cmd: () => move(-1) },
-        { key: 'h', desc: 'Previous permission option', group: 'Sandbox', cmd: () => move(-1) },
         { key: 'right', desc: 'Next permission option', group: 'Sandbox', cmd: () => move(1) },
-        { key: 'l', desc: 'Next permission option', group: 'Sandbox', cmd: () => move(1) },
         { key: 'return', desc: 'Select permission option', group: 'Sandbox', cmd: submit },
         { key: 'escape', desc: 'Reject permission', group: 'Sandbox', cmd: props.onCancel },
         {
@@ -690,58 +689,176 @@ const tui: TuiPlugin = async (api, options, meta) => {
     refreshPermissionPresentation,
   );
 
-  // /sandbox toggles the persisted `enabled` flag. The server reads
-  // sandbox.json on every tool call, so the toggle takes effect on the next
-  // command without any cross-process signalling.
-  const showSandbox = () => {
+  const [landstripOpen, setLandstripOpen] = createSignal(false);
+  const [confirmingDisable, setConfirmingDisable] = createSignal(false);
+  const [sandboxRevision, setSandboxRevision] = createSignal(0);
+  let unregisterLandstripKeys: (() => void) | undefined;
+  let popLandstripMode: (() => void) | undefined;
+
+  const closeLandstrip = () => {
+    unregisterLandstripKeys?.();
+    popLandstripMode?.();
+    unregisterLandstripKeys = undefined;
+    popLandstripMode = undefined;
+    setConfirmingDisable(false);
+    setLandstripOpen(false);
+  };
+  const toggleLandstrip = () => {
+    if (enabledManagedByOptions) {
+      api.ui.toast({
+        title: 'Landstrip',
+        message: 'Sandbox state is managed by plugin options',
+        variant: 'warning',
+      });
+      return;
+    }
+
     const directory = api.state.path.directory || process.cwd();
     const config = loadConfig(directory, optionOverrides);
-    const next = !config.enabled;
-    const target = sandboxConfigTarget(directory);
-    const message = [
-      `Sandbox is ${config.enabled ? 'enabled' : 'disabled'}.`,
-      `Network: ${config.network.allowNetwork ? 'open' : 'proxied'}`,
-      `Change: ${target.scope} config at ${formatPath(target.path, directory)}`,
-    ].join('\n');
-
-    // No `clear()` in onConfirm: the host pops the dialog itself, and its
-    // `clear()` re-invokes onClose, which would recurse and freeze the TUI.
-    api.ui.dialog.replace(() =>
-      api.ui.DialogConfirm({
-        title: next ? 'Enable sandbox?' : 'Disable sandbox?',
-        message,
-        onConfirm: () => {
-          const scope = setSandboxConfigEnabled(directory, next);
-          refreshSandboxStatus?.();
-          api.ui.toast({
-            title: 'Sandbox',
-            message: `Sandbox ${next ? 'enabled' : 'disabled'} (${scope} config)`,
-            variant: next ? 'success' : 'warning',
-          });
-        },
-      }),
-    );
+    if (config.enabled && !confirmingDisable()) {
+      setConfirmingDisable(true);
+      return;
+    }
+    setConfirmingDisable(false);
+    const enabled = !config.enabled;
+    const scope = setSandboxConfigEnabled(directory, enabled, optionOverrides);
+    refreshSandboxStatus?.();
+    api.ui.toast({
+      title: 'Landstrip',
+      message: `Sandbox ${enabled ? 'enabled' : 'disabled'} (${scope} config)`,
+      variant: enabled ? 'success' : 'warning',
+    });
+  };
+  const cancelLandstrip = () => {
+    if (confirmingDisable()) setConfirmingDisable(false);
+    else closeLandstrip();
+  };
+
+  function LandstripPane() {
+    const theme = api.theme.current;
+    const dimensions = useTerminalDimensions();
+
+    const row = (label: string, value: string) =>
+      jsxs('box', {
+        flexDirection: 'row',
+        paddingLeft: 2,
+        paddingRight: 2,
+        children: [
+          jsx('text', { fg: theme.textMuted, width: 22, children: label }),
+          jsx('text', { fg: theme.text, flexGrow: 1, wrapMode: 'word', children: value }),
+        ],
+      });
+
+    return Portal({
+      get children() {
+        if (!landstripOpen()) return null;
+        sandboxRevision();
+        const directory = api.state.path.directory || process.cwd();
+        const config = loadConfig(directory, optionOverrides);
+        const target = sandboxConfigTarget(directory);
+        const values = (items: readonly string[]) => items.join(', ') || 'none';
+        const status = enabledManagedByOptions
+          ? config.enabled
+            ? 'Active (plugin options)'
+            : 'Disabled by plugin options'
+          : config.enabled
+            ? 'Active'
+            : 'Disabled by configuration';
+        return jsxs('box', {
+          position: 'absolute',
+          zIndex: 4000,
+          bottom: 0,
+          left: 0,
+          right: 0,
+          get height() {
+            return Math.min(22, Math.max(12, dimensions().height - 2));
+          },
+          flexDirection: 'column',
+          border: ['top'],
+          borderColor: theme.primary,
+          backgroundColor: theme.backgroundPanel,
+          children: [
+            jsxs('box', {
+              flexDirection: 'row',
+              paddingLeft: 2,
+              paddingRight: 2,
+              paddingTop: 1,
+              paddingBottom: 1,
+              justifyContent: 'space-between',
+              children: [
+                jsx('text', { fg: theme.primary, children: 'Landstrip' }),
+                jsx('text', {
+                  fg: config.enabled ? theme.success : theme.warning,
+                  children: status,
+                }),
+              ],
+            }),
+            row('Network', config.network.allowNetwork ? 'Unrestricted' : 'Proxied'),
+            row('Allowed Domains', values(config.network.allowedDomains)),
+            row('Denied Domains', values(config.network.deniedDomains)),
+            row('Allowed Reads', values(config.filesystem.allowRead)),
+            row('Denied Reads', values(config.filesystem.denyRead)),
+            row('Allowed Writes', values(config.filesystem.allowWrite)),
+            row('Denied Writes', values(config.filesystem.denyWrite)),
+            row(
+              'Configuration Scope',
+              enabledManagedByOptions
+                ? 'Plugin options'
+                : target.scope === 'project'
+                  ? 'Project'
+                  : 'Global',
+            ),
+            row('Configuration File', formatPath(target.path, directory)),
+            jsx('box', { flexGrow: 1 }),
+            jsx('text', {
+              fg: confirmingDisable() ? theme.error : theme.textMuted,
+              marginLeft: 2,
+              marginRight: 2,
+              marginBottom: 1,
+              children: confirmingDisable()
+                ? 'Disable the sandbox? Commands will run without OS isolation.  Enter confirm · Esc cancel'
+                : enabledManagedByOptions
+                  ? 'Sandbox state is managed by plugin options · Esc close'
+                  : `Enter ${config.enabled ? 'disable' : 'enable'} · Esc close`,
+            }),
+          ],
+        });
+      },
+    });
+  }
+
+  const showLandstrip = () => {
+    if (landstripOpen()) return;
+    setLandstripOpen(true);
+    popLandstripMode = api.mode.push('modal');
+    unregisterLandstripKeys = api.keymap.registerLayer({
+      priority: 1000,
+      bindings: [
+        { key: 'return', desc: 'Toggle sandbox', group: 'Landstrip', cmd: toggleLandstrip },
+        { key: 'escape', desc: 'Close Landstrip', group: 'Landstrip', cmd: cancelLandstrip },
+      ],
+    });
   };
+  api.lifecycle.onDispose(closeLandstrip);
 
