opencode-landstrip 0.18.42 → 0.19.0

package/README.md

@@ -1,51 +1,44 @@
 # opencode-landstrip
 
-OpenCode plugin that runs AI `bash` calls through Landstrip.
+Landstrip sandboxing for AI `bash` calls in OpenCode ≥1.17.7.
 
-## Install
+## Install and use
 
 ```sh
-# Current project
-opencode plugin install opencode-landstrip
-
-# Global
-opencode plugin install opencode-landstrip --global
+opencode plugin install opencode-landstrip          # project
+opencode plugin install opencode-landstrip --global # global
 ```
 
-The installer configures both the server plugin and TUI presenter.
-
-## Permissions
+Installation configures server and TUI plugins. `/landstrip` opens the management
+pane; Pi's agent/task subcommands are unavailable.
 
-OpenCode permissions authorize tool dispatch. Landstrip permissions authorize
-filesystem and network access. Agent approval never bypasses a sandbox hard
-denial, and requests without a live presenter are denied.
+## Permissions and configuration
 
-OpenCode intentionally exposes one plugin slash command: `/landstrip`, which
-opens the bottom management pane. Pi-only agent and task subcommands are not
-available. Persistent approvals update `.opencode/sandbox.json` or
-`~/.config/opencode/sandbox.json`.
+OpenCode authorizes tool dispatch; Landstrip enforces filesystem/network access.
+Approval never bypasses hard denials. Interactive requests without a live
+presenter remain denied. Only AI `bash` receives OS isolation: OpenCode's plugin
+API cannot replace direct user shell commands.
 
-## Configuration
+Policy precedence (persistent approvals update the project/global files):
 
-Policy merges in this order:
+1. Bundled [`sandbox.json`](sandbox.json).
+2. `~/.config/opencode/sandbox.json`.
+3. `.opencode/sandbox.json`.
+4. Plugin options.
 
-1. bundled `sandbox.json`;
-2. `~/.config/opencode/sandbox.json`;
-3. `.opencode/sandbox.json`;
-4. plugin options.
+Arrays combine; later scalar values win. Defaults allow project writes, deny
+sensitive-file writes, and block network access. Enabled sandboxing fails closed
+on unusable binaries/platforms; `enabled: false` explicitly permits unsandboxed Bash.
 
-Objects merge recursively, arrays combine, and later scalar values replace
-earlier values. The bundled policy denies sensitive files and network access
-while allowing project writes. See [`sandbox.json`](sandbox.json) for its exact
-defaults.
+See [landstrip(1)](../landstrip/man/man1/landstrip.1) for native CLI/policy semantics.
+Runtime seccomp traps/query approval are Linux-only. Native macOS `--trap` reports
+setup/launch errors only and closes on successful exec—not runtime violations.
 
-If sandboxing is enabled but the binary or platform is unusable, AI Bash fails
-closed. Set `enabled` to `false` explicitly to allow unsandboxed AI Bash.
+## Development
 
-Only AI `bash` calls receive OS isolation; direct user shell commands cannot be
-replaced through OpenCode's plugin API.
+From this package: `npm ci`, then `npm run all` (format, lint, typecheck, tests).
+Read-only formatting check: `npm run ci:fmt`.
 
-## Licensing
+## License
 
-`opencode-landstrip` is licensed under the Apache 2.0 license. See [LICENSE](LICENSE)
-for more information.
+Apache-2.0; see [LICENSE](LICENSE).

package/index.ts

@@ -78,8 +78,8 @@ function normalizePathForMatch(filePath: string): string {
   return process.platform === 'win32' ? normalizePathSeparators(filePath).toLowerCase() : filePath;
 }
 
-// Component count of an absolute path; "/" is 0. Used to rank how specific a
-// matching pattern is so the most specific allow/deny rule wins.
+// Component count of an absolute path; "/" is 0. Read rules use it to rank
+// matching allow and deny patterns by specificity.
 function pathDepth(absolutePath: string): number {
   return absolutePath.split('/').filter((segment) => segment.length > 0).length;
 }
@@ -135,7 +135,7 @@ function isDomainAllowed(domain: string, config: SandboxConfig): boolean {
   );
 }
 
