pi-landstrip 0.14.2 → 0.15.1

package/index.ts

@@ -24,7 +24,13 @@ import {
   rmSync,
   writeFileSync,
 } from 'node:fs';
-import { type AddressInfo, connect as connectNet, createServer, type Socket } from 'node:net';
+import {
+  type AddressInfo,
+  connect as connectNet,
+  createServer,
+  type Socket,
+  Socket as NetSocket,
+} from 'node:net';
 import { homedir, tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { URL } from 'node:url';
@@ -39,6 +45,7 @@ import {
   withFileMutationQueue,
 } from '@earendil-works/pi-coding-agent';
 import { Key, matchesKey, truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
+import { randomBytes } from 'node:crypto';
 
 interface SandboxFilesystemConfig {
   denyRead: string[];
@@ -90,7 +97,7 @@ interface LandstripBashCallbacks {
   onErrorFd?: (data: Buffer) => void;
 }
 
-const LANDSTRIP_VERSION = [0, 14, 5] as const;
+const LANDSTRIP_VERSION = [0, 15, 4] as const;
 const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 
@@ -464,53 +471,56 @@ function extractBlockedReadPath(output: string, cwd: string): string | null {
   return extractNativeDeniedPath(output, cwd);
 }
 
-// Returns the first `length` elements of a string tuple, or null if `value` is
-// not an array of at least that many strings.
-function stringTuple(value: unknown, length: number): string[] | null {
-  if (!Array.isArray(value) || value.length < length) return null;
-  const head = value.slice(0, length);
-  return head.every((item) => typeof item === 'string') ? (head as string[]) : null;
+function asString(value: unknown): string | null {
+  return typeof value === 'string' ? value : null;
 }
 
-// landstrip emits each trap as a serde externally-tagged enum: a single-key
-// object whose key is the variant name (`Filesystem`, `Network`, `Launch`,
-// `Usage`, `Internal`) and whose value is the variant payload.
+// landstrip emits each trap as a flat JSON record tagged by a `kind`
+// discriminant (`filesystem`, `network`, `launch`, `usage`, `internal`)
+// alongside a stable `code` and variant-specific fields.
 function parseLandstripTrap(obj: Record<string, unknown>): LandstripTrap | null {
-  const fs = stringTuple(obj.Filesystem, 3);
-  if (fs) {
-    const [operation, file, mechanism] = fs;
-    if (operation === 'read' || operation === 'write') {
-      return { kind: 'filesystem', operation, file, mechanism };
+  switch (obj.kind) {
+    case 'filesystem': {
+      const operation = obj.operation;
+      const file = asString(obj.path);
+      if ((operation === 'read' || operation === 'write') && file !== null) {
+        return { kind: 'filesystem', operation, file, mechanism: asString(obj.mechanism) ?? '' };
+      }
+      return null;
     }
-    return null;
-  }
-
-  const net = stringTuple(obj.Network, 3);
-  if (net) {
-    const [operation, target, mechanism] = net;
-    return { kind: 'network', operation, target, mechanism };
-  }
-
-  const launch = stringTuple(obj.Launch, 2);
-  if (launch) {
-    const [program, source] = launch;
-    return { kind: 'launch', program, source };
-  }
-
-  if (typeof obj.Usage === 'string') {
-    return { kind: 'usage', message: obj.Usage };
-  }
-
-  const internal = obj.Internal;
-  if (typeof internal === 'object' && internal !== null && !Array.isArray(internal)) {
-    const detail: Record<string, string> = {};
-    for (const [key, value] of Object.entries(internal)) {
-      if (typeof value === 'string') detail[key] = value;
+    case 'network': {
+      const operation = asString(obj.operation);
+      const target = asString(obj.target);
+      if (operation !== null && target !== null) {
+        return { kind: 'network', operation, target, mechanism: asString(obj.mechanism) ?? '' };
+      }
+      return null;
+    }
+    case 'launch': {
+      const program = asString(obj.program);
+      const source = asString(obj.message);
+      if (program !== null && source !== null) {
+        return { kind: 'launch', program, source };
+      }
+      return null;
     }
-    return { kind: 'internal', detail };
+    case 'usage': {
+      const message = asString(obj.message);
+      return message !== null ? { kind: 'usage', message } : null;
+    }
+    case 'internal': {
+      const detail: Record<string, string> = {};
+      const raw = obj.detail;
+      if (typeof raw === 'object' && raw !== null && !Array.isArray(raw)) {
+        for (const [key, value] of Object.entries(raw)) {
+          if (typeof value === 'string') detail[key] = value;
+        }
+      }
+      return { kind: 'internal', detail };
+    }
+    default:
+      return null;
   }
-
-  return null;
 }
 
