pi-landstrip 0.11.1 → 0.11.3

package/index.ts

@@ -72,15 +72,41 @@ interface LandstripPolicy {
   filesystem: SandboxFilesystemConfig;
 }
 
+type LandstripErrorReason = 'Other' | 'AccessDenied' | 'LaunchFailed' | 'SetupFailed' | 'Usage';
+type LandstripOperation = 'read' | 'write';
+type LandstripErrorType = 'filesystem' | 'network' | 'platform' | 'launch' | 'encoding';
+
 interface LandstripErrorResponse {
-  reason: 'Other' | 'LaunchFailed' | 'SetupFailed' | 'Usage';
+  reason: LandstripErrorReason;
   file?: string;
+  operation?: LandstripOperation;
   program?: string;
-  type?: 'filesystem' | 'network' | 'platform' | 'launch' | 'encoding';
-  source: string;
+  type?: LandstripErrorType;
+  source?: string;
+}
+
+interface LandstripBashCallbacks {
+  onStderr?: (data: Buffer) => void;
+  onErrorFd?: (data: Buffer) => void;
 }
 
-const LANDSTRIP_VERSION = [0, 11, 5] as const;
+const LANDSTRIP_VERSION = [0, 11, 9] as const;
+const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
+const LANDSTRIP_ERROR_REASONS = new Set<LandstripErrorReason>([
+  'Other',
+  'AccessDenied',
+  'LaunchFailed',
+  'SetupFailed',
+  'Usage',
+]);
+const LANDSTRIP_OPERATIONS = new Set<LandstripOperation>(['read', 'write']);
+const LANDSTRIP_ERROR_TYPES = new Set<LandstripErrorType>([
+  'filesystem',
+  'network',
+  'platform',
+  'launch',
+  'encoding',
+]);
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 
 const DEFAULT_CONFIG: SandboxConfig = {
@@ -348,6 +374,22 @@ function normalizePathMatch(value: string, cwd: string): string | null {
   return isPathLike(value) ? normalizeBlockedPath(value, cwd) : null;
 }
 
+function isFilesystemAccessDenied(error: LandstripErrorResponse): boolean {
+  return error.reason === 'AccessDenied' && error.type === 'filesystem';
+}
+
+function isLandstripErrorReason(value: string): value is LandstripErrorReason {
+  return LANDSTRIP_ERROR_REASONS.has(value as LandstripErrorReason);
+}
+
+function isLandstripOperation(value: string): value is LandstripOperation {
+  return LANDSTRIP_OPERATIONS.has(value as LandstripOperation);
+}
+
+function isLandstripErrorType(value: string): value is LandstripErrorType {
+  return LANDSTRIP_ERROR_TYPES.has(value as LandstripErrorType);
+}
+
 function extractCandidatePaths(command: string): string[] {
   const paths: string[] = [];
   // Split on whitespace, preserving quoted strings minimally
@@ -362,32 +404,13 @@ function extractCandidatePaths(command: string): string[] {
 }
 
 function extractBlockedPath(output: string, cwd: string, command?: string): string | null {
-  // bash/sh: line X: /path: Permission denied
-  let match = output.match(
-    /(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/,
-  );
-  if (match) return normalizePathMatch(match[1], cwd);
-
-  // ls/cat/cp: cannot open/access/stat '/path': Permission denied
-  match = output.match(
-    /^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: Permission denied$/m,
-  );
-  if (match) return normalizePathMatch(match[1], cwd);
-
-  // Generic: cmd: /absolute/path: Permission denied or Operation not permitted
-  match = output.match(
-    /^[a-zA-Z0-9_-]+: (\/[^\n:]+): (?:Operation not permitted|Permission denied)$/m,
-  );
-  if (match) return normalizeBlockedPath(match[1], cwd);
-
-  // Landstrip structured error format with file field
-  const landstripErrors = parseLandstripErrors(output);
+  const landstripErrors = parseLandstripErrors(output).filter(isFilesystemAccessDenied);
   for (const error of landstripErrors) {
     if (error.file) return normalizeBlockedPath(error.file, cwd);
   }
 
   // If landstrip reported an error but without a file field, try to
-  // extract the blocked path from the command itself
+  // extract the blocked path from the command itself.
   if (landstripErrors.length > 0 && command) {
     const config = loadConfig(cwd);
     for (const candidate of extractCandidatePaths(command)) {
@@ -401,11 +424,61 @@ function extractBlockedPath(output: string, cwd: string, command?: string): stri
     }
   }
 