-function isFilesystemAllowed(
+function isReadAllowed(
   path: string,
   allowPatterns: string[],
   denyPatterns: string[],
@@ -146,6 +146,16 @@ function isFilesystemAllowed(
   return allowDepth >= 0 && allowDepth >= denyDepth;
 }
 
+function writeAccess(
+  path: string,
+  allowPatterns: string[],
+  denyPatterns: string[],
+  baseDirectory: string,
+): 'allow' | 'deny' | 'unlisted' {
+  if (matchDepth(path, denyPatterns, baseDirectory) >= 0) return 'deny';
+  return matchDepth(path, allowPatterns, baseDirectory) >= 0 ? 'allow' : 'unlisted';
+}
+
 function extractCandidatePaths(command: string): string[] {
   const paths: string[] = [];
   const tokens = command.match(/[^\s"']+|"[^"]*"|'[^']*'/g) ?? [];
@@ -219,9 +229,7 @@ function evaluateReadPermission(
   // everything else asks for approval (allow once/session/persist or reject)
   // rather than being blocked outright. denyRead still hard-applies to bash
   // through the landstrip binary policy, which has no way to prompt.
-  if (
-    isFilesystemAllowed(filePath, effectiveAllowRead, config.filesystem.denyRead, baseDirectory)
-  ) {
+  if (isReadAllowed(filePath, effectiveAllowRead, config.filesystem.denyRead, baseDirectory)) {
     return { status: 'allow', kind: 'read', resource: filePath, message: '' };
   }
 
@@ -240,10 +248,14 @@ function evaluateWritePermission(
   effectiveAllowWrite: string[],
 ): SandboxPermissionDecision {
   const filePath = canonicalizePath(path, baseDirectory);
-  const allowDepth = matchDepth(filePath, effectiveAllowWrite, baseDirectory);
-  const denyDepth = matchDepth(filePath, config.filesystem.denyWrite, baseDirectory);
+  const access = writeAccess(
+    filePath,
+    effectiveAllowWrite,
+    config.filesystem.denyWrite,
+    baseDirectory,
+  );
 
-  if (denyDepth >= 0 && denyDepth >= allowDepth) {
+  if (access === 'deny') {
     return {
       status: 'deny',
       kind: 'write',
@@ -252,9 +264,7 @@ function evaluateWritePermission(
     };
   }
 
-  if (
-    isFilesystemAllowed(filePath, effectiveAllowWrite, config.filesystem.denyWrite, baseDirectory)
-  ) {
+  if (access === 'allow') {
     return { status: 'allow', kind: 'write', resource: filePath, message: '' };
   }
 
@@ -427,8 +437,8 @@ function startTrapServer(
             const operation = trap.operation;
             const allowed =
               operation === 'read'
-                ? isFilesystemAllowed(path, effectiveAllowRead, denyRead, baseDirectory)
-                : isFilesystemAllowed(path, effectiveAllowWrite, denyWrite, baseDirectory);
+                ? isReadAllowed(path, effectiveAllowRead, denyRead, baseDirectory)
+                : writeAccess(path, effectiveAllowWrite, denyWrite, baseDirectory) === 'allow';
             if (allowed) {
               trapSocket.write(controlResponseLine(queryId, 'allow'));
             } else {
@@ -499,7 +509,7 @@ function buildWrappedCommand(
   const trapped = [
     landstripBinaryPath(),
     'run',
-    '--trap-fd',
+    '--trap',
     '3',
     '-p',
     policyPath,
@@ -1051,7 +1061,12 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
         config.filesystem.allowWrite,
       );
       for (const decision of decisions) {
-        if (decision.status === 'allow' || hasCallAllowance(input.callID, decision)) continue;
+        if (
+          decision.status === 'allow' ||
+          (decision.status === 'ask' && hasCallAllowance(input.callID, decision))
+        ) {
+          continue;
+        }
         reportBlocked(decision);
       }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.18.42",
+  "version": "0.19.0",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.18.42",
+    "@landstrip/landstrip-api": "^0.19.0",
     "@opentui/core": ">=0.3.4",
     "@opentui/solid": ">=0.3.4",
     "solid-js": "1.9.12"

package/shared.ts

@@ -1,33 +1,10 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) Jarkko Sakkinen 2026
 