 function parseLandstripTraps(output: string): LandstripTrap[] {
@@ -1121,6 +1131,29 @@ export function createLandstripIntegration(
     });
   }
 
+  function createSocketPair(): Promise<[NetSocket, NetSocket]> {
+    return new Promise((resolve, reject) => {
+      const sockPath = join(tmpdir(), `.landstrip-sock-${randomBytes(8).toString('hex')}`);
+      const server = createServer();
+      server.on('error', reject);
+      let client: NetSocket | null = null;
+      server.on('connection', (serverEnd) => {
+        server.close();
+        try {
+          rmSync(sockPath, { force: true });
+        } catch {
+          /* ok */
+        }
+        if (client) resolve([client, serverEnd]);
+      });
+      server.listen(sockPath, () => {
+        client = new NetSocket();
+        client.on('error', reject);
+        client.connect(sockPath);
+      });
+    });
+  }
+
   function createLandstripBashOps(
     ctx: ExtensionContext,
     callbacks: LandstripBashCallbacks = {},
@@ -1137,119 +1170,166 @@ export function createLandstripIntegration(
         const landstripArgs = ['--trap-fd', '3', '-p', policy.path, shell, ...args, command];
 
         return new Promise((resolvePromise, reject) => {
-          let timeoutHandle: NodeJS.Timeout | undefined;
-          let timedOut = false;
-          let cleaned = false;
-
-          const cleanup = () => {
-            if (cleaned) return;
-            cleaned = true;
-            if (timeoutHandle) clearTimeout(timeoutHandle);
-            signal?.removeEventListener('abort', onAbort);
-            void proxy?.stop();
-            rmSync(policy.dir, { recursive: true, force: true });
-          };
+          (async () => {
+            let timeoutHandle: NodeJS.Timeout | undefined;
+            let timedOut = false;
+            let cleaned = false;
+
+            // Create socketpair for bidirectional query-response on fd 3.
+            const [trapSocket, childEnd] = await createSocketPair();
+
+            const cleanup = () => {
+              if (cleaned) return;
+              cleaned = true;
+              if (timeoutHandle) clearTimeout(timeoutHandle);
+              signal?.removeEventListener('abort', onAbort);
+              void proxy?.stop();
+              trapSocket.destroy();
+              rmSync(policy.dir, { recursive: true, force: true });
+            };
 
-          const child = spawn(binaryPath(), landstripArgs, {
-            cwd,
-            env: allowNetwork ? { ...process.env, ...env } : proxyEnv(env, proxy!.port),
-            detached: true,
-            stdio: ['ignore', 'pipe', 'pipe', 'pipe'],
-          });
-
-          function killChild(): void {
-            if (!child.pid) return;
-            try {
-              process.kill(-child.pid, 'SIGKILL');
-            } catch {
-              child.kill('SIGKILL');
+            const child = spawn(binaryPath(), landstripArgs, {
+              cwd,
+              env: allowNetwork ? { ...process.env, ...env } : proxyEnv(env, proxy!.port),
+              detached: true,
+              stdio: ['ignore', 'pipe', 'pipe', childEnd],
+            });
+
+            // Child has dup'd its end; parent can close its copy.
+            childEnd.destroy();
+
+            function killChild(): void {
+              if (!child.pid) return;
+              try {
+                process.kill(-child.pid, 'SIGKILL');
+              } catch {
+                child.kill('SIGKILL');
+              }
             }
-          }
 