+  return extractNativeDeniedPath(output, cwd);
+}
+
+function extractNativeDeniedPath(output: string, cwd: string): string | null {
+  let match = output.match(/['"]([^'"\n]+)['"]:\s+(?:Operation not permitted|Permission denied)/);
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  // bash/sh: line X: /path: Permission denied
+  match = output.match(
+    /(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  // ls/cat/cp: cannot open/access/stat '/path': Permission denied
+  match = output.match(
+    /^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: (?:Operation not permitted|Permission denied)$/m,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  // Generic: cmd: /absolute/path: Permission denied or Operation not permitted
+  match = output.match(
+    /^[a-zA-Z0-9_-]+: (\/[^:\n]+): (?:Operation not permitted|Permission denied)$/m,
+  );
+  if (match) return normalizeBlockedPath(match[1], cwd);
+
+  return null;
+}
+
+function extractNativeWriteDeniedPath(output: string, cwd: string): string | null {
+  let match = output.match(
+    /(?:[Uu]nable to create|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\n]*['"]([^'"\n]+)['"]:\s+(?:Operation not permitted|Permission denied)/m,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  match = output.match(
+    /(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  match = output.match(
+    /^[a-zA-Z0-9_-]+: cannot create(?: directory)? '?([^'\n]+?)'?(?: for writing)?: (?:Operation not permitted|Permission denied)$/m,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
   return null;
 }
 
-function extractBlockedWritePath(output: string, cwd: string, command?: string): string | null {
-  return extractBlockedPath(output, cwd, command);
+function extractBlockedWritePath(output: string, cwd: string): string | null {
+  for (const error of parseLandstripErrors(output).filter(isFilesystemAccessDenied)) {
+    if (error.file && error.operation === 'write') {
+      return normalizeBlockedPath(error.file, cwd);
+    }
+  }
+
+  return extractNativeWriteDeniedPath(output, cwd);
 }
 
 function parseLandstripErrors(output: string): LandstripErrorResponse[] {
@@ -424,22 +497,21 @@ function parseLandstripErrors(output: string): LandstripErrorResponse[] {
 
     if (
       fields.reason &&
-      ['Other', 'LaunchFailed', 'SetupFailed', 'Usage'].includes(fields.reason) &&
-      fields.source
+      isLandstripErrorReason(fields.reason) &&
+      (fields.source || fields.reason === 'AccessDenied')
     ) {
-      const error: LandstripErrorResponse = {
-        reason: fields.reason as LandstripErrorResponse['reason'],
-        source: fields.source,
-      };
+      const error: LandstripErrorResponse = { reason: fields.reason };
 
+      if (fields.source) error.source = fields.source;
       if (fields.file) error.file = fields.file;
       if (fields.program) error.program = fields.program;
 
-      if (
-        fields.type &&
-        ['filesystem', 'network', 'platform', 'launch', 'encoding'].includes(fields.type)
-      ) {
-        error.type = fields.type as LandstripErrorResponse['type'];
+      if (fields.operation && isLandstripOperation(fields.operation)) {
+        error.operation = fields.operation;
+      }
+
+      if (fields.type && isLandstripErrorType(fields.type)) {
+        error.type = fields.type;
       }
 
       errors.push(error);
@@ -463,7 +535,12 @@ function formatLandstripErrors(errors: LandstripErrorResponse[]): string {
       if (err.type) {
         parts.push(`:${err.type}`);
       }
-      parts.push(`: ${err.source}`);
+      if (err.operation) {
+        parts.push(`:${err.operation}`);
+      }
+      if (err.source) {
+        parts.push(`: ${err.source}`);
+      }
 
       return parts.join('');
     })
@@ -1003,7 +1080,7 @@ export function createLandstripIntegration(
 
   function createLandstripBashOps(
     ctx: ExtensionContext,
-    onStderr: (data: Buffer) => void = () => {},
+    callbacks: LandstripBashCallbacks = {},
   ): BashOperations {
     return {
       async exec(command, cwd, { onData, signal, timeout, env }) {
@@ -1013,9 +1090,8 @@ export function createLandstripIntegration(
         const config = loadConfig(cwd);
         const allowNetwork = config.network.allowNetwork;
         const proxy = allowNetwork ? null : await startProxy(ctx, cwd);
-        const proxyPort = proxy ? proxy.port : null;
-        const policy = writePolicyFile(cwd, proxyPort);
-        const landstripArgs = ['-p', policy.path, shell, ...args, command];
+        const policy = writePolicyFile(cwd, proxy?.port ?? null);
+        const landstripArgs = ['--error-fd', '3', '-p', policy.path, shell, ...args, command];
 
