opencode-landstrip 0.18.41 → 0.18.43

package/index.ts

@@ -74,17 +74,12 @@ const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 const DISCOVERY_CONNECT_TIMEOUT_MS = 250;
 
-function configuredShellPath(config: unknown): string | undefined {
-  if (!isRecord(config)) return undefined;
-  return typeof config.shell === 'string' ? config.shell : undefined;
-}
-
 function normalizePathForMatch(filePath: string): string {
   return process.platform === 'win32' ? normalizePathSeparators(filePath).toLowerCase() : filePath;
 }
 
-// Component count of an absolute path; "/" is 0. Used to rank how specific a
-// matching pattern is so the most specific allow/deny rule wins.
+// Component count of an absolute path; "/" is 0. Read rules use it to rank
+// matching allow and deny patterns by specificity.
 function pathDepth(absolutePath: string): number {
   return absolutePath.split('/').filter((segment) => segment.length > 0).length;
 }
@@ -140,7 +135,7 @@ function isDomainAllowed(domain: string, config: SandboxConfig): boolean {
   );
 }
 
-function isFilesystemAllowed(
+function isReadAllowed(
   path: string,
   allowPatterns: string[],
   denyPatterns: string[],
@@ -151,6 +146,16 @@ function isFilesystemAllowed(
   return allowDepth >= 0 && allowDepth >= denyDepth;
 }
 
+function writeAccess(
+  path: string,
+  allowPatterns: string[],
+  denyPatterns: string[],
+  baseDirectory: string,
+): 'allow' | 'deny' | 'unlisted' {
+  if (matchDepth(path, denyPatterns, baseDirectory) >= 0) return 'deny';
+  return matchDepth(path, allowPatterns, baseDirectory) >= 0 ? 'allow' : 'unlisted';
+}
+
 function extractCandidatePaths(command: string): string[] {
   const paths: string[] = [];
   const tokens = command.match(/[^\s"']+|"[^"]*"|'[^']*'/g) ?? [];
@@ -224,9 +229,7 @@ function evaluateReadPermission(
   // everything else asks for approval (allow once/session/persist or reject)
   // rather than being blocked outright. denyRead still hard-applies to bash
   // through the landstrip binary policy, which has no way to prompt.
-  if (
-    isFilesystemAllowed(filePath, effectiveAllowRead, config.filesystem.denyRead, baseDirectory)
-  ) {
+  if (isReadAllowed(filePath, effectiveAllowRead, config.filesystem.denyRead, baseDirectory)) {
     return { status: 'allow', kind: 'read', resource: filePath, message: '' };
   }
 
@@ -245,10 +248,14 @@ function evaluateWritePermission(
   effectiveAllowWrite: string[],
 ): SandboxPermissionDecision {
   const filePath = canonicalizePath(path, baseDirectory);
-  const allowDepth = matchDepth(filePath, effectiveAllowWrite, baseDirectory);
-  const denyDepth = matchDepth(filePath, config.filesystem.denyWrite, baseDirectory);
+  const access = writeAccess(
+    filePath,
+    effectiveAllowWrite,
+    config.filesystem.denyWrite,
+    baseDirectory,
+  );
 
-  if (denyDepth >= 0 && denyDepth >= allowDepth) {
+  if (access === 'deny') {
     return {
       status: 'deny',
       kind: 'write',
@@ -257,9 +264,7 @@ function evaluateWritePermission(
     };
   }
 
-  if (
-    isFilesystemAllowed(filePath, effectiveAllowWrite, config.filesystem.denyWrite, baseDirectory)
-  ) {
+  if (access === 'allow') {
     return { status: 'allow', kind: 'write', resource: filePath, message: '' };
   }
 
@@ -310,12 +315,6 @@ function evaluateCommandDomains(
   );
 }
 
-function landstripVersion(): string | null {
-  const result = spawnSync(landstripBinaryPath(), ['--version'], { encoding: 'utf-8' });
-  if (result.status !== 0) return null;
-  return result.stdout.trim();
-}
-
 function parseVersion(version: string): [number, number, number] | null {
   const match = version.match(/\b(\d+)\.(\d+)\.(\d+)\b/);
   if (!match) return null;
@@ -438,8 +437,8 @@ function startTrapServer(
             const operation = trap.operation;
             const allowed =
               operation === 'read'
-                ? isFilesystemAllowed(path, effectiveAllowRead, denyRead, baseDirectory)
-                : isFilesystemAllowed(path, effectiveAllowWrite, denyWrite, baseDirectory);
+                ? isReadAllowed(path, effectiveAllowRead, denyRead, baseDirectory)
+                : writeAccess(path, effectiveAllowWrite, denyWrite, baseDirectory) === 'allow';
             if (allowed) {
               trapSocket.write(controlResponseLine(queryId, 'allow'));
             } else {
@@ -492,12 +491,6 @@ function trapPortAcceptsConnections(port: number): Promise<boolean> {
   });
 }
 