-          function onAbort(): void {
-            killChild();
-          }
-
-          if (timeout !== undefined && timeout > 0) {
-            timeoutHandle = setTimeout(() => {
-              timedOut = true;
+            function onAbort(): void {
               killChild();
-            }, timeout * 1000);
-          }
+            }
 
-          signal?.addEventListener('abort', onAbort, { once: true });
-          let stderrAcc = '';
-          let errorFdAcc = '';
-
-          child.stdout?.on('data', onData);
-          child.stderr?.on('data', (data: Buffer) => {
-            stderrAcc += data.toString('utf8');
-            callbacks.onStderr?.(data);
-            onData(data);
-          });
-          child.stdio[3]?.on('data', (data: Buffer) => {
-            errorFdAcc += data.toString('utf8');
-            callbacks.onErrorFd?.(data);
-          });
-
-          child.on('error', (error) => {
-            cleanup();
-            reject(error);
-          });
-
-          child.on('close', async (code) => {
-            cleanup();
-            if (signal?.aborted) {
-              reject(new Error('aborted'));
-              return;
+            if (timeout !== undefined && timeout > 0) {
+              timeoutHandle = setTimeout(() => {
+                timedOut = true;
+                killChild();
+              }, timeout * 1000);
             }
-            if (timedOut) {
-              reject(new Error(`timeout:${timeout}`));
-              return;
+
+            signal?.addEventListener('abort', onAbort, { once: true });
+            const resolvedQueryIds = new Set<number>();
+            let stderrAcc = '';
+            let errorFdAcc = '';
+
+            child.stdout?.on('data', onData);
+            child.stderr?.on('data', (data: Buffer) => {
+              stderrAcc += data.toString('utf8');
+              callbacks.onStderr?.(data);
+              onData(data);
+            });
+            trapSocket.on('data', (data: Buffer) => {
+              errorFdAcc += data.toString('utf8');
+              callbacks.onErrorFd?.(data);
+              // Process query traps in real-time.
+              if (ctx.hasUI) {
+                const traps = parseLandstripTraps(errorFdAcc);
+                for (const trap of traps) {
+                  if (
+                    trap.kind === 'filesystem' &&
+                    trap.operation === 'write' &&
+                    'state' in trap &&
+                    (trap as any).state === 'query' &&
+                    'query_id' in trap
+                  ) {
+                    const queryId = (trap as any).query_id as number;
+                    if (!resolvedQueryIds.has(queryId)) {
+                      resolvedQueryIds.add(queryId);
+                      handleWriteQuery(trapSocket, queryId, trap.file, cwd, ctx).catch(() => {});
+                    }
+                  }
+                }
+              }
+            });
+
+            async function handleWriteQuery(
+              socket: NetSocket,
+              queryId: number,
+              file: string,
+              cwd: string,
+              ctx: ExtensionContext,
+            ): Promise<void> {
+              const choice = await promptWriteBlock(ctx, file);
+              if (choice !== 'abort') {
+                await applyWriteChoice(choice, file, cwd);
+              }
+              const action = choice === 'abort' ? 'deny' : 'allow';
+              const response = JSON.stringify({ query_id: queryId, action }) + '\n';
+              if (!socket.destroyed) {
+                socket.write(response);
+              }
             }
 
