pi-landstrip 0.11.7 → 0.11.9

package/README.md

@@ -23,13 +23,22 @@ Project config takes precedence.
 
 See [`sandbox.json`](./sandbox.json) for a starter config.
 
-## Usage
-
-```bash
-pi --no-sandbox
+Use Pi settings to toggle sandboxing:
+
+```json
+{
+  "landstrip": {
+    "enabled": false
+  }
+}
 ```
 
-Use `/sandbox` inside Pi to show the active config.
+Project Pi settings override global Pi settings.
+The `/sandbox` UI updates the project setting when present, otherwise the global setting.
+
+## Usage
+
+Use `/sandbox` inside Pi to show the active config and toggle the Pi setting.
 
 ## License
 

package/index.ts

@@ -62,6 +62,15 @@ interface SandboxConfig {
   filesystem: SandboxFilesystemConfig;
 }
 
+interface PiLandstripSettings {
+  [key: string]: unknown;
+  landstrip?: {
+    enabled?: boolean;
+  };
+}
+
+type PiSettingsScope = 'global' | 'project';
+
 interface LandstripPolicy {
   network: {
     allowNetwork: boolean;
@@ -184,6 +193,53 @@ function loadConfig(cwd: string): SandboxConfig {
   return deepMerge(deepMerge(DEFAULT_CONFIG, globalConfig), projectConfig);
 }
 
+function getPiLandstripSettings(cwd: string): {
+  globalSettings: PiLandstripSettings;
+  projectSettings: PiLandstripSettings;
+} {
+  const settings = SettingsManager.create(cwd);
+  return {
+    globalSettings: settings.getGlobalSettings() as PiLandstripSettings,
+    projectSettings: settings.getProjectSettings() as PiLandstripSettings,
+  };
+}
+
+function isSandboxEnabledInPiSettings(cwd: string): boolean {
+  const { globalSettings, projectSettings } = getPiLandstripSettings(cwd);
+  return projectSettings.landstrip?.enabled ?? globalSettings.landstrip?.enabled ?? true;
+}
+
+function getPiSettingsWriteScope(cwd: string): PiSettingsScope {
+  const { projectSettings } = getPiLandstripSettings(cwd);
+  return projectSettings.landstrip?.enabled === undefined ? 'global' : 'project';
+}
+
+function getPiSettingsPath(cwd: string, scope: PiSettingsScope): string {
+  if (scope === 'project') return join(cwd, '.pi', 'settings.json');
+  return join(getAgentDir(), 'settings.json');
+}
+
+function readPiSettingsFile(settingsPath: string): PiLandstripSettings {
+  if (!existsSync(settingsPath)) return {};
+  return JSON.parse(readFileSync(settingsPath, 'utf-8')) as PiLandstripSettings;
+}
+
+async function setPiSettingsSandboxEnabled(
+  cwd: string,
+  enabled: boolean,
+): Promise<PiSettingsScope> {
+  const scope = getPiSettingsWriteScope(cwd);
+  const settingsPath = getPiSettingsPath(cwd, scope);
+  await withFileMutationQueue(settingsPath, async () => {
+    const settings = readPiSettingsFile(settingsPath);
+    settings.landstrip = { ...settings.landstrip, enabled };
+    mkdirSync(dirname(settingsPath), { recursive: true });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+  });
+
+  return scope;
+}
+
 function mergeArray(base: string[], override?: string[]): string[] {
   if (!override) return base;
   return [...new Set([...base, ...override])];
@@ -1430,6 +1486,34 @@ export function createLandstripIntegration(
     return true;
   }
 
+  let noSandboxFlag = false;
+  function disableSandbox(ctx: ExtensionContext): void {
+    sandboxEnabled = false;
+    sandboxReady = false;
+    setTuiStatus(ctx, 'sandbox', undefined);
+  }
+
+  function ensureSandboxState(ctx: ExtensionContext): boolean {
+    if (noSandboxFlag) {
+      disableSandbox(ctx);
+      return false;
+    }
+
+    if (!isSandboxEnabledInPiSettings(ctx.cwd)) {
+      disableSandbox(ctx);
+      return false;
+    }
+
+    const config = loadConfig(ctx.cwd);
+    if (!config.enabled) {
+      disableSandbox(ctx);
+      return false;
+    }
+
+    if (!sandboxEnabled || !sandboxReady) return enableSandbox(ctx);
+    return true;
+  }
+
   function createBashTool(cwd: string, ctx?: ExtensionContext): LandstripBashTool {
     const localBash = createPlainBashTool(cwd);
 
@@ -1438,7 +1522,7 @@ export function createLandstripIntegration(
       label: 'bash (landstrip)',
       async execute(id, params, signal, onUpdate, callCtx) {
         const effectiveCtx = callCtx ?? ctx;
-        if (!sandboxEnabled || !sandboxReady || !effectiveCtx)
+        if (!effectiveCtx || !ensureSandboxState(effectiveCtx))
           return localBash.execute(id, params, signal, onUpdate, effectiveCtx);
 
         return runBashWithOptionalRetry(id, params, signal, onUpdate, effectiveCtx);
@@ -1462,9 +1546,8 @@ export function createLandstripIntegration(
     if (shouldRegisterBashTool) pi.registerTool(createBashTool(localCwd));
 
     pi.on('user_bash', async (event, ctx) => {
-      if (!sandboxEnabled || !sandboxReady) return;
