pi-landstrip 0.16.14 → 0.16.16

package/index.ts

@@ -105,8 +105,6 @@ interface LandstripBashCallbacks {
   promptOnBlock?: boolean;
 }
 
-const LANDSTRIP_VERSION = [0, 16, 4] as const;
-const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 
 const packageDir = dirname(fileURLToPath(import.meta.url));
@@ -316,16 +314,21 @@ function allowsAllDomains(allowedDomains: string[]): boolean {
   return allowedDomains.includes('*');
 }
 
-function shouldPromptForWrite(path: string, allowWrite: string[]): boolean {
-  return allowWrite.length === 0 || !matchesPattern(path, allowWrite);
+export function shouldPromptForWrite(path: string, allowWrite: string[], cwd: string): boolean {
+  return allowWrite.length === 0 || !matchesPattern(path, allowWrite, cwd);
 }
 
-function expandPath(filePath: string): string {
-  return resolve(filePath.replace(/^~(?=$|\/)/, homedir()));
+// Relative entries (notably ".") resolve against `cwd` — the command's working
+// directory that landstrip itself uses as its policy base — not the extension
+// process's own cwd. Resolving against process.cwd() would let the broker's
+// allow/deny decision diverge from landstrip's whenever the agent operates
+// outside the directory pi was launched from.
+function expandPath(filePath: string, cwd: string): string {
+  return resolve(cwd, filePath.replace(/^~(?=$|\/)/, homedir()));
 }
 
-function canonicalizePath(filePath: string): string {
-  const abs = expandPath(filePath);
+function canonicalizePath(filePath: string, cwd: string): string {
+  const abs = expandPath(filePath, cwd);
 
   try {
     return realpathSync.native(abs);
@@ -348,11 +351,13 @@ function canonicalizePath(filePath: string): string {
   }
 }
 
-function matchesPattern(filePath: string, patterns: string[]): boolean {
-  const abs = canonicalizePath(filePath);
+export function matchesPattern(filePath: string, patterns: string[], cwd: string): boolean {
+  const abs = canonicalizePath(filePath, cwd);
 
   return patterns.some((pattern) => {
-    const absPattern = pattern.includes('*') ? expandPath(pattern) : canonicalizePath(pattern);
+    const absPattern = pattern.includes('*')
+      ? expandPath(pattern, cwd)
+      : canonicalizePath(pattern, cwd);
 
     if (pattern.includes('*')) {
       const escaped = absPattern
@@ -367,7 +372,7 @@ function matchesPattern(filePath: string, patterns: string[]): boolean {
 }
 
 function normalizeBlockedPath(path: string, cwd: string): string {
-  return canonicalizePath(isAbsolute(path) ? path : join(cwd, path));
+  return canonicalizePath(isAbsolute(path) ? path : join(cwd, path), cwd);
 }
 
 function isPathLike(value: string): boolean {
@@ -767,28 +772,14 @@ function promptWriteBlock(ctx: ExtensionContext, filePath: string): Promise<Perm
   );
 }
 
-function landstripVersion(): string | null {
-  const result = spawnSync(binaryPath(), ['--version'], { encoding: 'utf-8' });
-  if (result.status !== 0) return null;
-  return result.stdout.trim();
-}
-
-function parseVersion(version: string): [number, number, number] | null {
-  const match = version.match(/\b(\d+)\.(\d+)\.(\d+)\b/);
-  if (!match) return null;
-  return [Number(match[1]), Number(match[2]), Number(match[3])];
-}
-
-function hasMinimumVersion(version: string, minimum: readonly [number, number, number]): boolean {
-  const parsed = parseVersion(version);
-  if (!parsed) return false;
-
-  for (let i = 0; i < minimum.length; i++) {
-    if (parsed[i] > minimum[i]) return true;
-    if (parsed[i] < minimum[i]) return false;
+// The binary is bundled and version-locked to @landstrip/landstrip via npm, so
+// compatibility is settled at install time; only confirm it is runnable here.
+function landstripAvailable(): boolean {
+  try {
+    return spawnSync(binaryPath(), ['--version']).status === 0;
+  } catch {
+    return false;
   }
-
-  return true;
 }
 