-async function readLiveDiscoveryPort(baseDirectory: string): Promise<number | null> {
-  const port = readDiscoveryPort(baseDirectory);
-  if (port === null) return null;
-  return (await trapPortAcceptsConnections(port)) ? port : null;
-}
-
 function buildWrappedCommand(
   policyPath: string,
   shell: string,
@@ -542,10 +535,6 @@ function isGeneratedWrappedCommand(command: string): boolean {
   );
 }
 
-function landstripDescription(description: string): string {
-  return description.endsWith(' (landstrip)') ? description : `${description} (landstrip)`;
-}
-
 function splitShellQuotedArgs(command: string): string[] {
   const args: string[] = [];
   let i = 0;
@@ -597,10 +586,6 @@ function getToolPath(args: Record<string, unknown>): string | undefined {
   return typeof filePath === 'string' ? filePath : undefined;
 }
 
-function getSearchPath(args: Record<string, unknown>): string {
-  return typeof args.path === 'string' ? args.path : '.';
-}
-
 function extractPatchPaths(patchText: string): string[] {
   const paths: string[] = [];
 
@@ -636,7 +621,8 @@ function evaluateToolPermissions(
   }
 
   if (tool === 'glob' || tool === 'grep' || tool === 'list') {
-    return [evaluateReadPermission(getSearchPath(args), config, baseDirectory, effectiveAllowRead)];
+    const searchPath = typeof args.path === 'string' ? args.path : '.';
+    return [evaluateReadPermission(searchPath, config, baseDirectory, effectiveAllowRead)];
   }
 
   if (tool === 'write' || tool === 'edit') {
@@ -679,16 +665,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     return `${callID}:${kind}:${resource}`;
   }
 
-  function rememberCallAllowances(
-    callID: string | undefined,
-    approvals: readonly SandboxPermissionDecision[],
-  ): void {
-    if (!callID) return;
-    for (const approval of approvals) {
-      callAllowances.add(allowanceKey(callID, approval.kind, approval.resource));
-    }
-  }
-
   function clearCallAllowances(callID: string): void {
     for (const key of callAllowances) {
       if (key.startsWith(`${callID}:`)) callAllowances.delete(key);
@@ -712,11 +688,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     throw errorWithConfigPaths(directory, decision.message);
   }
 
-  function enforcePermission(callID: string, decision: SandboxPermissionDecision): void {
-    if (decision.status === 'allow' || hasCallAllowance(callID, decision)) return;
-    reportBlocked(decision);
-  }
-
   client.app
     ?.log?.({
       body: {
@@ -787,7 +758,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
     let version: string | null;
     try {
-      version = landstripVersion();
+      const result = spawnSync(landstripBinaryPath(), ['--version'], { encoding: 'utf-8' });
+      version = result.status === 0 ? result.stdout.trim() : null;
     } catch (error) {
       landstripCheck = {
         ok: false,
@@ -889,8 +861,9 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     const normalizedSessionID = sessionID?.trim() || undefined;
 
     const rewriteDescription = (): void => {
-      if (typeof args.description === 'string')
-        args.description = landstripDescription(args.description);
+      if (typeof args.description === 'string' && !args.description.endsWith(' (landstrip)')) {
+        args.description = `${args.description} (landstrip)`;
+      }
     };
 
     const existing = activeBash.get(callID);
@@ -965,9 +938,11 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     // The TUI owns interactive query handling. Fall back to an in-process
     // broker when no TUI endpoint or session identity is available.
     const interactiveSessionID = normalizedSessionID ?? '';
+    const discoveredPort =
+      process.platform === 'linux' && interactiveSessionID ? readDiscoveryPort(directory) : null;
     const tuiTrapPort =
-      process.platform === 'linux' && interactiveSessionID
-        ? await readLiveDiscoveryPort(directory)
+      discoveredPort !== null && (await trapPortAcceptsConnections(discoveredPort))
+        ? discoveredPort
         : null;
     const trapServer =
       tuiTrapPort === null
@@ -1008,7 +983,9 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
   const hooks: Hooks = {
     config: async (config) => {
-      configuredShell = configuredShellPath(config);
+      const value: unknown = config;
+      configuredShell =
+        isRecord(value) && typeof value.shell === 'string' ? value.shell : undefined;
     },
 
