pi-landstrip 0.11.2 → 0.11.4

package/index.ts

@@ -85,7 +85,12 @@ interface LandstripErrorResponse {
   source?: string;
 }
 
-const LANDSTRIP_VERSION = [0, 11, 6] as const;
+interface LandstripBashCallbacks {
+  onStderr?: (data: Buffer) => void;
+  onErrorFd?: (data: Buffer) => void;
+}
+
+const LANDSTRIP_VERSION = [0, 11, 9] as const;
 const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const LANDSTRIP_ERROR_REASONS = new Set<LandstripErrorReason>([
   'Other',
@@ -111,28 +116,14 @@ const DEFAULT_CONFIG: SandboxConfig = {
     allowLocalBinding: false,
     allowAllUnixSockets: false,
     allowUnixSockets: [],
-    allowedDomains: [
-      'npmjs.org',
-      '*.npmjs.org',
-      'registry.npmjs.org',
-      'registry.yarnpkg.com',
-      'pypi.org',
-      '*.pypi.org',
-      'github.com',
-      '*.github.com',
-      'api.github.com',
-      'raw.githubusercontent.com',
-      'crates.io',
-      '*.crates.io',
-      'static.crates.io',
-    ],
+    allowedDomains: [],
     deniedDomains: [],
   },
   filesystem: {
     denyRead: ['/Users', '/home'],
-    allowRead: ['.', '~/.config', '~/.gitconfig', '~/.local', '~/.cargo', '/dev/null'],
-    allowWrite: ['.', '/tmp', '/dev/null'],
-    denyWrite: ['.env', '.env.*', '*.pem', '*.key'],
+    allowRead: ['.', '~/.gitconfig', '/dev/null'],
+    allowWrite: ['.', '/dev/null'],
+    denyWrite: ['**/.env', '**/.env.*', '**/*.pem', '**/*.key'],
   },
 };
 
@@ -191,16 +182,30 @@ function loadConfig(cwd: string): SandboxConfig {
   return deepMerge(deepMerge(DEFAULT_CONFIG, globalConfig), projectConfig);
 }
 
+function mergeArray(base: string[], override?: string[]): string[] {
+  if (!override) return base;
+  return [...new Set([...base, ...override])];
+}
+
 function deepMerge(base: SandboxConfig, overrides: Partial<SandboxConfig>): SandboxConfig {
+  const network = overrides.network;
+  const filesystem = overrides.filesystem;
+
   return {
     enabled: overrides.enabled ?? base.enabled,
     network: {
-      ...base.network,
-      ...overrides.network,
+      allowNetwork: network?.allowNetwork ?? base.network.allowNetwork,
+      allowLocalBinding: network?.allowLocalBinding ?? base.network.allowLocalBinding,
+      allowAllUnixSockets: network?.allowAllUnixSockets ?? base.network.allowAllUnixSockets,
+      allowUnixSockets: mergeArray(base.network.allowUnixSockets, network?.allowUnixSockets),
+      allowedDomains: mergeArray(base.network.allowedDomains, network?.allowedDomains),
+      deniedDomains: mergeArray(base.network.deniedDomains, network?.deniedDomains),
     },
     filesystem: {
-      ...base.filesystem,
-      ...overrides.filesystem,
+      denyRead: mergeArray(base.filesystem.denyRead, filesystem?.denyRead),
+      allowRead: mergeArray(base.filesystem.allowRead, filesystem?.allowRead),
+      allowWrite: mergeArray(base.filesystem.allowWrite, filesystem?.allowWrite),
+      denyWrite: mergeArray(base.filesystem.denyWrite, filesystem?.denyWrite),
     },
   };
 }
@@ -419,15 +424,22 @@ function extractBlockedPath(output: string, cwd: string, command?: string): stri
     }
   }
 
+  return extractNativeDeniedPath(output, cwd);
+}
+
+function extractNativeDeniedPath(output: string, cwd: string): string | null {
+  let match = output.match(/['"]([^'"\n]+)['"]:\s+(?:Operation not permitted|Permission denied)/);
+  if (match) return normalizePathMatch(match[1], cwd);
+
   // bash/sh: line X: /path: Permission denied
-  let match = output.match(
+  match = output.match(
     /(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/,
   );
   if (match) return normalizePathMatch(match[1], cwd);
 
