pi-landstrip 0.14.1 → 0.15.0

package/index.ts

@@ -454,53 +454,66 @@ function extractBlockedWritePath(output: string, cwd: string): string | null {
   return extractNativeWriteDeniedPath(output, cwd);
 }
 
-// Returns the first `length` elements of a string tuple, or null if `value` is
-// not an array of at least that many strings.
-function stringTuple(value: unknown, length: number): string[] | null {
-  if (!Array.isArray(value) || value.length < length) return null;
-  const head = value.slice(0, length);
-  return head.every((item) => typeof item === 'string') ? (head as string[]) : null;
-}
-
-// landstrip emits each trap as a serde externally-tagged enum: a single-key
-// object whose key is the variant name (`Filesystem`, `Network`, `Launch`,
-// `Usage`, `Internal`) and whose value is the variant payload.
-function parseLandstripTrap(obj: Record<string, unknown>): LandstripTrap | null {
-  const fs = stringTuple(obj.Filesystem, 3);
-  if (fs) {
-    const [operation, file, mechanism] = fs;
-    if (operation === 'read' || operation === 'write') {
-      return { kind: 'filesystem', operation, file, mechanism };
+function extractBlockedReadPath(output: string, cwd: string): string | null {
+  for (const error of parseLandstripTraps(output).filter(isFilesystemTrap)) {
+    if (error.operation === 'read') {
+      return normalizeBlockedPath(error.file, cwd);
     }
-    return null;
   }
 
-  const net = stringTuple(obj.Network, 3);
-  if (net) {
-    const [operation, target, mechanism] = net;
-    return { kind: 'network', operation, target, mechanism };
-  }
-
-  const launch = stringTuple(obj.Launch, 2);
-  if (launch) {
-    const [program, source] = launch;
-    return { kind: 'launch', program, source };
-  }
+  return extractNativeDeniedPath(output, cwd);
+}
 
-  if (typeof obj.Usage === 'string') {
-    return { kind: 'usage', message: obj.Usage };
-  }
+function asString(value: unknown): string | null {
+  return typeof value === 'string' ? value : null;
+}
 
-  const internal = obj.Internal;
-  if (typeof internal === 'object' && internal !== null && !Array.isArray(internal)) {
-    const detail: Record<string, string> = {};
-    for (const [key, value] of Object.entries(internal)) {
-      if (typeof value === 'string') detail[key] = value;
+// landstrip emits each trap as a flat JSON record tagged by a `kind`
+// discriminant (`filesystem`, `network`, `launch`, `usage`, `internal`)
+// alongside a stable `code` and variant-specific fields.
+function parseLandstripTrap(obj: Record<string, unknown>): LandstripTrap | null {
+  switch (obj.kind) {
+    case 'filesystem': {
+      const operation = obj.operation;
+      const file = asString(obj.path);
+      if ((operation === 'read' || operation === 'write') && file !== null) {
+        return { kind: 'filesystem', operation, file, mechanism: asString(obj.mechanism) ?? '' };
+      }
+      return null;
+    }
+    case 'network': {
+      const operation = asString(obj.operation);
+      const target = asString(obj.target);
+      if (operation !== null && target !== null) {
+        return { kind: 'network', operation, target, mechanism: asString(obj.mechanism) ?? '' };
+      }
+      return null;
+    }
+    case 'launch': {
+      const program = asString(obj.program);
+      const source = asString(obj.message);
+      if (program !== null && source !== null) {
+        return { kind: 'launch', program, source };
+      }
+      return null;
     }
-    return { kind: 'internal', detail };
+    case 'usage': {
+      const message = asString(obj.message);
+      return message !== null ? { kind: 'usage', message } : null;
+    }
+    case 'internal': {
+      const detail: Record<string, string> = {};
+      const raw = obj.detail;
+      if (typeof raw === 'object' && raw !== null && !Array.isArray(raw)) {
+        for (const [key, value] of Object.entries(raw)) {
+          if (typeof value === 'string') detail[key] = value;
+        }
+      }
+      return { kind: 'internal', detail };
+    }
+    default:
+      return null;
   }
-
-  return null;
 }
 
