opencode-landstrip 0.18.41 → 0.18.42

package/index.ts

@@ -74,11 +74,6 @@ const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 const DISCOVERY_CONNECT_TIMEOUT_MS = 250;
 
-function configuredShellPath(config: unknown): string | undefined {
-  if (!isRecord(config)) return undefined;
-  return typeof config.shell === 'string' ? config.shell : undefined;
-}
-
 function normalizePathForMatch(filePath: string): string {
   return process.platform === 'win32' ? normalizePathSeparators(filePath).toLowerCase() : filePath;
 }
@@ -310,12 +305,6 @@ function evaluateCommandDomains(
   );
 }
 
-function landstripVersion(): string | null {
-  const result = spawnSync(landstripBinaryPath(), ['--version'], { encoding: 'utf-8' });
-  if (result.status !== 0) return null;
-  return result.stdout.trim();
-}
-
 function parseVersion(version: string): [number, number, number] | null {
   const match = version.match(/\b(\d+)\.(\d+)\.(\d+)\b/);
   if (!match) return null;
@@ -492,12 +481,6 @@ function trapPortAcceptsConnections(port: number): Promise<boolean> {
   });
 }
 
-async function readLiveDiscoveryPort(baseDirectory: string): Promise<number | null> {
-  const port = readDiscoveryPort(baseDirectory);
-  if (port === null) return null;
-  return (await trapPortAcceptsConnections(port)) ? port : null;
-}
-
 function buildWrappedCommand(
   policyPath: string,
   shell: string,
@@ -542,10 +525,6 @@ function isGeneratedWrappedCommand(command: string): boolean {
   );
 }
 
-function landstripDescription(description: string): string {
-  return description.endsWith(' (landstrip)') ? description : `${description} (landstrip)`;
-}
-
 function splitShellQuotedArgs(command: string): string[] {
   const args: string[] = [];
   let i = 0;
@@ -597,10 +576,6 @@ function getToolPath(args: Record<string, unknown>): string | undefined {
   return typeof filePath === 'string' ? filePath : undefined;
 }
 
-function getSearchPath(args: Record<string, unknown>): string {
-  return typeof args.path === 'string' ? args.path : '.';
-}
-
 function extractPatchPaths(patchText: string): string[] {
   const paths: string[] = [];
 
@@ -636,7 +611,8 @@ function evaluateToolPermissions(
   }
 
   if (tool === 'glob' || tool === 'grep' || tool === 'list') {
-    return [evaluateReadPermission(getSearchPath(args), config, baseDirectory, effectiveAllowRead)];
+    const searchPath = typeof args.path === 'string' ? args.path : '.';
+    return [evaluateReadPermission(searchPath, config, baseDirectory, effectiveAllowRead)];
   }
 
   if (tool === 'write' || tool === 'edit') {
@@ -679,16 +655,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     return `${callID}:${kind}:${resource}`;
   }
 
-  function rememberCallAllowances(
-    callID: string | undefined,
-    approvals: readonly SandboxPermissionDecision[],
-  ): void {
-    if (!callID) return;
-    for (const approval of approvals) {
-      callAllowances.add(allowanceKey(callID, approval.kind, approval.resource));
-    }
-  }
-
   function clearCallAllowances(callID: string): void {
     for (const key of callAllowances) {
       if (key.startsWith(`${callID}:`)) callAllowances.delete(key);
@@ -712,11 +678,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     throw errorWithConfigPaths(directory, decision.message);
   }
 
-  function enforcePermission(callID: string, decision: SandboxPermissionDecision): void {
-    if (decision.status === 'allow' || hasCallAllowance(callID, decision)) return;
-    reportBlocked(decision);
-  }
-
   client.app
     ?.log?.({
       body: {
@@ -787,7 +748,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
     let version: string | null;
     try {
-      version = landstripVersion();
+      const result = spawnSync(landstripBinaryPath(), ['--version'], { encoding: 'utf-8' });
+      version = result.status === 0 ? result.stdout.trim() : null;
     } catch (error) {
       landstripCheck = {
         ok: false,
@@ -889,8 +851,9 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     const normalizedSessionID = sessionID?.trim() || undefined;
 
     const rewriteDescription = (): void => {
-      if (typeof args.description === 'string')
-        args.description = landstripDescription(args.description);
+      if (typeof args.description === 'string' && !args.description.endsWith(' (landstrip)')) {
+        args.description = `${args.description} (landstrip)`;
+      }
     };
 
     const existing = activeBash.get(callID);
@@ -965,9 +928,11 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     // The TUI owns interactive query handling. Fall back to an in-process
     // broker when no TUI endpoint or session identity is available.
     const interactiveSessionID = normalizedSessionID ?? '';
+    const discoveredPort =
+      process.platform === 'linux' && interactiveSessionID ? readDiscoveryPort(directory) : null;
     const tuiTrapPort =
-      process.platform === 'linux' && interactiveSessionID
-        ? await readLiveDiscoveryPort(directory)
+      discoveredPort !== null && (await trapPortAcceptsConnections(discoveredPort))
+        ? discoveredPort
         : null;
     const trapServer =
       tuiTrapPort === null
@@ -1008,7 +973,9 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
   const hooks: Hooks = {
     config: async (config) => {
-      configuredShell = configuredShellPath(config);
+      const value: unknown = config;
+      configuredShell =
+        isRecord(value) && typeof value.shell === 'string' ? value.shell : undefined;
     },
 