+      if (!ensureSandboxState(ctx)) return;
       const config = loadConfig(ctx.cwd);
-      if (!config.enabled) return;
 
       if (!config.network.allowNetwork) {
         const blockedDomain = await preflightCommandDomains(event.command, ctx);
@@ -1484,10 +1567,9 @@ export function createLandstripIntegration(
     });
 
     pi.on('tool_call', async (event, ctx) => {
-      if (!sandboxEnabled) return;
+      if (!ensureSandboxState(ctx)) return;
 
       const config = loadConfig(ctx.cwd);
-      if (!config.enabled) return;
 
       const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
 
@@ -1544,60 +1626,33 @@ export function createLandstripIntegration(
 
     pi.on('session_start', async (_event, ctx) => {
       resetSessionAllowances();
-      const noSandbox = maybePi.getFlag?.('no-sandbox') as boolean;
+      noSandboxFlag = Boolean(maybePi.getFlag?.('no-sandbox'));
 
-      if (noSandbox) {
-        sandboxEnabled = false;
-        sandboxReady = false;
+      if (noSandboxFlag) {
+        disableSandbox(ctx);
         notify(ctx, 'Sandbox disabled via --no-sandbox', 'warning');
         return;
       }
 
+      if (!isSandboxEnabledInPiSettings(ctx.cwd)) {
+        disableSandbox(ctx);
+        notify(ctx, 'Sandbox disabled via pi settings', 'info');
+        return;
+      }
+
       const config = loadConfig(ctx.cwd);
       if (!config.enabled) {
-        sandboxEnabled = false;
-        sandboxReady = false;
+        disableSandbox(ctx);
         notify(ctx, 'Sandbox disabled via config', 'info');
         return;
       }
 
       enableSandbox(ctx);
     });
-
-    maybePi.registerCommand?.('sandbox-enable', {
-      description: 'Enable the landstrip sandbox for this session',
-      handler: async (_args, ctx) => {
-        if (sandboxEnabled) {
-          notify(ctx, 'Sandbox is already enabled', 'info');
-          return;
-        }
-
-        if (enableSandbox(ctx)) notify(ctx, 'Sandbox enabled', 'info');
-      },
-    });
-
-    maybePi.registerCommand?.('sandbox-disable', {
-      description: 'Disable the landstrip sandbox for this session',
-      handler: async (_args, ctx) => {
-        if (!sandboxEnabled) {
-          notify(ctx, 'Sandbox is already disabled', 'info');
-          return;
-        }
-
-        sandboxEnabled = false;
-        sandboxReady = false;
-        setTuiStatus(ctx, 'sandbox', undefined);
-        notify(ctx, 'Sandbox disabled', 'info');
-      },
-    });
-
     maybePi.registerCommand?.('sandbox', {
       description: 'Show sandbox configuration',
       handler: async (_args, ctx) => {
-        if (!sandboxEnabled) {
-          notify(ctx, 'Sandbox is disabled', 'info');
-          return;
-        }
+        let piSettingsEnabled = isSandboxEnabledInPiSettings(ctx.cwd);
 
         const config = loadConfig(ctx.cwd);
         const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
@@ -1611,6 +1666,14 @@ export function createLandstripIntegration(
             const text = (s: string) => theme.fg('text', s);
             const borderFg = (s: string) => theme.fg('border', s);
 
+            function sandboxStatus(): { color: 'success' | 'warning'; label: string } {
+              if (noSandboxFlag) return { color: 'warning', label: 'Disabled (--no-sandbox)' };
+              if (!piSettingsEnabled) return { color: 'warning', label: 'Disabled (Pi setting)' };
+              if (!config.enabled) return { color: 'warning', label: 'Disabled (config)' };
+              if (!sandboxEnabled || !sandboxReady) return { color: 'warning', label: 'Inactive' };
+              return { color: 'success', label: 'Active' };
+            }
+
             function boolVal(v: boolean): string {
               return v ? theme.fg('warning', 'yes') : theme.fg('success', 'no');
             }
@@ -1623,120 +1686,108 @@ export function createLandstripIntegration(
 
             return {
               render(width: number): string[] {
-                const innerW = width - 4;
+                const innerW = Math.max(1, width - 4);
                 const border = borderFg('│');
-                const row = (c: string) => makeRow(c, innerW, border);
+                const row = (content: string) => makeRow(content, innerW, border);
                 const lines: string[] = [];
+                const status = sandboxStatus();
+                const toggleValue = piSettingsEnabled
+                  ? theme.fg('success', 'enabled')
+                  : theme.fg('warning', 'disabled');
+
+                function topBorder(titleText: string): string {
+                  const title = accent(` ${titleText} `);
+                  const fill = borderFg('─'.repeat(Math.max(0, width - 4 - visibleWidth(title))));