     'permission.ask': async (input, output) => {
@@ -1057,7 +1034,11 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       if (approvals.length === 0) return;
 
       output.status = 'ask';
-      rememberCallAllowances(callID, approvals);
+      if (callID) {
+        for (const approval of approvals) {
+          callAllowances.add(allowanceKey(callID, approval.kind, approval.resource));
+        }
+      }
     },
 
     'tool.execute.before': async (input, output) => {
@@ -1080,7 +1061,13 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
         config.filesystem.allowWrite,
       );
       for (const decision of decisions) {
-        enforcePermission(input.callID, decision);
+        if (
+          decision.status === 'allow' ||
+          (decision.status === 'ask' && hasCallAllowance(input.callID, decision))
+        ) {
+          continue;
+        }
+        reportBlocked(decision);
       }
     },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.18.41",
+  "version": "0.18.43",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.18.41",
+    "@landstrip/landstrip-api": "^0.18.43",
     "@opentui/core": ">=0.3.4",
     "@opentui/solid": ">=0.3.4",
     "solid-js": "1.9.12"

package/shared.ts

@@ -1,33 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) Jarkko Sakkinen 2026
 
-import {
-  binaryPath,
-  type LandstripControlResponse,
-  type LandstripTrap,
-} from '@landstrip/landstrip-api';
-
-import {
-  allowsAllDomains,
-  canonicalizeGlobPattern,
-  canonicalizePath,
-  controlResponseLine,
-  decodeLandstripTrap,
-  domainMatchesAny,
-  domainMatchesPattern,
-  expandHomePath,
-  expandPath,
-  globToRegExp,
-  formatLandstripTrap,
-  formatLandstripTraps,
-  isRecord,
-  normalizePathSeparators,
-  parseLandstripTraps,
-  pathUnderDirectory,
-  sessionAllows,
-  sessionScopeFor,
-} from '@landstrip/landstrip-api/shared';
+import { binaryPath } from '@landstrip/landstrip-api';
+import { isRecord } from '@landstrip/landstrip-api/shared';
 
+export type { LandstripControlResponse, LandstripTrap } from '@landstrip/landstrip-api';
 export {
   allowsAllDomains,
   canonicalizeGlobPattern,
@@ -47,11 +24,7 @@ export {
   pathUnderDirectory,
   sessionAllows,
   sessionScopeFor,
-};
-
-// Re-exported so index.ts/tui.ts can import the trap/response types from this
-// module alongside the parsing functions that produce/consume them.
-export type { LandstripControlResponse, LandstripTrap };
+} from '@landstrip/landstrip-api/shared';
 
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
@@ -99,10 +72,6 @@ const LANDSTRIP_PACKAGE_NAMES = new Set([
   '@landstrip/landstrip-win32-arm64',
 ]);
 
-export function list(values: string[]): string {
-  return values.join(', ') || '(none)';
-}
-
 function rejectUnknownFields(
   value: Record<string, unknown>,
   fields: readonly string[],
@@ -601,54 +570,3 @@ export function readDiscoveryPort(baseDirectory: string): number | null {
     return null;
   }
 }
-
-/**
- * Human-readable sandbox configuration report consumed by both the server
- * command and the TUI inspector dialog.
- */
-export function sandboxSummary(
-  config: SandboxConfig,
-  globalPath: string,
-  projectPath: string,
-  statusOverride?: string,
-): string {
-  const networkMode = config.network.allowNetwork ? 'unrestricted' : 'proxied';
-  const allowed = list(config.network.allowedDomains);
-  const denied = list(config.network.deniedDomains);
-  const unixSockets = config.network.allowAllUnixSockets
-    ? 'all'
-    : list(config.network.allowUnixSockets);
-  const denyRead = list(config.filesystem.denyRead);
-  const allowRead = list(config.filesystem.allowRead);
-  const allowWrite = list(config.filesystem.allowWrite);
-  const denyWrite = list(config.filesystem.denyWrite);
-
-  const status = statusOverride ?? (config.enabled ? 'active' : 'disabled by config');
-  let binary: string;
-  try {
-    binary = landstripBinaryPath();
-  } catch {
-    binary = '(unavailable)';
-  }
-
-  return [
-    `Status: ${status}`,
-    `landstrip package binary: ${binary}`,
-    '',
-    'Config files',
-    `${projectPath} ${existsSync(projectPath) ? '(found)' : '(missing)'}`,
-    `${globalPath} ${existsSync(globalPath) ? '(found)' : '(missing)'}`,
-    '',
-    `Network: ${networkMode}`,
-    `allow network: ${config.network.allowNetwork ? 'yes' : 'no'}`,
-    `allowed: ${allowed}`,
-    `denied: ${denied}`,
-    `unix sockets: ${unixSockets}`,
-    '',
-    'Filesystem',
-    `deny read: ${denyRead}`,
-    `allow read: ${allowRead}`,
-    `allow write: ${allowWrite}`,
-    `deny write: ${denyWrite}`,
-  ].join('\n');
-}