     'permission.ask': async (input, output) => {
@@ -1057,7 +1024,11 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       if (approvals.length === 0) return;
 
       output.status = 'ask';
-      rememberCallAllowances(callID, approvals);
+      if (callID) {
+        for (const approval of approvals) {
+          callAllowances.add(allowanceKey(callID, approval.kind, approval.resource));
+        }
+      }
     },
 
     'tool.execute.before': async (input, output) => {
@@ -1080,7 +1051,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
         config.filesystem.allowWrite,
       );
       for (const decision of decisions) {
-        enforcePermission(input.callID, decision);
+        if (decision.status === 'allow' || hasCallAllowance(input.callID, decision)) continue;
+        reportBlocked(decision);
       }
     },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.18.41",
+  "version": "0.18.42",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.18.41",
+    "@landstrip/landstrip-api": "^0.18.42",
     "@opentui/core": ">=0.3.4",
     "@opentui/solid": ">=0.3.4",
     "solid-js": "1.9.12"

package/tui.ts

@@ -118,11 +118,6 @@ function formatPath(input: string, base: string): string {
   return absolute;
 }
 
-function selectedForeground(background: RGBA): RGBA {
-  const luminance = 0.2126 * background.r + 0.7152 * background.g + 0.0722 * background.b;
-  return luminance > 0.5 ? RGBA.fromInts(0, 0, 0) : RGBA.fromInts(255, 255, 255);
-}
-
 const tui: TuiPlugin = async (api, options, meta) => {
   const optionOverrides = normalizeOptions(options);
   const enabledManagedByOptions = optionOverrides.enabled !== undefined;
@@ -176,7 +171,10 @@ const tui: TuiPlugin = async (api, options, meta) => {
         },
         children: jsx('text', {
           get fg() {
-            return selected() === index ? selectedForeground(theme.warning) : theme.textMuted;
+            if (selected() !== index) return theme.textMuted;
+            const background = theme.warning;
+            const luminance = 0.2126 * background.r + 0.7152 * background.g + 0.0722 * background.b;
+            return luminance > 0.5 ? RGBA.fromInts(0, 0, 0) : RGBA.fromInts(255, 255, 255);
           },
           children: option.label,
         }),
@@ -333,14 +331,11 @@ const tui: TuiPlugin = async (api, options, meta) => {
     );
   }
 
-  function currentRouteSessionID(): string | undefined {
-    const route = api.route.current;
-    if (route.name !== 'session' || !route.params) return undefined;
-    return typeof route.params.sessionID === 'string' ? route.params.sessionID : undefined;
-  }
-
   function pump(): void {
-    const routeSessionID = currentRouteSessionID();
+    const route = api.route.current;
+    if (route.name !== 'session' || !route.params) return;
+    const routeSessionID =
+      typeof route.params.sessionID === 'string' ? route.params.sessionID : undefined;
     if (!routeSessionID) return;
 
     const active = activeEntry();
@@ -360,8 +355,8 @@ const tui: TuiPlugin = async (api, options, meta) => {
     if (index === -1) return;
     const [next] = queue.splice(index, 1);
     if (!next) return;
-    if (next.kind === 'fs-query') showFsQuery(next);
-    else showNetworkQuery(next);
+    activeId = next.id;
+    setActiveEntry(next);
   }
 
   function enqueueEntry(entry: QueueEntry): void {
@@ -505,10 +500,6 @@ const tui: TuiPlugin = async (api, options, meta) => {
     }
   }
 
-  function showFsQuery(entry: FsQueryEntry): void {
-    activeId = entry.id;
-    setActiveEntry(entry);
-  }
   function resolveNetworkQuery(entry: NetworkQueryEntry, choice: NetworkQueryChoice): void {
     if (resolved.has(entry.id)) return;
     const action = choice === 'deny' ? 'deny' : 'allow';
@@ -533,11 +524,6 @@ const tui: TuiPlugin = async (api, options, meta) => {
     }
   }
 
-  function showNetworkQuery(entry: NetworkQueryEntry): void {
-    activeId = entry.id;
-    setActiveEntry(entry);
-  }
-
   // Query-response socket server (Linux-only — landstrip's socket protocol lives
   // in the seccomp broker). The server plugin connects each sandboxed run's
   // fd 3 here via a /dev/tcp redirect and we answer held writes interactively.