+                  return `${borderFg('╭─')}${title}${fill}${borderFg('─╮')}`;
+                }
 
-                // Top border
-                const title = accent(' Sandbox Configuration ');
-                const topFill = borderFg('─'.repeat(Math.max(0, width - 4 - visibleWidth(title))));
-                lines.push(`${borderFg('╭─')}${title}${topFill}${borderFg('─╮')}`);
+                function section(titleText: string, detail?: string): void {
+                  lines.push(row(''));
+                  lines.push(row(`${accent(titleText)}${detail ? dim(` · ${detail}`) : ''}`));
+                }
 
-                // Status
-                const statusDot = theme.fg('success', '●');
-                const pathSnippet = text(truncateToWidth(binaryPath(), Math.max(20, innerW - 27)));
-                lines.push(
-                  row(
-                    `  ${statusDot} ${text('Active')}  ${dim('·')}  ${muted('landstrip:')} ${pathSnippet}`,
-                  ),
-                );
+                function item(label: string, value: string): void {
+                  lines.push(row(`  ${dim('•')} ${muted(label.padEnd(13))} ${value}`));
+                }
 
-                // Config files
-                lines.push(row(`  ${dim('Config files:')}`));
-                lines.push(row(`    ${dim('project')} ${text(projectPath)}`));
-                lines.push(row(`    ${dim('global')}  ${text(globalPath)}`));
+                function listValue(values: string[], maxWidth: number): string {
+                  const value = values.join(', ') || 'none';
+                  return text(truncateToWidth(value, Math.max(10, maxWidth)));
+                }
 
-                // Network section
-                lines.push(row(''));
-                lines.push(row(`${'─'.repeat(innerW)}`));
-                const netMode = config.network.allowNetwork ? ' (unrestricted)' : ' (proxied)';
-                lines.push(row(`  ${accent('Network')}${dim(netMode)}`));
-                lines.push(
-                  row(
-                    `  ${dim('•')} ${muted('Allow network:')} ${boolVal(config.network.allowNetwork)}`,
-                  ),
-                );
-                const domainsStr = config.network.allowedDomains.join(', ') || '(none)';
-                lines.push(
-                  row(
-                    `  ${dim('•')} ${muted('Allowed:')} ${text(truncateToWidth(domainsStr, Math.max(10, innerW - 15)))}`,
-                  ),
-                );
-                const denyStr = config.network.deniedDomains.join(', ') || '(none)';
+                lines.push(topBorder('Sandbox'));
+
+                const statusDot = theme.fg(status.color, '●');
+                const pathSnippet = text(truncateToWidth(binaryPath(), Math.max(20, innerW - 28)));
                 lines.push(
                   row(
-                    `  ${dim('•')} ${muted('Denied:')} ${text(truncateToWidth(denyStr, Math.max(10, innerW - 14)))}`,
+                    `${statusDot} ${text(status.label)} ${dim('·')} Pi setting ${toggleValue} ${dim('·')} ${muted('landstrip')} ${pathSnippet}`,
                   ),
                 );
-                if (sessionAllowedDomains.length > 0) {
-                  lines.push(
-                    row(
-                      `  ${dim('•')} ${muted('Session:')} ${theme.fg('accent', sessionAllowedDomains.join(', '))}`,
-                    ),
-                  );
+
+                section('Config');
+                item('project', text(projectPath));
+                item('global', text(globalPath));
+
+                const netMode = config.network.allowNetwork ? 'unrestricted' : 'proxied';
+                section('Network', netMode);
+                item('allow network', boolVal(config.network.allowNetwork));
+                item('allowed', listValue(config.network.allowedDomains, innerW - 17));
+                item('denied', listValue(config.network.deniedDomains, innerW - 17));
+                if (sessionAllowedDomains.length > 0)
+                  item('session', theme.fg('accent', sessionAllowedDomains.join(', ')));
+
+                section('Filesystem');
+                item('deny read', listValue(config.filesystem.denyRead, innerW - 17));
+                item('allow read', listValue(config.filesystem.allowRead, innerW - 17));
+                item('allow write', listValue(config.filesystem.allowWrite, innerW - 17));
+                item('deny write', listValue(config.filesystem.denyWrite, innerW - 17));
+
+                if (sessionAllowedReadPaths.length > 0 || sessionAllowedWritePaths.length > 0) {