package/tui.ts

@@ -118,11 +118,6 @@ function formatPath(input: string, base: string): string {
   return absolute;
 }
 
-function selectedForeground(background: RGBA): RGBA {
-  const luminance = 0.2126 * background.r + 0.7152 * background.g + 0.0722 * background.b;
-  return luminance > 0.5 ? RGBA.fromInts(0, 0, 0) : RGBA.fromInts(255, 255, 255);
-}
-
 const tui: TuiPlugin = async (api, options, meta) => {
   const optionOverrides = normalizeOptions(options);
   const enabledManagedByOptions = optionOverrides.enabled !== undefined;
@@ -176,7 +171,10 @@ const tui: TuiPlugin = async (api, options, meta) => {
         },
         children: jsx('text', {
           get fg() {
-            return selected() === index ? selectedForeground(theme.warning) : theme.textMuted;
+            if (selected() !== index) return theme.textMuted;
+            const background = theme.warning;
+            const luminance = 0.2126 * background.r + 0.7152 * background.g + 0.0722 * background.b;
+            return luminance > 0.5 ? RGBA.fromInts(0, 0, 0) : RGBA.fromInts(255, 255, 255);
           },
           children: option.label,
         }),
@@ -333,14 +331,11 @@ const tui: TuiPlugin = async (api, options, meta) => {
     );
   }
 
-  function currentRouteSessionID(): string | undefined {
-    const route = api.route.current;
-    if (route.name !== 'session' || !route.params) return undefined;
-    return typeof route.params.sessionID === 'string' ? route.params.sessionID : undefined;
-  }
-
   function pump(): void {
-    const routeSessionID = currentRouteSessionID();
+    const route = api.route.current;
+    if (route.name !== 'session' || !route.params) return;
+    const routeSessionID =
+      typeof route.params.sessionID === 'string' ? route.params.sessionID : undefined;
     if (!routeSessionID) return;
 
     const active = activeEntry();
@@ -360,8 +355,8 @@ const tui: TuiPlugin = async (api, options, meta) => {
     if (index === -1) return;
     const [next] = queue.splice(index, 1);
     if (!next) return;
-    if (next.kind === 'fs-query') showFsQuery(next);
-    else showNetworkQuery(next);
+    activeId = next.id;
+    setActiveEntry(next);
   }
 
   function enqueueEntry(entry: QueueEntry): void {
@@ -505,10 +500,6 @@ const tui: TuiPlugin = async (api, options, meta) => {
     }
   }
 
-  function showFsQuery(entry: FsQueryEntry): void {
-    activeId = entry.id;
-    setActiveEntry(entry);
-  }
   function resolveNetworkQuery(entry: NetworkQueryEntry, choice: NetworkQueryChoice): void {
     if (resolved.has(entry.id)) return;
     const action = choice === 'deny' ? 'deny' : 'allow';
@@ -533,11 +524,6 @@ const tui: TuiPlugin = async (api, options, meta) => {
     }
   }
 
-  function showNetworkQuery(entry: NetworkQueryEntry): void {
-    activeId = entry.id;
-    setActiveEntry(entry);
-  }
-
   // Query-response socket server (Linux-only — landstrip's socket protocol lives
   // in the seccomp broker). The server plugin connects each sandboxed run's
   // fd 3 here via a /dev/tcp redirect and we answer held writes interactively.
@@ -599,6 +585,10 @@ const tui: TuiPlugin = async (api, options, meta) => {
             }
 
             if (trap.kind === 'filesystem') {
+              if (trap.operation === 'write' && trap.reason === 'deny_match') {
+                respondQuery(socket, trap.query_id, 'deny');
+                continue;
+              }
               const sessionPaths =
                 trap.operation === 'read' ? allowances.readPaths : allowances.writePaths;
               if (sessionAllows(sessionPaths, trap.path)) {