opencode-landstrip 0.20.14 → 0.20.15

package/index.ts

@@ -15,30 +15,33 @@ import {
   startFilterProxy,
 } from '@landstrip/landstrip-api/proxy';
 
+import type { LandstripTrap } from '@landstrip/landstrip-api';
 import {
-  type LandstripTrap,
   type SandboxConfig,
   allowsAllDomains,
+  buildLandstripPolicy,
   canonicalizePath,
   controlResponseLine,
   evaluateDomainAccess,
   evaluateReadAccess,
   evaluateWriteAccess,
-  extractDomainsFromCommand,
   extractDeniedPath,
+  extractDomainsFromCommand,
   formatLandstripTraps,
-  getConfigPaths,
   isDomainAllowed,
-  isRecord,
   isQueryTrap,
-  buildLandstripPolicy,
+  isRecord,
+  parseLandstripTraps,
+  parseTrapLine,
+  writeLandstripPolicyFile,
+} from '@landstrip/landstrip-api/shared';
+
+import {
+  getConfigPaths,
   landstripBinaryPath,
   loadConfig,
   normalizeOptions,
-  parseLandstripTraps,
-  parseTrapLine,
   readDiscoveryPort,
-  writeLandstripPolicyFile,
   trapSessionHelloLine,
 } from './shared.js';
 
@@ -117,21 +120,12 @@ function evaluateWritePermission(
     allowWriteOverrides: effectiveAllowWrite,
   });
 
-  if (decision === 'denyAlways') {
-    return {
-      status: 'deny',
-      kind: 'write',
-      resource: filePath,
-      message: `Sandbox: write access denied for "${filePath}" (denyWriteAlways).`,
-    };
-  }
-
   if (decision === 'deny') {
     return {
       status: 'deny',
       kind: 'write',
       resource: filePath,
-      message: `Sandbox: write access denied for "${filePath}" (denyWrite overrides allowWrite).`,
+      message: `Sandbox: write access denied for "${filePath}" (denyWriteAlways).`,
     };
   }
 
@@ -143,7 +137,7 @@ function evaluateWritePermission(
     status: 'ask',
     kind: 'write',
     resource: filePath,
-    message: `Sandbox: write access requires approval for "${filePath}" (not in filesystem.allowWrite).`,
+    message: `Sandbox: write access requires approval for "${filePath}".`,
   };
 }
 
@@ -228,7 +222,7 @@ function proxyEnv(
   proxyToken?: string | null,
 ): Record<string, string> | undefined {
   if (port === null) return undefined;
-  return createProxyEnvironment(port, proxyToken) as Record<string, string>;
+  return createProxyEnvironment(port, { token: proxyToken }) as Record<string, string>;
 }
 
 function shellQuote(value: string): string {
@@ -414,17 +408,8 @@ function extractOriginalCommand(wrappedCommand: string): string | null {
   const pIdx = args.indexOf('-p');
   const flagIdx = args.findIndex((arg, i) => i > pIdx && (arg === '-lc' || arg === '-c'));
   if (flagIdx === -1) return null;
-  // Old query-response wrappers appended `|| <fallback>`; stop there so
-  // recovering an expired wrapper never folds a fallback into the command.
-  const end = args.indexOf('||', flagIdx + 1);
-  return (end === -1 ? args.slice(flagIdx + 1) : args.slice(flagIdx + 1, end)).join(' ');
-}
-
-function getToolPath(args: Record<string, unknown>): string | undefined {
-  const filePath = args.filePath ?? args.path;
-  return typeof filePath === 'string' ? filePath : undefined;
+  return args.slice(flagIdx + 1).join(' ');
 }
-
 function extractPatchPaths(patchText: string): string[] {
   const paths: string[] = [];
 
@@ -453,13 +438,15 @@ function evaluateToolPermissions(
   if (tool === 'read') {
     const paths = Array.isArray(args.paths)
       ? args.paths.filter((path): path is string => typeof path === 'string')
-      : [getToolPath(args)].filter((path): path is string => path !== undefined);
+      : typeof args.path === 'string'
+        ? [args.path]
+        : [];
     return paths.map((path) =>
       evaluateReadPermission(path, config, baseDirectory, effectiveAllowRead),
     );
   }
 