 function proxyEnv(env: NodeJS.ProcessEnv | undefined, port: number): NodeJS.ProcessEnv {
@@ -1264,10 +1255,10 @@ export function createLandstripIntegration(
               const config = loadConfig(cwd);
               const isAllowed = (cfg: SandboxConfig): boolean =>
                 operation === 'read'
-                  ? !matchesPattern(path, cfg.filesystem.denyRead) &&
-                    matchesPattern(path, getEffectiveAllowRead(cfg))
-                  : !matchesPattern(path, cfg.filesystem.denyWrite) &&
-                    !shouldPromptForWrite(path, getEffectiveAllowWrite(cfg));
+                  ? !matchesPattern(path, cfg.filesystem.denyRead, cwd) &&
+                    matchesPattern(path, getEffectiveAllowRead(cfg), cwd)
+                  : !matchesPattern(path, cfg.filesystem.denyWrite, cwd) &&
+                    !shouldPromptForWrite(path, getEffectiveAllowWrite(cfg), cwd);
 
               if (isAllowed(config)) {
                 respondQuery(queryId, 'allow');
@@ -1280,7 +1271,7 @@ export function createLandstripIntegration(
                 return;
               }
               // denyWrite is a hard block: never prompt to override it.
-              if (operation === 'write' && matchesPattern(path, config.filesystem.denyWrite)) {
+              if (operation === 'write' && matchesPattern(path, config.filesystem.denyWrite, cwd)) {
                 respondQuery(queryId, 'deny');
                 return;
               }
@@ -1298,7 +1289,7 @@ export function createLandstripIntegration(
                       ? await promptReadBlock(
                           ctx,
                           path,
-                          matchesPattern(path, cfg.filesystem.denyRead)
+                          matchesPattern(path, cfg.filesystem.denyRead, cwd)
                             ? 'granting allowRead will override it'
                             : undefined,
                         )
@@ -1416,7 +1407,7 @@ export function createLandstripIntegration(
 
       let config = loadConfig(ctx.cwd);
       const { globalPath, projectPath } = getConfigPaths(ctx.cwd);
-      if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
+      if (matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd)) {
         notify(
           ctx,
           `"${blockedPath}" is blocked by denyWrite. Check:\n  ${projectPath}\n  ${globalPath}`,
@@ -1425,14 +1416,14 @@ export function createLandstripIntegration(
         return null;
       }
 
-      if (shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config))) {
+      if (shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config), ctx.cwd)) {
         const choice = await promptWriteBlock(ctx, blockedPath);
         if (choice === 'abort') return null;
         await applyWriteChoice(choice, blockedPath, ctx.cwd);
       }
 
       config = loadConfig(ctx.cwd);
-      if (matchesPattern(blockedPath, config.filesystem.denyWrite)) {
+      if (matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd)) {
         notify(
           ctx,
           `"${blockedPath}" was added to allowWrite, but denyWrite still blocks it. Check:\n  ${projectPath}\n  ${globalPath}`,
@@ -1458,11 +1449,11 @@ export function createLandstripIntegration(
       if (!ctx.hasUI) return null;
 
       const config = loadConfig(ctx.cwd);
-      if (!matchesPattern(blockedPath, getEffectiveAllowRead(config))) {
+      if (!matchesPattern(blockedPath, getEffectiveAllowRead(config), ctx.cwd)) {
         const choice = await promptReadBlock(
           ctx,
           blockedPath,
-          matchesPattern(blockedPath, config.filesystem.denyRead)
+          matchesPattern(blockedPath, config.filesystem.denyRead, ctx.cwd)
             ? 'granting allowRead will override it'
             : undefined,
         );
@@ -1591,8 +1582,7 @@ export function createLandstripIntegration(
       return false;
     }
 