   // ls/cat/cp: cannot open/access/stat '/path': Permission denied
   match = output.match(
-    /^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: Permission denied$/m,
+    /^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: (?:Operation not permitted|Permission denied)$/m,
   );
   if (match) return normalizePathMatch(match[1], cwd);
 
@@ -440,6 +452,25 @@ function extractBlockedPath(output: string, cwd: string, command?: string): stri
   return null;
 }
 
+function extractNativeWriteDeniedPath(output: string, cwd: string): string | null {
+  let match = output.match(
+    /(?:[Uu]nable to create|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\n]*['"]([^'"\n]+)['"]:\s+(?:Operation not permitted|Permission denied)/m,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  match = output.match(
+    /(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  match = output.match(
+    /^[a-zA-Z0-9_-]+: cannot create(?: directory)? '?([^'\n]+?)'?(?: for writing)?: (?:Operation not permitted|Permission denied)$/m,
+  );
+  if (match) return normalizePathMatch(match[1], cwd);
+
+  return null;
+}
+
 function extractBlockedWritePath(output: string, cwd: string): string | null {
   for (const error of parseLandstripErrors(output).filter(isFilesystemAccessDenied)) {
     if (error.file && error.operation === 'write') {
@@ -447,7 +478,7 @@ function extractBlockedWritePath(output: string, cwd: string): string | null {
     }
   }
 
-  return null;
+  return extractNativeWriteDeniedPath(output, cwd);
 }
 
 function parseLandstripErrors(output: string): LandstripErrorResponse[] {
@@ -1049,7 +1080,7 @@ export function createLandstripIntegration(
 
   function createLandstripBashOps(
     ctx: ExtensionContext,
-    onStderr: (data: Buffer) => void = () => {},
+    callbacks: LandstripBashCallbacks = {},
   ): BashOperations {
     return {
       async exec(command, cwd, { onData, signal, timeout, env }) {
@@ -1059,9 +1090,8 @@ export function createLandstripIntegration(
         const config = loadConfig(cwd);
         const allowNetwork = config.network.allowNetwork;
         const proxy = allowNetwork ? null : await startProxy(ctx, cwd);
-        const proxyPort = proxy ? proxy.port : null;
-        const policy = writePolicyFile(cwd, proxyPort);
-        const landstripArgs = ['-p', policy.path, shell, ...args, command];
+        const policy = writePolicyFile(cwd, proxy?.port ?? null);
+        const landstripArgs = ['--error-fd', '3', '-p', policy.path, shell, ...args, command];
 
         return new Promise((resolvePromise, reject) => {
           let timeoutHandle: NodeJS.Timeout | undefined;
@@ -1081,7 +1111,7 @@ export function createLandstripIntegration(
             cwd,
             env: allowNetwork ? { ...process.env, ...env } : proxyEnv(env, proxy!.port),
             detached: true,
-            stdio: ['ignore', 'pipe', 'pipe'],
+            stdio: ['ignore', 'pipe', 'pipe', 'pipe'],
           });
 
           function killChild(): void {
@@ -1106,13 +1136,18 @@ export function createLandstripIntegration(
 
           signal?.addEventListener('abort', onAbort, { once: true });
           let stderrAcc = '';
+          let errorFdAcc = '';
 
           child.stdout?.on('data', onData);
           child.stderr?.on('data', (data: Buffer) => {
             stderrAcc += data.toString('utf8');
-            onStderr(data);
+            callbacks.onStderr?.(data);
             onData(data);
           });
+          child.stdio[3]?.on('data', (data: Buffer) => {
+            errorFdAcc += data.toString('utf8');
+            callbacks.onErrorFd?.(data);
+          });
 
           child.on('error', (error) => {
             cleanup();
@@ -1130,8 +1165,14 @@ export function createLandstripIntegration(
               return;
             }
 