         return new Promise((resolvePromise, reject) => {
           let timeoutHandle: NodeJS.Timeout | undefined;
@@ -1035,7 +1111,7 @@ export function createLandstripIntegration(
             cwd,
             env: allowNetwork ? { ...process.env, ...env } : proxyEnv(env, proxy!.port),
             detached: true,
-            stdio: ['ignore', 'pipe', 'pipe'],
+            stdio: ['ignore', 'pipe', 'pipe', 'pipe'],
           });
 
           function killChild(): void {
@@ -1060,13 +1136,18 @@ export function createLandstripIntegration(
 
           signal?.addEventListener('abort', onAbort, { once: true });
           let stderrAcc = '';
+          let errorFdAcc = '';
 
           child.stdout?.on('data', onData);
           child.stderr?.on('data', (data: Buffer) => {
             stderrAcc += data.toString('utf8');
-            onStderr(data);
+            callbacks.onStderr?.(data);
             onData(data);
           });
+          child.stdio[3]?.on('data', (data: Buffer) => {
+            errorFdAcc += data.toString('utf8');
+            callbacks.onErrorFd?.(data);
+          });
 
           child.on('error', (error) => {
             cleanup();
@@ -1084,7 +1165,14 @@ export function createLandstripIntegration(
               return;
             }
 
-            const blockedPath = extractBlockedPath(stderrAcc, cwd, command);
+            const errorOutput = errorFdAcc || stderrAcc;
+
+            const blockedPath =
+              extractBlockedPath(errorOutput, cwd, command) ??
+              (errorFdAcc ? extractBlockedPath(stderrAcc, cwd, command) : null);
+            const blockedWritePath =
+              extractBlockedWritePath(errorOutput, cwd) ??
+              (errorFdAcc ? extractBlockedWritePath(stderrAcc, cwd) : null);
             if (blockedPath && ctx.hasUI) {
               const config = loadConfig(cwd);
               const isDeniedByDenyRead = matchesPattern(blockedPath, config.filesystem.denyRead);
@@ -1095,7 +1183,10 @@ export function createLandstripIntegration(
                 matchesPattern,
               );
 
-              if (isDeniedByDenyRead || !isReadAllowed) {
+              if (blockedWritePath === blockedPath && !isWriteAllowed) {
+                const choice = await promptWriteBlock(ctx, blockedPath);
+                if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
+              } else if (isDeniedByDenyRead || !isReadAllowed) {
                 const choice = await promptReadBlock(
                   ctx,
                   blockedPath,
@@ -1107,7 +1198,7 @@ export function createLandstripIntegration(
                 if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
               }
             } else if (!blockedPath && ctx.hasUI) {
-              const landstripErrors = parseLandstripErrors(stderrAcc);
+              const landstripErrors = parseLandstripErrors(errorOutput);
               if (landstripErrors.length > 0) {
                 const formatted = formatLandstripErrors(landstripErrors);
                 ctx.ui.notify(`Sandbox blocked an operation: ${formatted}`, 'warning');
@@ -1128,60 +1219,94 @@ export function createLandstripIntegration(
     onUpdate: AgentToolUpdateCallback<BashToolDetails | undefined> | undefined,
     ctx: ExtensionContext,
   ): Promise<AgentToolResult<BashToolDetails | undefined>> {
-    let landstripStderr = '';
+    let landstripErrorOutput = '';
+    let stderrOutput = '';
     const sandboxedBash = createBashToolDefinition(ctx.cwd, {
-      operations: createLandstripBashOps(ctx, (data) => {
-        landstripStderr += data.toString('utf8');
+      operations: createLandstripBashOps(ctx, {
+        onErrorFd: (data) => {
+          landstripErrorOutput += data.toString('utf8');
+        },
+        onStderr: (data) => {
+          stderrOutput += data.toString('utf8');
+        },
       }),
       shellPath: SettingsManager.create(ctx.cwd).getShellPath(),
     });
 
