opencode-landstrip 0.19.7 → 0.19.9

package/README.md

@@ -19,23 +19,17 @@ Approval never bypasses hard denials. Interactive requests without a live
 presenter remain denied. Only AI `bash` receives OS isolation: OpenCode's plugin
 API cannot replace direct user shell commands.
 
-Policy precedence (persistent approvals update the project/global files):
-
-1. Bundled [`sandbox.json`](sandbox.json).
-2. `~/.config/opencode/sandbox.json`.
-3. `.opencode/sandbox.json`.
-4. Plugin options.
+Policy precedence: bundled [`sandbox.json`](sandbox.json) → global →
+`.opencode/sandbox.json` → plugin options. The global file is
+`$XDG_CONFIG_HOME/opencode/sandbox.json` (`~/.config` when unset, empty, or relative).
+Persistent approvals update the chosen project/global file.
 
 Arrays combine; later scalar values win. Defaults allow project writes, deny
 sensitive-file writes, and block network access. Enabled sandboxing fails closed
 on unusable binaries/platforms; `enabled: false` explicitly permits unsandboxed Bash.
 
-- `filesystem.denyReadAlways` cannot be overridden by equal/nested read grants
-  and blocks promptable reads on those paths. Non-empty `denyReadAlways` is
-  unsupported on Windows.
-- `filesystem.denyWriteAlways` cannot be overridden by equal/nested write grants
-  and blocks promptable writes on those paths. Non-empty `denyWriteAlways` is
-  unsupported on Windows.
+`filesystem.denyReadAlways` and `filesystem.denyWriteAlways` block approvals and
+equal/nested grants. Non-empty hard-denial lists are unsupported on Windows.
 
 See [landstrip(1)](../landstrip/man/man1/landstrip.1) for native CLI/policy semantics.
 Runtime seccomp traps/query approval are Linux-only. Native macOS `--trap` reports

package/index.ts

@@ -5,10 +5,9 @@ import type { Plugin } from '@opencode/plugin';
 
 import { randomBytes } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { rmSync } from 'node:fs';
 import { type AddressInfo, connect as connectNet, createServer } from 'node:net';
-import { tmpdir } from 'node:os';
-import { basename, join } from 'node:path';
+import { basename } from 'node:path';
 
 import {
   createProxyCredentials,
@@ -38,7 +37,7 @@ import {
   normalizeOptions,
   parseLandstripTraps,
   readDiscoveryPort,
-  serializeLandstripPolicy,
+  writeLandstripPolicyFile,
   trapSessionHelloLine,
 } from './shared.js';
 
@@ -210,21 +209,15 @@ function writePolicyFile(
   baseDirectory: string,
   proxyPort: number | null,
 ): { dir: string; path: string } {
-  const dir = mkdtempSync(join(tmpdir(), 'opencode-landstrip-'));
-  const path = join(dir, 'policy.json');
-  writeFileSync(
-    path,
-    serializeLandstripPolicy(
-      buildLandstripPolicy({
-        network: config.network,
-        filesystem: config.filesystem,
-        baseDirectory,
-        httpProxyPort: proxyPort,
-      }),
-    ),
+  return writeLandstripPolicyFile(
+    buildLandstripPolicy({
+      network: config.network,
+      filesystem: config.filesystem,
+      baseDirectory,
+      httpProxyPort: proxyPort,
+    }),
+    'opencode-landstrip-',
   );
-
-  return { dir, path };
 }
 
 function proxyEnv(
@@ -491,7 +484,7 @@ function evaluateToolPermissions(
     );
   }
 
-  if (tool === 'apply_patch' && typeof args.patchText === 'string') {
+  if ((tool === 'patch' || tool === 'apply_patch') && typeof args.patchText === 'string') {
     return extractPatchPaths(args.patchText).map((path) =>
       evaluateWritePermission(path, config, baseDirectory, effectiveAllowWrite),
     );
@@ -873,14 +866,25 @@ const plugin: Plugin.Plugin = {
       const state = activeBash.get(event.id);
       if (!state) return;
 
-      const outputText =
-        event.status === 'completed'
-          ? typeof event.result.output === 'string'
-            ? event.result.output
-            : typeof event.result.content === 'string'
-              ? event.result.content
-              : ''
-          : '';
+      let outputText = '';
+      if (event.status === 'completed') {
+        const { output, content } = event.result;
+        if (typeof output === 'string') {
+          outputText = output;
+        } else if (isRecord(output) && typeof output.output === 'string') {
+          outputText = output.output;
+        } else if (typeof content === 'string') {
+          outputText = content;
+        } else if (Array.isArray(content)) {
+          outputText = content
+            .flatMap((part) =>
+              isRecord(part) && part.type === 'text' && typeof part.text === 'string'
+                ? [part.text]
+                : [],
+            )
+            .join('\n');
+        }
+      }
       const serverTrapOutput = state.trapLines.join('\n');
       const combinedOutput = serverTrapOutput ? outputText + '\n' + serverTrapOutput : outputText;
       const traps = parseLandstripTraps(combinedOutput);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.19.7",
+  "version": "0.19.9",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.19.7",
+    "@landstrip/landstrip-api": "^0.19.9",
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",
     "solid-js": "1.9.12"

