opencode-landstrip 0.19.12 → 0.19.14

package/README.md

@@ -9,37 +9,31 @@ opencode plugin install opencode-landstrip          # project
 opencode plugin install opencode-landstrip --global # global
 ```
 
-Installation configures server and TUI plugins. `/landstrip` opens the management
-pane; Pi's agent/task subcommands are unavailable.
+Installation configures server/TUI plugins; `/landstrip` opens the management pane.
 
 ## Permissions and configuration
 
-OpenCode authorizes tool dispatch; Landstrip enforces filesystem/network access.
-Approval never bypasses hard denials. Interactive requests without a live
-presenter remain denied. Only AI `bash` receives OS isolation: OpenCode's plugin
-API cannot replace direct user shell commands.
+Only AI `bash` is OS-isolated; the plugin API cannot replace user shell commands.
+Tool approval never overrides hard sandbox denials. Interactive requests without
+a live presenter remain denied.
 
-Policy precedence: bundled [`sandbox.json`](sandbox.json) → global →
-`.opencode/sandbox.json` → plugin options. The global file is
-`$XDG_CONFIG_HOME/opencode/sandbox.json` (`~/.config` when unset, empty, or relative).
-Persistent approvals update the chosen project/global file.
+Configuration: bundled [`sandbox.json`](sandbox.json) → global →
+`.opencode/sandbox.json` → plugin options. Global:
+`$XDG_CONFIG_HOME/opencode/sandbox.json`, with `~/.config` as fallback for an unset,
+empty, or relative `XDG_CONFIG_HOME`. Arrays combine; later scalars win.
+Persistent approvals update the selected global/project file.
 
-Arrays combine; later scalar values win. Defaults allow project writes, deny
-sensitive-file writes, and block network access. Enabled sandboxing fails closed
-on unusable binaries/platforms; `enabled: false` explicitly permits unsandboxed Bash.
+Defaults allow project writes, deny sensitive-file writes, and block networking.
+Unusable sandboxing fails closed; `enabled: false` permits unsandboxed Bash.
 
-`filesystem.denyReadAlways` and `filesystem.denyWriteAlways` block approvals and
-equal/nested grants. Non-empty hard-denial lists are unsupported on Windows.
-
-See [landstrip(1)](../landstrip/man/man1/landstrip.1) for native CLI/policy semantics.
-Runtime seccomp traps/query approval are Linux-only. Native macOS `--trap` reports
-setup/launch errors only and closes on successful exec—not runtime violations.
+See [landstrip(1)](../landstrip/man/man1/landstrip.1) for hard-denial rules,
+native traps, and platform limits.
 
 ## Development
 
-From this package: `npm ci`, then `npm run all` (format, lint, typecheck, tests).
-Read-only formatting check: `npm run ci:fmt`.
+From this package: `npm ci && npm run all`; `npm run ci:fmt` checks formatting
+without edits.
 
 ## License
 
-Apache-2.0; see [LICENSE](LICENSE).
+[Apache-2.0](LICENSE).

package/index.ts

@@ -21,7 +21,6 @@ import {
   allowsAllDomains,
   canonicalizePath,
   controlResponseLine,
-  decodeLandstripTrap,
   evaluateDomainAccess,
   evaluateReadAccess,
   evaluateWriteAccess,
@@ -31,11 +30,13 @@ import {
   getConfigPaths,
   isDomainAllowed,
   isRecord,
+  isQueryTrap,
   buildLandstripPolicy,
   landstripBinaryPath,
   loadConfig,
   normalizeOptions,
   parseLandstripTraps,
+  parseTrapLine,
   readDiscoveryPort,
   writeLandstripPolicyFile,
   trapSessionHelloLine,
@@ -262,17 +263,8 @@ function startTrapServer(
         buffer = buffer.slice(nl + 1);
         nl = buffer.indexOf('\n');
         if (line.length === 0) continue;
-        let trap: LandstripTrap | null = null;
-        try {
-          trap = decodeLandstripTrap(JSON.parse(line));
-        } catch {
-          trap = null;
-        }
-        if (
-          (trap?.kind === 'filesystem' || trap?.kind === 'network') &&
-          trap.state === 'query' &&
-          trap.query_id
-        ) {
+        const trap = parseTrapLine(line);
+        if (trap && isQueryTrap(trap)) {
           const queryId = trap.query_id;
           if (trap.kind === 'filesystem') {
             const path = canonicalizePath(trap.path, baseDirectory);
@@ -295,13 +287,8 @@ function startTrapServer(
               trapSocket.write(controlResponseLine(queryId, 'deny'));
               trapLines.push(line);
             }
-          } else if (
-            trap.kind === 'network' &&
-            (trap.operation === 'connect' || trap.operation === 'bind')
-          ) {
-            trapSocket.write(controlResponseLine(queryId, 'deny'));
-            trapLines.push(line);
           } else {
+            trapSocket.write(controlResponseLine(queryId, 'deny'));
             trapLines.push(line);
           }
         } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.19.12",
+  "version": "0.19.14",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.19.12",
+    "@landstrip/landstrip-api": "^0.19.14",
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",
     "solid-js": "1.9.12"

package/shared.ts

@@ -33,8 +33,10 @@ export {
   formatLandstripTrap,
   formatLandstripTraps,
   isRecord,
+  isQueryTrap,
   normalizePathSeparators,
   parseLandstripTraps,
+  parseTrapLine,
   pathUnderDirectory,
   resolveFilesystemPatterns,
   resolveFilesystemPolicy,

package/tui.ts

@@ -16,6 +16,7 @@ import {
   controlResponseLine,
   decodeTrapSessionHello,
   getConfigPaths,
+  isQueryTrap,
   loadConfig,
   normalizeOptions,
   nextSandboxPermissionIndex,
@@ -576,8 +577,7 @@ const tui: TuiPlugin.Definition = {
 
             const allowances = sessionAllowancesFor(sessionAllowances, routeSessionID);
             for (const trap of parseLandstripTraps(line)) {
-              if (trap.kind !== 'filesystem' && trap.kind !== 'network') continue;
-              if (trap.state !== 'query') continue;
+              if (!isQueryTrap(trap)) continue;
               if (seen.has(trap.query_id)) continue;
               seen.add(trap.query_id);