-            const errorOutput = errorFdAcc || stderrAcc;
-
-            const blockedPath =
-              extractBlockedPath(errorOutput, cwd) ??
-              (errorFdAcc ? extractBlockedPath(stderrAcc, cwd) : null);
-            const blockedWritePath =
-              extractBlockedWritePath(errorOutput, cwd) ??
-              (errorFdAcc ? extractBlockedWritePath(stderrAcc, cwd) : null);
-            if (blockedPath && ctx.hasUI) {
-              const config = loadConfig(cwd);
-              const isDeniedByDenyRead = matchesPattern(blockedPath, config.filesystem.denyRead);
-              const isReadAllowed = matchesPattern(blockedPath, getEffectiveAllowRead(cwd));
-              const isWriteAllowed = !shouldPromptForWrite(
-                blockedPath,
-                getEffectiveAllowWrite(cwd),
-                matchesPattern,
-              );
-
-              if (blockedWritePath === blockedPath && !isWriteAllowed) {
-                const choice = await promptWriteBlock(ctx, blockedPath);
-                if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
-              } else if (isDeniedByDenyRead || !isReadAllowed) {
-                const choice = await promptReadBlock(
-                  ctx,
+            child.on('error', (error) => {
+              cleanup();
+              reject(error);
+            });
+
+            child.on('close', async (code) => {
+              cleanup();
+              if (signal?.aborted) {
+                reject(new Error('aborted'));
+                return;
+              }
+              if (timedOut) {
+                reject(new Error(`timeout:${timeout}`));
+                return;
+              }
+
+              const errorOutput = errorFdAcc || stderrAcc;
+
+              const blockedPath =
+                extractBlockedPath(errorOutput, cwd) ??
+                (errorFdAcc ? extractBlockedPath(stderrAcc, cwd) : null);
+              const blockedWritePath =
+                extractBlockedWritePath(errorOutput, cwd) ??
+                (errorFdAcc ? extractBlockedWritePath(stderrAcc, cwd) : null);
+              if (blockedPath && ctx.hasUI) {
+                const config = loadConfig(cwd);
+                const isDeniedByDenyRead = matchesPattern(blockedPath, config.filesystem.denyRead);
+                const isReadAllowed = matchesPattern(blockedPath, getEffectiveAllowRead(cwd));
+                const isWriteAllowed = !shouldPromptForWrite(
                   blockedPath,
-                  isDeniedByDenyRead ? 'denyRead overrides allowRead' : undefined,
+                  getEffectiveAllowWrite(cwd),
+                  matchesPattern,
                 );
-                if (choice !== 'abort') await applyReadChoice(choice, blockedPath, cwd);
-              } else if (!isWriteAllowed) {
-                const choice = await promptWriteBlock(ctx, blockedPath);
-                if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
-              }
-            } else if (!blockedPath && ctx.hasUI) {
-              const landstripErrors = parseLandstripTraps(errorOutput);
-              if (landstripErrors.length > 0) {
-                const formatted = formatLandstripTraps(landstripErrors);
-                notify(ctx, `Sandbox blocked an operation: ${formatted}`, 'warning');
+
+                if (blockedWritePath === blockedPath && !isWriteAllowed) {
+                  const choice = await promptWriteBlock(ctx, blockedPath);
+                  if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
+                } else if (isDeniedByDenyRead || !isReadAllowed) {
+                  const choice = await promptReadBlock(
+                    ctx,
+                    blockedPath,
+                    isDeniedByDenyRead ? 'granting allowRead will override it' : undefined,
+                  );
+                  if (choice !== 'abort') await applyReadChoice(choice, blockedPath, cwd);
+                } else if (!isWriteAllowed) {
+                  const choice = await promptWriteBlock(ctx, blockedPath);
+                  if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
+                }
+              } else if (!blockedPath && ctx.hasUI) {
+                const landstripErrors = parseLandstripTraps(errorOutput);
+                if (landstripErrors.length > 0) {
+                  const formatted = formatLandstripTraps(landstripErrors);
+                  notify(ctx, `Sandbox blocked an operation: ${formatted}`, 'warning');
+                }
               }
-            }
 
-            resolvePromise({ exitCode: code });
-          });
+              resolvePromise({ exitCode: code });
+            });
+          })().catch(reject);
         });
       },
     };
@@ -1331,7 +1411,7 @@ export function createLandstripIntegration(
           ctx,
           blockedPath,
           matchesPattern(blockedPath, config.filesystem.denyRead)
-            ? 'denyRead overrides allowRead'
+            ? 'granting allowRead will override it'
             : undefined,
         );
         if (choice === 'abort') return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.14.2",
+  "version": "0.15.1",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-tui": "^0.78.0",
-    "@landstrip/landstrip": "^0.14.5"
+    "@landstrip/landstrip": "^0.15.4"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.78.0",