-            const blockedPath = extractBlockedPath(stderrAcc, cwd, command);
-            const blockedWritePath = extractBlockedWritePath(stderrAcc, cwd);
+            const errorOutput = errorFdAcc || stderrAcc;
+
+            const blockedPath =
+              extractBlockedPath(errorOutput, cwd, command) ??
+              (errorFdAcc ? extractBlockedPath(stderrAcc, cwd, command) : null);
+            const blockedWritePath =
+              extractBlockedWritePath(errorOutput, cwd) ??
+              (errorFdAcc ? extractBlockedWritePath(stderrAcc, cwd) : null);
             if (blockedPath && ctx.hasUI) {
               const config = loadConfig(cwd);
               const isDeniedByDenyRead = matchesPattern(blockedPath, config.filesystem.denyRead);
@@ -1157,7 +1198,7 @@ export function createLandstripIntegration(
                 if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
               }
             } else if (!blockedPath && ctx.hasUI) {
-              const landstripErrors = parseLandstripErrors(stderrAcc);
+              const landstripErrors = parseLandstripErrors(errorOutput);
               if (landstripErrors.length > 0) {
                 const formatted = formatLandstripErrors(landstripErrors);
                 ctx.ui.notify(`Sandbox blocked an operation: ${formatted}`, 'warning');
@@ -1178,56 +1219,94 @@ export function createLandstripIntegration(
     onUpdate: AgentToolUpdateCallback<BashToolDetails | undefined> | undefined,
     ctx: ExtensionContext,
   ): Promise<AgentToolResult<BashToolDetails | undefined>> {
-    let landstripStderr = '';
+    let landstripErrorOutput = '';
+    let stderrOutput = '';
     const sandboxedBash = createBashToolDefinition(ctx.cwd, {
-      operations: createLandstripBashOps(ctx, (data) => {
-        landstripStderr += data.toString('utf8');
+      operations: createLandstripBashOps(ctx, {
+        onErrorFd: (data) => {
+          landstripErrorOutput += data.toString('utf8');
+        },
+        onStderr: (data) => {
+          stderrOutput += data.toString('utf8');
+        },
       }),
       shellPath: SettingsManager.create(ctx.cwd).getShellPath(),
     });
 
     const run = () => sandboxedBash.execute(id, params, signal, onUpdate, ctx);
+    const retryWithWriteAccess = async (
+      blockedPath: string,
+    ): Promise<AgentToolResult<BashToolDetails | undefined> | null> => {
+      if (!ctx.hasUI) return null;
+
+      let config = loadConfig(ctx.cwd);
+      const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
+      if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
+        ctx.ui.notify(
+          `"${blockedPath}" is blocked by denyWrite. Check:\n  ${projectPath}\n  ${globalPath}`,
+          'warning',
+        );
+        return null;
+      }
+
+      if (shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(ctx.cwd), matchesPattern)) {
+        const choice = await promptWriteBlock(ctx, blockedPath);
+        if (choice === 'abort') return null;
+        await applyWriteChoice(choice, blockedPath, ctx.cwd);
+      }
+
+      config = loadConfig(ctx.cwd);
+      if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
+        ctx.ui.notify(
+          `"${blockedPath}" was added to allowWrite, but denyWrite still blocks it. Check:\n  ${projectPath}\n  ${globalPath}`,
+          'warning',
+        );
+        return null;
+      }
+
+      onUpdate?.({
+        content: [
+          { type: 'text', text: `\n--- Write access granted for "${blockedPath}", retrying ---\n` },
+        ],
+        details: {},
+      });
+      landstripErrorOutput = '';
+      stderrOutput = '';
+      return run();
+    };
+
     let result: AgentToolResult<BashToolDetails | undefined>;
     try {
       result = await run();
     } catch (error) {
-      const landstripErrors = parseLandstripErrors(landstripStderr);
+      const errorText = error instanceof Error ? error.message : String(error);
+      const fallbackOutput = `${stderrOutput}\n${errorText}`;
+      const blockedPath =
+        extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
+        extractBlockedWritePath(fallbackOutput, ctx.cwd);
+      if (blockedPath) {
+        const retryResult = await retryWithWriteAccess(blockedPath);
+        if (retryResult) return retryResult;
+      }
+
+      const landstripErrors = parseLandstripErrors(landstripErrorOutput || errorText);
       if (landstripErrors.length > 0) {
         throw new Error(formatLandstripErrors(landstripErrors));
       }
       throw error;
     }
-    const landstripErrors = parseLandstripErrors(landstripStderr);
+    const landstripErrors = parseLandstripErrors(landstripErrorOutput);
     if (landstripErrors.length > 0) {
       const message = formatLandstripErrors(landstripErrors);
       result.content.unshift({ type: 'text', text: `\n${message}\n` });
     }
-    const blockedPath = extractBlockedWritePath(landstripStderr, ctx.cwd);
-
-    if (!blockedPath || !ctx.hasUI) return result;
-
-    const choice = await promptWriteBlock(ctx, blockedPath);
-    if (choice === 'abort') return result;
-
-    await applyWriteChoice(choice, blockedPath, ctx.cwd);
-
-    const config = loadConfig(ctx.cwd);
-    const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
-    if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
-      ctx.ui.notify(
-        `"${blockedPath}" was added to allowWrite, but denyWrite still blocks it. Check:\n  ${projectPath}\n  ${globalPath}`,
-        'warning',
-      );
-      return result;
-    }
+    const blockedPath =
+      extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
+      extractBlockedWritePath(stderrOutput, ctx.cwd);
+    if (!blockedPath) return result;
 