package/shared.ts

@@ -6,6 +6,7 @@ import {
   deepMergeSandboxConfig,
   extractDomainsFromCommand,
   isRecord,
+  mergeArray,
   parseSandboxConfig,
 } from '@landstrip/landstrip-api/shared';
 import type { SandboxConfig, SandboxConfigOverrides } from '@landstrip/landstrip-api/shared';
@@ -40,6 +41,7 @@ export {
   sessionAllows,
   sessionScopeFor,
   serializeLandstripPolicy,
+  writeLandstripPolicyFile,
   deepMergeSandboxConfig,
   mergeArray,
   parseSandboxConfig,
@@ -74,20 +76,10 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
+import { dirname, isAbsolute, join } from 'node:path';
 
 const packageDir = dirname(fileURLToPath(import.meta.url));
 
-const LANDSTRIP_PACKAGE_NAMES = new Set([
-  '@landstrip/landstrip-api',
-  '@landstrip/landstrip-darwin-arm64',
-  '@landstrip/landstrip-darwin-x64',
-  '@landstrip/landstrip-linux-x64',
-  '@landstrip/landstrip-linux-arm64',
-  '@landstrip/landstrip-win32-x64',
-  '@landstrip/landstrip-win32-arm64',
-]);
-
 export function normalizeConfig(value: unknown): SandboxConfigOverrides {
   return parseSandboxConfig(value);
 }
@@ -104,8 +96,11 @@ export function deepMerge(base: SandboxConfig, overrides: SandboxConfigOverrides
 }
 
 export function getConfigPaths(baseDirectory: string): { globalPath: string; projectPath: string } {
+  const configHome = process.env.XDG_CONFIG_HOME;
+  const configDirectory =
+    configHome && isAbsolute(configHome) ? configHome : join(homedir(), '.config');
   return {
-    globalPath: join(homedir(), '.config', 'opencode', 'sandbox.json'),
+    globalPath: join(configDirectory, 'opencode', 'sandbox.json'),
     projectPath: join(baseDirectory, '.opencode', 'sandbox.json'),
   };
 }
@@ -136,6 +131,7 @@ export function loadConfig(
   }
 
   const templateConfig: SandboxConfig = JSON.parse(readFileSync(templatePath, 'utf-8'));
+  templateConfig.filesystem.denyWrite.push(globalPath);
   const globalOverrides = readConfigFile(globalPath);
   const baseConfig = deepMerge(templateConfig, globalOverrides);
 
@@ -143,12 +139,24 @@ export function loadConfig(
 }
 
 export function writeConfigFile(configPath: string, update: SandboxConfigOverrides): void {
-  const current = readConfigFile(configPath);
+  const next: Record<string, unknown> = { ...readConfigFile(configPath) };
+  for (const [key, value] of Object.entries(normalizeConfig(update))) {
+    if (!isRecord(value)) {
+      next[key] = value;
+      continue;
+    }
 
-  const templateConfig: SandboxConfig = JSON.parse(
-    readFileSync(join(packageDir, 'sandbox.json'), 'utf-8'),
-  );
-  const next = deepMerge(deepMerge(templateConfig, current), update);
+    const previous = next[key];
+    const section: Record<string, unknown> = isRecord(previous) ? { ...previous } : {};
+    for (const [field, fieldValue] of Object.entries(value)) {
+      if (fieldValue === undefined) continue;
+      const existing = section[field];
+      section[field] = Array.isArray(fieldValue)
+        ? mergeArray(Array.isArray(existing) ? existing : [], fieldValue)
+        : fieldValue;
+    }
+    next[key] = section;
+  }
 
   mkdirSync(dirname(configPath), { recursive: true });
   writeFileSync(configPath, JSON.stringify(next, null, 2) + '\n');
@@ -162,31 +170,8 @@ export function landstripBinaryPath(): string {
   if (_landstripBinaryPathError !== undefined) throw _landstripBinaryPathError;
 
   try {
-    const filePath = realpathSync.native(binaryPath());
-    let probe = dirname(filePath);
-
-    while (true) {
-      const manifestPath = join(probe, 'package.json');
-      if (existsSync(manifestPath)) {
-        try {
-          const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8')) as unknown;
-          if (isRecord(manifest) && LANDSTRIP_PACKAGE_NAMES.has(String(manifest.name))) {
-            _landstripBinaryPath = filePath;
-            return filePath;
-          }
-        } catch {
-          // malformed package.json — continue walking to parent
-        }
-      }
-
-      const parent = dirname(probe);
-      if (parent === probe) break;
-      probe = parent;
-    }
-
-    throw new Error(
-      `Refusing to use landstrip binary outside official @landstrip/landstrip-api packages: ${filePath}`,
-    );
+    _landstripBinaryPath = binaryPath();
+    return _landstripBinaryPath;
   } catch (error) {
     _landstripBinaryPathError = error;
     throw error;