-  if (tool === 'glob' || tool === 'grep' || tool === 'list') {
+  if (tool === 'glob' || tool === 'grep') {
     const searchPath = typeof args.path === 'string' ? args.path : '.';
     return [evaluateReadPermission(searchPath, config, baseDirectory, effectiveAllowRead)];
   }
@@ -467,22 +454,28 @@ function evaluateToolPermissions(
   if (tool === 'write' || tool === 'edit') {
     const paths = Array.isArray(args.paths)
       ? args.paths.filter((path): path is string => typeof path === 'string')
-      : [getToolPath(args)].filter((path): path is string => path !== undefined);
+      : typeof args.path === 'string'
+        ? [args.path]
+        : [];
     return paths.map((path) =>
       evaluateWritePermission(path, config, baseDirectory, effectiveAllowWrite),
     );
   }
 
-  if ((tool === 'patch' || tool === 'apply_patch') && typeof args.patchText === 'string') {
+  if (tool === 'patch' && typeof args.patchText === 'string') {
     return extractPatchPaths(args.patchText).map((path) =>
       evaluateWritePermission(path, config, baseDirectory, effectiveAllowWrite),
     );
   }
 
-  if (tool === 'bash' && typeof args.command === 'string') {
-    return evaluateCommandDomains(args.command, config);
+  if (tool === 'shell') {
+    const commands = Array.isArray(args.commands)
+      ? args.commands.filter((command): command is string => typeof command === 'string')
+      : typeof args.command === 'string'
+        ? [args.command]
+        : [];
+    return commands.flatMap((command) => evaluateCommandDomains(command, config));
   }
-
   return [];
 }
 
@@ -672,7 +665,7 @@ const plugin: Plugin.Plugin = {
       const proxy = allowNetwork
         ? null
         : await startFilterProxy({
-            isDomainAllowed: (domain) => isDomainAllowed(domain, config),
+            isDomainAllowed: (domain) => isDomainAllowed(domain, config.network),
             ...(proxyCredentials ? { authorization: proxyCredentials.authorization } : {}),
           });
       const proxyPort = proxy ? proxy.port : null;
@@ -745,24 +738,14 @@ const plugin: Plugin.Plugin = {
       if (!config) return;
 
       const action = evaluation.action;
-      const patterns = [...(evaluation.resources ?? [])];
+      const resources = [...(evaluation.resources ?? [])];
       const effectiveAllowRead = config.filesystem.allowRead;
       const effectiveAllowWrite = config.filesystem.allowWrite;
       const args: Record<string, unknown> = { ...evaluation.metadata };
-      if (action === 'read' || action === 'external_directory') args.paths = patterns;
-      if (action === 'write' || action === 'edit') {
-        args.paths =
-          patterns.length > 0
-            ? patterns
-            : [args.filepath ?? args.path].filter(
-                (path): path is string => typeof path === 'string',
-              );
-      }
-      if ((action === 'shell' || action === 'bash') && typeof args.command !== 'string') {
-        args.command = patterns[0];
-      }
-      const toolName =
-        action === 'shell' ? 'bash' : action === 'external_directory' ? 'read' : action;
+      if (action === 'read' || action === 'external_directory') args.paths = resources;
+      if (action === 'edit') args.paths = resources;
+      if (action === 'shell') args.commands = resources;
+      const toolName = action === 'external_directory' ? 'read' : action;
       const decisions = evaluateToolPermissions(
         toolName,
         args,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.20.14",
+  "version": "0.20.15",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.20.14",
+    "@landstrip/landstrip-api": "^0.20.15",
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",
     "solid-js": "1.9.12"