     const run = () => sandboxedBash.execute(id, params, signal, onUpdate, ctx);
+    const retryWithWriteAccess = async (
+      blockedPath: string,
+    ): Promise<AgentToolResult<BashToolDetails | undefined> | null> => {
+      if (!ctx.hasUI) return null;
+
+      let config = loadConfig(ctx.cwd);
+      const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
+      if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
+        ctx.ui.notify(
+          `"${blockedPath}" is blocked by denyWrite. Check:\n  ${projectPath}\n  ${globalPath}`,
+          'warning',
+        );
+        return null;
+      }
+
+      if (shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(ctx.cwd), matchesPattern)) {
+        const choice = await promptWriteBlock(ctx, blockedPath);
+        if (choice === 'abort') return null;
+        await applyWriteChoice(choice, blockedPath, ctx.cwd);
+      }
+
+      config = loadConfig(ctx.cwd);
+      if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
+        ctx.ui.notify(
+          `"${blockedPath}" was added to allowWrite, but denyWrite still blocks it. Check:\n  ${projectPath}\n  ${globalPath}`,
+          'warning',
+        );
+        return null;
+      }
+
+      onUpdate?.({
+        content: [
+          { type: 'text', text: `\n--- Write access granted for "${blockedPath}", retrying ---\n` },
+        ],
+        details: {},
+      });
+      landstripErrorOutput = '';
+      stderrOutput = '';
+      return run();
+    };
+
     let result: AgentToolResult<BashToolDetails | undefined>;
     try {
       result = await run();
     } catch (error) {
-      const landstripErrors = parseLandstripErrors(landstripStderr);
+      const errorText = error instanceof Error ? error.message : String(error);
+      const fallbackOutput = `${stderrOutput}\n${errorText}`;
+      const blockedPath =
+        extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
+        extractBlockedWritePath(fallbackOutput, ctx.cwd);
+      if (blockedPath) {
+        const retryResult = await retryWithWriteAccess(blockedPath);
+        if (retryResult) return retryResult;
+      }
+
+      const landstripErrors = parseLandstripErrors(landstripErrorOutput || errorText);
       if (landstripErrors.length > 0) {
         throw new Error(formatLandstripErrors(landstripErrors));
       }
       throw error;
     }
-    const outputText = result.content
-      .filter((content) => content.type === 'text')
-      .map((content) => content.text)
-      .join('\n');
-    const landstripErrors = parseLandstripErrors(landstripStderr);
+    const landstripErrors = parseLandstripErrors(landstripErrorOutput);
     if (landstripErrors.length > 0) {
       const message = formatLandstripErrors(landstripErrors);
       result.content.unshift({ type: 'text', text: `\n${message}\n` });
     }
-    const blockedPath = extractBlockedWritePath(outputText, ctx.cwd, params.command);
-
-    if (!blockedPath || !ctx.hasUI) return result;
-
-    const choice = await promptWriteBlock(ctx, blockedPath);
-    if (choice === 'abort') return result;
-
-    await applyWriteChoice(choice, blockedPath, ctx.cwd);
+    const blockedPath =
+      extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
+      extractBlockedWritePath(stderrOutput, ctx.cwd);
+    if (!blockedPath) return result;
 
-    const config = loadConfig(ctx.cwd);
-    const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
-    if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
-      ctx.ui.notify(
-        `"${blockedPath}" was added to allowWrite, but denyWrite still blocks it. Check:\n  ${projectPath}\n  ${globalPath}`,
-        'warning',
-      );
-      return result;
-    }
-
-    onUpdate?.({
-      content: [
-        { type: 'text', text: `\n--- Write access granted for "${blockedPath}", retrying ---\n` },
-      ],
-      details: {},
-    });
-    return run();
+    const retryResult = await retryWithWriteAccess(blockedPath);
+    return retryResult ?? result;
   }
 
   async function preflightCommandDomains(
@@ -1256,7 +1381,10 @@ export function createLandstripIntegration(
     if (!hasMinimumVersion(version, LANDSTRIP_VERSION)) {
       sandboxEnabled = false;
       sandboxReady = false;
-      ctx.ui.notify(`landstrip 0.11.5 or newer is required; found: ${version}`, 'error');
+      ctx.ui.notify(
+        `landstrip ${REQUIRED_LANDSTRIP_VERSION} or newer is required; found: ${version}`,
+        'error',
+      );
       return false;
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-tui": "^0.78.0",
-    "@jarkkojs/landstrip": "^0.11.5"
+    "@jarkkojs/landstrip": "^0.11.9"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.78.0",