-import {
-  binaryPath,
-  type LandstripControlResponse,
-  type LandstripTrap,
-} from '@landstrip/landstrip-api';
-
-import {
-  allowsAllDomains,
-  canonicalizeGlobPattern,
-  canonicalizePath,
-  controlResponseLine,
-  decodeLandstripTrap,
-  domainMatchesAny,
-  domainMatchesPattern,
-  expandHomePath,
-  expandPath,
-  globToRegExp,
-  formatLandstripTrap,
-  formatLandstripTraps,
-  isRecord,
-  normalizePathSeparators,
-  parseLandstripTraps,
-  pathUnderDirectory,
-  sessionAllows,
-  sessionScopeFor,
-} from '@landstrip/landstrip-api/shared';
+import { binaryPath } from '@landstrip/landstrip-api';
+import { isRecord } from '@landstrip/landstrip-api/shared';
 
+export type { LandstripControlResponse, LandstripTrap } from '@landstrip/landstrip-api';
 export {
   allowsAllDomains,
   canonicalizeGlobPattern,
@@ -47,11 +24,7 @@ export {
   pathUnderDirectory,
   sessionAllows,
   sessionScopeFor,
-};
-
-// Re-exported so index.ts/tui.ts can import the trap/response types from this
-// module alongside the parsing functions that produce/consume them.
-export type { LandstripControlResponse, LandstripTrap };
+} from '@landstrip/landstrip-api/shared';
 
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
@@ -99,10 +72,6 @@ const LANDSTRIP_PACKAGE_NAMES = new Set([
   '@landstrip/landstrip-win32-arm64',
 ]);
 
-export function list(values: string[]): string {
-  return values.join(', ') || '(none)';
-}
-
 function rejectUnknownFields(
   value: Record<string, unknown>,
   fields: readonly string[],
@@ -601,54 +570,3 @@ export function readDiscoveryPort(baseDirectory: string): number | null {
     return null;
   }
 }
-
-/**
- * Human-readable sandbox configuration report consumed by both the server
- * command and the TUI inspector dialog.
- */
-export function sandboxSummary(
-  config: SandboxConfig,
-  globalPath: string,
-  projectPath: string,
-  statusOverride?: string,
-): string {
-  const networkMode = config.network.allowNetwork ? 'unrestricted' : 'proxied';
-  const allowed = list(config.network.allowedDomains);
-  const denied = list(config.network.deniedDomains);
-  const unixSockets = config.network.allowAllUnixSockets
-    ? 'all'
-    : list(config.network.allowUnixSockets);
-  const denyRead = list(config.filesystem.denyRead);
-  const allowRead = list(config.filesystem.allowRead);
-  const allowWrite = list(config.filesystem.allowWrite);
-  const denyWrite = list(config.filesystem.denyWrite);
-
-  const status = statusOverride ?? (config.enabled ? 'active' : 'disabled by config');
-  let binary: string;
-  try {
-    binary = landstripBinaryPath();
-  } catch {
-    binary = '(unavailable)';
-  }
-
-  return [
-    `Status: ${status}`,
-    `landstrip package binary: ${binary}`,
-    '',
-    'Config files',
-    `${projectPath} ${existsSync(projectPath) ? '(found)' : '(missing)'}`,
-    `${globalPath} ${existsSync(globalPath) ? '(found)' : '(missing)'}`,
-    '',
-    `Network: ${networkMode}`,
-    `allow network: ${config.network.allowNetwork ? 'yes' : 'no'}`,
-    `allowed: ${allowed}`,
-    `denied: ${denied}`,
-    `unix sockets: ${unixSockets}`,
-    '',
-    'Filesystem',
-    `deny read: ${denyRead}`,
-    `allow read: ${allowRead}`,
-    `allow write: ${allowWrite}`,
-    `deny write: ${denyWrite}`,
-  ].join('\n');
-}

package/tui.ts

@@ -585,6 +585,10 @@ const tui: TuiPlugin = async (api, options, meta) => {
             }
 
             if (trap.kind === 'filesystem') {
+              if (trap.operation === 'write' && trap.reason === 'deny_match') {
+                respondQuery(socket, trap.query_id, 'deny');
+                continue;
+              }
               const sessionPaths =
                 trap.operation === 'read' ? allowances.readPaths : allowances.writePaths;
               if (sessionAllows(sessionPaths, trap.path)) {