package/shared.ts

@@ -4,79 +4,11 @@
 import { binaryPath } from '@landstrip/landstrip-api';
 import {
   deepMergeSandboxConfig,
-  extractDomainsFromCommand,
   isRecord,
   mergeArray,
   parseSandboxConfig,
 } from '@landstrip/landstrip-api/shared';
 import type { SandboxConfig, SandboxConfigOverrides } from '@landstrip/landstrip-api/shared';
-
-export type {
-  LandstripControlResponse,
-  LandstripDarwinPolicy,
-  LandstripFilesystemPolicy,
-  LandstripNetworkPolicy,
-  LandstripPathSelector,
-  LandstripPolicy,
-  LandstripTrap,
-} from '@landstrip/landstrip-api';
-export {
-  buildLandstripPolicy,
-  allowsAllDomains,
-  canonicalizeGlobPattern,
-  canonicalizePath,
-  controlResponseLine,
-  decodeLandstripTrap,
-  domainMatchesAny,
-  domainMatchesPattern,
-  expandHomePath,
-  expandPath,
-  globToRegExp,
-  formatLandstripTrap,
-  formatLandstripTraps,
-  isRecord,
-  isQueryTrap,
-  normalizePathSeparators,
-  parseLandstripTraps,
-  parseTrapLine,
-  pathUnderDirectory,
-  resolveFilesystemPatterns,
-  resolveFilesystemPolicy,
-  sessionAllows,
-  sessionScopeFor,
-  serializeLandstripPolicy,
-  writeLandstripPolicyFile,
-  deepMergeSandboxConfig,
-  mergeArray,
-  parseSandboxConfig,
-  matchesPathPattern,
-  matchPathSpecificity,
-  isPathReadAllowed,
-  isPathWriteAllowed,
-  shouldPromptForWrite,
-  evaluateReadAccess,
-  evaluateWriteAccess,
-  isDomainAllowed,
-  evaluateDomainAccess,
-  extractDomainsFromCommand,
-  extractCandidatePaths,
-  extractNativeDeniedPath,
-  extractDeniedPath,
-  type PathAccessDecision,
-  type DomainAccessDecision,
-  type EvaluateReadOptions,
-  type EvaluateWriteOptions,
-  type EvaluateDomainOptions,
-  type SandboxConfig,
-  type SandboxConfigFile,
-  type SandboxConfigOverrides,
-  type SandboxDarwinConfig,
-  type SandboxFilesystemConfig,
-  type SandboxNetworkConfig,
-  type SandboxShellConfig,
-  type SandboxWindowsConfig,
-} from '@landstrip/landstrip-api/shared';
-
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
@@ -85,21 +17,12 @@ import { dirname, isAbsolute, join } from 'node:path';
 
 const packageDir = dirname(fileURLToPath(import.meta.url));
 
-export function normalizeConfig(value: unknown): SandboxConfigOverrides {
-  return parseSandboxConfig(value);
-}
-
 export function normalizeOptions(options: unknown): SandboxConfigOverrides {
   if (!isRecord(options)) return {};
-  if (options.config === undefined) return normalizeConfig(options);
+  if (options.config === undefined) return parseSandboxConfig(options);
   if (!isRecord(options.config)) throw new Error('config must be an object');
-  return normalizeConfig(options.config);
+  return parseSandboxConfig(options.config);
 }
-
-export function deepMerge(base: SandboxConfig, overrides: SandboxConfigOverrides): SandboxConfig {
-  return deepMergeSandboxConfig(base, overrides);
-}
-
 export function getConfigPaths(baseDirectory: string): { globalPath: string; projectPath: string } {
   const configHome = process.env.XDG_CONFIG_HOME;
   const configDirectory =
@@ -114,7 +37,7 @@ export function readConfigFile(configPath: string): SandboxConfigOverrides {
   if (!existsSync(configPath)) return {};
 
   try {
-    return normalizeConfig(JSON.parse(readFileSync(configPath, 'utf-8')));
+    return parseSandboxConfig(JSON.parse(readFileSync(configPath, 'utf-8')));
   } catch (error) {
     throw new Error(
       `Could not load ${configPath}: ${error instanceof Error ? error.message : String(error)}`,
@@ -138,14 +61,17 @@ export function loadConfig(
   const templateConfig: SandboxConfig = JSON.parse(readFileSync(templatePath, 'utf-8'));
   templateConfig.filesystem.denyWrite.push(globalPath);
   const globalOverrides = readConfigFile(globalPath);
-  const baseConfig = deepMerge(templateConfig, globalOverrides);
+  const baseConfig = deepMergeSandboxConfig(templateConfig, globalOverrides);
 