 function parseLandstripTraps(output: string): LandstripTrap[] {
@@ -1223,7 +1236,7 @@ export function createLandstripIntegration(
                 const choice = await promptReadBlock(
                   ctx,
                   blockedPath,
-                  isDeniedByDenyRead ? 'denyRead overrides allowRead' : undefined,
+                  isDeniedByDenyRead ? 'granting allowRead will override it' : undefined,
                 );
                 if (choice !== 'abort') await applyReadChoice(choice, blockedPath, cwd);
               } else if (!isWriteAllowed) {
@@ -1310,17 +1323,54 @@ export function createLandstripIntegration(
       return run();
     };
 
+    const retryWithReadAccess = async (
+      blockedPath: string,
+    ): Promise<AgentToolResult<BashToolDetails | undefined> | null> => {
+      if (!ctx.hasUI) return null;
+
+      if (!matchesPattern(blockedPath, getEffectiveAllowRead(ctx.cwd))) {
+        const config = loadConfig(ctx.cwd);
+        const choice = await promptReadBlock(
+          ctx,
+          blockedPath,
+          matchesPattern(blockedPath, config.filesystem.denyRead)
+            ? 'granting allowRead will override it'
+            : undefined,
+        );
+        if (choice === 'abort') return null;
+        await applyReadChoice(choice, blockedPath, ctx.cwd);
+      }
+
+      onUpdate?.({
+        content: [
+          { type: 'text', text: `\n--- Read access granted for "${blockedPath}", retrying ---\n` },
+        ],
+        details: {},
+      });
+      landstripErrorOutput = '';
+      stderrOutput = '';
+      return run();
+    };
+
     let result: AgentToolResult<BashToolDetails | undefined>;
     try {
       result = await run();
     } catch (error) {
       const errorText = error instanceof Error ? error.message : String(error);
       const fallbackOutput = `${stderrOutput}\n${errorText}`;
-      const blockedPath =
+      const blockedWritePath =
         extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
         extractBlockedWritePath(fallbackOutput, ctx.cwd);
-      if (blockedPath) {
-        const retryResult = await retryWithWriteAccess(blockedPath);
+      if (blockedWritePath) {
+        const retryResult = await retryWithWriteAccess(blockedWritePath);
+        if (retryResult) return retryResult;
+      }
+
+      const blockedReadPath =
+        extractBlockedReadPath(landstripErrorOutput, ctx.cwd) ??
+        extractBlockedReadPath(fallbackOutput, ctx.cwd);
+      if (blockedReadPath) {
+        const retryResult = await retryWithReadAccess(blockedReadPath);
         if (retryResult) return retryResult;
       }
 
@@ -1335,12 +1385,20 @@ export function createLandstripIntegration(
       const message = formatLandstripTraps(landstripErrors);
       result.content.unshift({ type: 'text', text: `\n${message}\n` });
     }
-    const blockedPath =
+    const blockedWritePath =
       extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
       extractBlockedWritePath(stderrOutput, ctx.cwd);
-    if (!blockedPath) return result;
+    if (blockedWritePath) {
+      const retryResult = await retryWithWriteAccess(blockedWritePath);
+      if (retryResult) return retryResult;
+    }
+
+    const blockedReadPath =
+      extractBlockedReadPath(landstripErrorOutput, ctx.cwd) ??
+      extractBlockedReadPath(stderrOutput, ctx.cwd);
+    if (!blockedReadPath) return result;
 
-    const retryResult = await retryWithWriteAccess(blockedPath);
+    const retryResult = await retryWithReadAccess(blockedReadPath);
     return retryResult ?? result;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-tui": "^0.78.0",
-    "@landstrip/landstrip": "^0.14.5"
+    "@landstrip/landstrip": "^0.15.1"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.78.0",