-    const version = landstripVersion();
-    if (!version) {
+    if (!landstripAvailable()) {
       sandboxEnabled = false;
       sandboxReady = false;
       notify(
@@ -1603,17 +1593,6 @@ export function createLandstripIntegration(
       return false;
     }
 
-    if (!hasMinimumVersion(version, LANDSTRIP_VERSION)) {
-      sandboxEnabled = false;
-      sandboxReady = false;
-      notify(
-        ctx,
-        `landstrip ${REQUIRED_LANDSTRIP_VERSION} or newer is required; found: ${version}`,
-        'error',
-      );
-      return false;
-    }
-
     sandboxEnabled = true;
     sandboxReady = true;
     warnIfAllDomainsAllowed(ctx, config);
@@ -1716,8 +1695,8 @@ export function createLandstripIntegration(
       }
 
       if (isToolCallEventType('read', event)) {
-        const filePath = canonicalizePath(event.input.path);
-        if (!matchesPattern(filePath, getEffectiveAllowRead(config))) {
+        const filePath = canonicalizePath(event.input.path, ctx.cwd);
+        if (!matchesPattern(filePath, getEffectiveAllowRead(config), ctx.cwd)) {
           const choice = await promptReadBlock(ctx, filePath);
           if (choice === 'abort') {
             return {
@@ -1730,9 +1709,9 @@ export function createLandstripIntegration(
       }
 
       if (isToolCallEventType('write', event) || isToolCallEventType('edit', event)) {
-        const filePath = canonicalizePath((event.input as { path: string }).path);
+        const filePath = canonicalizePath((event.input as { path: string }).path, ctx.cwd);
 
-        if (matchesPattern(filePath, config.filesystem.denyWrite)) {
+        if (matchesPattern(filePath, config.filesystem.denyWrite, ctx.cwd)) {
           return {
             block: true,
             reason:
@@ -1741,7 +1720,7 @@ export function createLandstripIntegration(
           };
         }
 
-        if (shouldPromptForWrite(filePath, getEffectiveAllowWrite(config))) {
+        if (shouldPromptForWrite(filePath, getEffectiveAllowWrite(config), ctx.cwd)) {
           const choice = await promptWriteBlock(ctx, filePath);
           if (choice === 'abort') {
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.16.14",
+  "version": "0.16.16",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",
@@ -21,24 +21,27 @@
   ],
   "type": "module",
   "scripts": {
-    "fmt": "oxfmt index.ts package.json tsconfig.json sandbox.json .oxfmtrc.json README.md",
-    "lint": "oxlint index.ts",
+    "fmt": "oxfmt index.ts index.test.ts package.json tsconfig.json sandbox.json .oxfmtrc.json README.md",
+    "lint": "oxlint index.ts index.test.ts",
     "check": "tsc --noEmit",
-    "all": "npm run fmt && npm run lint && npm run check",
-    "ci:fmt": "oxfmt --check index.ts package.json tsconfig.json sandbox.json .oxfmtrc.json README.md",
+    "test": "vitest run",
+    "all": "npm run fmt && npm run lint && npm run check && npm run test",
+    "ci:fmt": "oxfmt --check index.ts index.test.ts package.json tsconfig.json sandbox.json .oxfmtrc.json README.md",
     "ci:lint": "npm run lint",
-    "ci:check": "npm run check"
+    "ci:check": "npm run check",
+    "ci:test": "npm run test"
   },
   "dependencies": {
     "@earendil-works/pi-tui": "^0.78.0",
-    "@landstrip/landstrip": "^0.16.15"
+    "@landstrip/landstrip": "^0.16.16"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.74.2",
     "@types/node": "^24.0.0",
     "oxfmt": "^0.53.0",
     "oxlint": "^1.68.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "^4.1.9"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.74.2"