-  return deepMerge(deepMerge(baseConfig, readConfigFile(projectPath)), optionOverrides);
+  return deepMergeSandboxConfig(
+    deepMergeSandboxConfig(baseConfig, readConfigFile(projectPath)),
+    optionOverrides,
+  );
 }
 
 export function writeConfigFile(configPath: string, update: SandboxConfigOverrides): void {
   const next: Record<string, unknown> = { ...readConfigFile(configPath) };
-  for (const [key, value] of Object.entries(normalizeConfig(update))) {
+  for (const [key, value] of Object.entries(parseSandboxConfig(update))) {
     if (!isRecord(value)) {
       next[key] = value;
       continue;
@@ -183,95 +109,6 @@ export function landstripBinaryPath(): string {
   }
 }
 
-// Permission requests reach the plugin in slightly different shapes across the
-// server hook and the TUI event bus, so the field-fallback parsing below is the
-// single source of truth both entrypoints share.
-export function permissionType(permission: Record<string, unknown>, fallback = ''): string {
-  if (typeof permission.permission === 'string') return permission.permission;
-  if (typeof permission.action === 'string') return permission.action;
-  if (typeof permission.type === 'string') return permission.type;
-  return fallback;
-}
-
-export function permissionPattern(permission: Record<string, unknown>): string | undefined {
-  const patterns = permission.patterns;
-  if (Array.isArray(patterns))
-    return patterns.find((item): item is string => typeof item === 'string');
-
-  const pattern = permission.pattern;
-  if (typeof pattern === 'string') return pattern;
-  if (Array.isArray(pattern))
-    return pattern.find((item): item is string => typeof item === 'string');
-
-  return undefined;
-}
-
-/**
- * Every string pattern a permission carries, in declaration order, read from
- * `patterns`, `pattern`, or `resources`. The plural complement to
- * {@link permissionPattern} for callers that must inspect all patterns.
- */
-export function permissionPatterns(permission: Record<string, unknown>): string[] {
-  const patterns = permission.patterns;
-  if (Array.isArray(patterns))
-    return patterns.filter((item): item is string => typeof item === 'string');
-
-  const pattern = permission.pattern;
-  if (typeof pattern === 'string') return [pattern];
-  if (Array.isArray(pattern))
-    return pattern.filter((item): item is string => typeof item === 'string');
-
-  const resources = permission.resources;
-  if (Array.isArray(resources))
-    return resources.filter((item): item is string => typeof item === 'string');
-
-  return [];
-}
-
-// The concrete resource a permission concerns (a path or a domain), used to show
-// the user exactly what they are approving and to persist the right allowlist.
-export function permissionResource(permission: Record<string, unknown>): string | undefined {
-  const metadata = isRecord(permission.metadata) ? permission.metadata : {};
-  const type = permissionType(permission);
-  const pattern = permissionPattern(permission);
-
-  if (type === 'bash') {
-    const command = typeof metadata.command === 'string' ? metadata.command : pattern;
-    const domains = typeof command === 'string' ? extractDomainsFromCommand(command) : [];
-    return domains.length > 0 ? domains.join(', ') : (command ?? pattern);
-  }
-
-  if (typeof metadata.filepath === 'string') return metadata.filepath;
-  if (typeof metadata.path === 'string') return metadata.path;
-  return pattern;
-}
-
-export function updateForPermission(
-  permission: Record<string, unknown>,
-): SandboxConfigOverrides | null {
-  const metadata = isRecord(permission.metadata) ? permission.metadata : {};
-  const type = permissionType(permission);
-  const pattern = permissionPattern(permission);
-
-  if (type === 'bash') {
-    const command = typeof metadata.command === 'string' ? metadata.command : pattern;
-    const domains = typeof command === 'string' ? extractDomainsFromCommand(command) : [];
-    return domains.length > 0 ? { network: { allowedDomains: domains } } : null;
-  }
-
-  if (type === 'read' || type === 'glob' || type === 'grep' || type === 'list') {
-    const filePath = typeof metadata.filepath === 'string' ? metadata.filepath : pattern;
-    return filePath ? { filesystem: { allowRead: [filePath] } } : null;
-  }
-
-  if (type === 'edit' || type === 'write' || type === 'apply_patch') {
-    const filePath = typeof metadata.filepath === 'string' ? metadata.filepath : pattern;
-    return filePath ? { filesystem: { allowWrite: [filePath] } } : null;
-  }
-
-  return null;
-}
-
 export interface TrapSessionHello {
   kind: 'opencode-landstrip-session';
   sessionID: string;

package/tui.ts

@@ -14,23 +14,28 @@ import { createSignal, onMount } from 'solid-js';
 