-    onUpdate?.({
-      content: [
-        { type: 'text', text: `\n--- Write access granted for "${blockedPath}", retrying ---\n` },
-      ],
-      details: {},
-    });
-    return run();
+    const retryResult = await retryWithWriteAccess(blockedPath);
+    return retryResult ?? result;
   }
 
   async function preflightCommandDomains(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-tui": "^0.78.0",
-    "@jarkkojs/landstrip": "^0.11.6"
+    "@jarkkojs/landstrip": "^0.11.9"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.78.0",

package/sandbox.json

@@ -2,56 +2,16 @@
   "enabled": true,
   "network": {
     "allowNetwork": false,
-    "allowLocalBinding": true,
+    "allowLocalBinding": false,
     "allowAllUnixSockets": false,
     "allowUnixSockets": [],
-    "allowedDomains": [
-      "github.com",
-      "*.github.com",
-      "api.github.com",
-      "raw.githubusercontent.com",
-      "objects.githubusercontent.com",
-      "codeload.github.com",
-      "registry.npmjs.org",
-      "npmjs.org",
-      "*.npmjs.org",
-      "nodejs.org",
-      "*.nodejs.org",
-      "crates.io",
-      "*.crates.io",
-      "static.crates.io"
-    ],
+    "allowedDomains": [],
     "deniedDomains": []
   },
   "filesystem": {
-    "denyRead": ["/home"],
-    "allowRead": [
-      ".",
-      "/tmp",
-      "/var/tmp",
-      "/dev/null",
-      "~/.config",
-      "~/.gitconfig",
-      "~/.local",
-      "~/.cargo",
-      "~/.rustup",
-      "~/.npm",
-      "~/.cache",
-      "~/.bun",
-      "~/.node-gyp"
-    ],
-    "allowWrite": [
-      ".",
-      "/tmp",
-      "/var/tmp",
-      "/dev/null",
-      "~/.cargo",
-      "~/.rustup",
-      "~/.npm",
-      "~/.cache",
-      "~/.bun",
-      "~/.node-gyp"
-    ],
-    "denyWrite": [".env", ".env.*", "*.pem", "*.key"]
+    "denyRead": ["/Users", "/home"],
+    "allowRead": [".", "~/.gitconfig", "/dev/null"],
+    "allowWrite": [".", "/dev/null"],
+    "denyWrite": ["**/.env", "**/.env.*", "**/*.pem", "**/*.key"]
   }
 }