+                  section('Session grants');
+                  if (sessionAllowedReadPaths.length > 0)
+                    item('read', theme.fg('accent', sessionAllowedReadPaths.join(', ')));
+                  if (sessionAllowedWritePaths.length > 0)
+                    item('write', theme.fg('accent', sessionAllowedWritePaths.join(', ')));
                 }
 
-                // Filesystem section
                 lines.push(row(''));
-                lines.push(row(`${'─'.repeat(innerW)}`));
-                lines.push(row(`  ${accent('Filesystem')}`));
-                const denyReadStr = config.filesystem.denyRead.join(', ') || '(none)';
                 lines.push(
-                  row(
-                    `  ${dim('•')} ${muted('Deny read:')} ${text(truncateToWidth(denyReadStr, Math.max(10, innerW - 16)))}`,
-                  ),
-                );
-                const allowReadStr = config.filesystem.allowRead.join(', ') || '(none)';
-                lines.push(
-                  row(
-                    `  ${dim('•')} ${muted('Allow read:')} ${text(truncateToWidth(allowReadStr, Math.max(10, innerW - 17)))}`,
-                  ),
+                  row(`${dim('t')} ${muted('toggle Pi setting')}  ${dim('esc')} ${muted('close')}`),
                 );
-                const allowWriteStr = config.filesystem.allowWrite.join(', ') || '(none)';
                 lines.push(
-                  row(
-                    `  ${dim('•')} ${muted('Allow write:')} ${text(truncateToWidth(allowWriteStr, Math.max(10, innerW - 18)))}`,
-                  ),
-                );
-                const denyWriteStr = config.filesystem.denyWrite.join(', ') || '(none)';
-                lines.push(
-                  row(
-                    `  ${dim('•')} ${muted('Deny write:')} ${text(truncateToWidth(denyWriteStr, Math.max(10, innerW - 17)))}`,
-                  ),
+                  `${borderFg('╰')}${borderFg('─'.repeat(Math.max(0, width - 2)))}${borderFg('╯')}`,
                 );
 
-                // Session allowances
-                if (sessionAllowedReadPaths.length > 0 || sessionAllowedWritePaths.length > 0) {
-                  lines.push(row(''));
-                  if (sessionAllowedReadPaths.length > 0) {
-                    lines.push(
-                      row(
-                        `  ${dim('•')} ${muted('Session read:')} ${theme.fg('accent', sessionAllowedReadPaths.join(', '))}`,
-                      ),
-                    );
-                  }
-                  if (sessionAllowedWritePaths.length > 0) {
-                    lines.push(
-                      row(
-                        `  ${dim('•')} ${muted('Session write:')} ${theme.fg('accent', sessionAllowedWritePaths.join(', '))}`,
-                      ),
-                    );
-                  }
-                }
-
-                // Footer
-                lines.push(row(''));
-                lines.push(row(`  ${dim('esc')} ${muted('or any key to close')}`));
-
-                // Bottom border
-                lines.push(`${borderFg('╰')}${borderFg('─'.repeat(width - 2))}${borderFg('╯')}`);
-
                 return lines;
               },
 
-              handleInput(): void {
-                done(undefined);
+              handleInput(data: string): void {
+                if (data !== 't' && data !== 'T') {
+                  done(undefined);
+                  return;
+                }
+
+                void (async () => {
+                  const enabled = !piSettingsEnabled;
+                  const scope = await setPiSettingsSandboxEnabled(ctx.cwd, enabled);
+                  piSettingsEnabled = isSandboxEnabledInPiSettings(ctx.cwd);
+
+                  if (!enabled) {
+                    disableSandbox(ctx);
+                    notify(ctx, `Sandbox disabled via ${scope} Pi settings`, 'info');
+                  } else if (noSandboxFlag) {
+                    notify(ctx, 'Sandbox remains disabled via --no-sandbox', 'warning');
+                  } else if (!config.enabled) {
+                    notify(ctx, 'Sandbox remains disabled via config', 'info');
+                  } else if (enableSandbox(ctx)) {
+                    notify(ctx, `Sandbox enabled via ${scope} Pi settings`, 'info');
+                  }
+
+                  tui.requestRender();
+                })().catch((error: unknown) => {
+                  notify(ctx, `Could not update Pi settings: ${error}`, 'error');
+                });
               },
 
               invalidate(): void {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.11.7",
+  "version": "0.11.9",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",