 import {
   controlResponseLine,
+  evaluateReadAccess,
+  evaluateWriteAccess,
+  isPathReadAllowed,
+  isPathWriteAllowed,
+  isQueryTrap,
+  parseLandstripTraps,
+  sessionScopeFor,
+} from '@landstrip/landstrip-api/shared';
+
+import {
   decodeTrapSessionHello,
   getConfigPaths,
-  isQueryTrap,
   loadConfig,
   normalizeOptions,
   nextSandboxPermissionIndex,
-  parseLandstripTraps,
   removeDiscoveryFile,
-  sessionAllows,
   sessionAllowancesFor,
   sandboxConfigTarget,
-  sessionScopeFor,
   rootSessionIDFor,
   setSandboxConfigEnabled,
   shouldRenderSandboxPermission,
   type SessionAllowances,
-  updateForPermission,
   writeConfigFile,
   writeDiscoveryPort,
 } from './shared.js';
@@ -463,21 +468,29 @@ const tui: TuiPlugin.Definition = {
       const action = choice === 'deny' ? 'deny' : 'allow';
       const verb = entry.operation === 'read' ? 'Read' : 'Write';
       const directory = entry.directory;
-      const scope = sessionScopeFor(entry.path, directory);
+      const config = loadConfig(directory, optionOverrides);
+      let scope = sessionScopeFor(entry.path, directory);
+      if (
+        entry.operation === 'read'
+          ? !isPathReadAllowed(entry.path, [scope], config.filesystem.denyRead, directory, {
+              requireAllowMatch: true,
+            })
+          : !isPathWriteAllowed(entry.path, [scope], config.filesystem.denyWrite, directory)
+      ) {
+        scope = entry.path;
+      }
       const allowances = sessionAllowancesFor(sessionAllowances, entry.sessionID);
       const sessionPaths =
         entry.operation === 'read' ? allowances.readPaths : allowances.writePaths;
-
       let responseAction: 'allow' | 'deny' = action;
       try {
         if (action === 'allow') {
           if (choice === 'project' || choice === 'global') {
             const { globalPath, projectPath } = getConfigPaths(directory);
-            const update = updateForPermission({
-              permission: entry.operation,
-              metadata: { filepath: scope },
+            writeConfigFile(choice === 'project' ? projectPath : globalPath, {
+              filesystem:
+                entry.operation === 'read' ? { allowRead: [scope] } : { allowWrite: [scope] },
             });
-            if (update) writeConfigFile(choice === 'project' ? projectPath : globalPath, update);
           }
           if (choice !== 'once') sessionPaths.add(scope);
         }
@@ -581,23 +594,29 @@ const tui: TuiPlugin.Definition = {
               if (seen.has(trap.query_id)) continue;
               seen.add(trap.query_id);
 
-              if (!loadConfig(sessionDirectory, optionOverrides).enabled) {
+              const config = loadConfig(sessionDirectory, optionOverrides);
+              if (!config.enabled) {
                 respondQuery(socket, trap.query_id, 'allow');
                 continue;
               }
 
               if (trap.kind === 'filesystem') {
-                if (trap.operation === 'write' && trap.reason === 'deny_match') {
-                  respondQuery(socket, trap.query_id, 'deny');
-                  continue;
-                }
-                const sessionPaths =
-                  trap.operation === 'read' ? allowances.readPaths : allowances.writePaths;
-                if (sessionAllows(sessionPaths, trap.path)) {
+                const sessionAllowed =
+                  trap.operation === 'read'
+                    ? evaluateReadAccess(
+                        trap.path,
+                        { ...config.filesystem, allowRead: [...allowances.readPaths] },
+                        { baseDirectory: sessionDirectory, requireAllowMatch: true },
+                      ) === 'allow'
+                    : evaluateWriteAccess(
+                        trap.path,
+                        { ...config.filesystem, allowWrite: [...allowances.writePaths] },
+                        { baseDirectory: sessionDirectory },
+                      ) === 'allow';
+                if (sessionAllowed) {
                   respondQuery(socket, trap.query_id, 'allow');
                   continue;
                 }
-
                 const entry: FsQueryEntry = {
                   kind: 'fs-query',
                   id: `landstrip-${trap.operation}:${socketId}:${trap.query_id}`,