   api.keymap.registerLayer({
     commands: [
       {
         namespace: 'palette',
-        name: 'sandbox',
-        title: 'Sandbox',
-        desc: 'Inspect and toggle the sandbox',
-        category: 'Sandbox',
+        name: 'landstrip',
+        title: 'Landstrip',
+        desc: 'Manage the Landstrip sandbox',
+        category: 'Landstrip',
         suggested: true,
-        slash: { name: 'sandbox' },
-        slashName: 'sandbox',
-        run: showSandbox,
+        slash: { name: 'landstrip' },
+        slashName: 'landstrip',
+        run: showLandstrip,
       },
     ],
   });
 
   // Persistent status badge in the prompt area.
   try {
-    const [sandboxRevision, setSandboxRevision] = createSignal(0);
     const statusBadge = (ctx: TuiSlotContext) => {
       sandboxRevision();
       const directory = api.state.path.directory || process.cwd();
@@ -759,6 +876,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
 
     const statusSlot: TuiSlotPlugin = {
       slots: {
+        app: () => jsx(LandstripPane, {}),
         home_prompt_right: (ctx) => statusBadge(ctx),
         session_prompt: (_ctx, props) => renderSessionPrompt(props),
         session_prompt_right: (ctx) => statusBadge(ctx),
@@ -767,7 +885,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
     api.slots.register(statusSlot);
     refreshSandboxStatus = () => setSandboxRevision((revision) => revision + 1);
   } catch {
-    // Solid runtime unavailable on this host — skip the status badge.
+    // Solid runtime unavailable on this host — skip the pane and status badge.
   }
 
   // First-run onboarding: a single quiet pointer to the default-strict policy
@@ -777,7 +895,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
     api.kv.set('onboarded', true);
     api.ui.toast({
       title: 'Sandbox active',
-      message: 'Landstrip sandbox is on. Run /sandbox to inspect it.',
+      message: 'Landstrip sandbox is on. Run /landstrip to inspect it.',
       variant: 'info',
       duration: 8000,
     });