pi-landstrip 0.16.29 → 0.17.2

package/LICENSE

@@ -1,21 +1,201 @@
-MIT License
-
-Copyright (c) 2026 Jarkko Sakkinen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -72,7 +72,7 @@ Use `/sandbox` inside pi to show the active config and toggle sandboxing.
 
 ## License
 
-`pi-landstrip` is licensed under `MIT`. See [LICENSE](LICENSE) for more
+`pi-landstrip` is licensed under `Apache-2.0`. See [LICENSE](LICENSE) for more
 information.
 
 The bundled `@landstrip/landstrip` package is licensed separately as

package/index.ts

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MIT
+// SPDX-License-Identifier: Apache-2.0
 // Copyright (C) Jarkko Sakkinen 2026
 
 import { spawn, spawnSync } from 'node:child_process';
@@ -43,7 +43,13 @@ import {
   withFileMutationQueue,
 } from '@earendil-works/pi-coding-agent';
 import { Key, matchesKey, truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
-import { binaryPath } from '@landstrip/landstrip';
+import {
+  binaryPath,
+  type LandstripControlResponse,
+  type LandstripFilesystemTrap,
+  type LandstripNetworkTrap,
+  type LandstripTrap,
+} from '@landstrip/landstrip';
 
 interface SandboxFilesystemConfig {
   denyRead: string[];
@@ -92,12 +98,7 @@ interface LandstripPolicy {
 
 type LandstripOperation = 'read' | 'write';
 
-type LandstripTrap =
-  | { kind: 'filesystem'; operation: LandstripOperation; file: string; mechanism: string }
-  | { kind: 'network'; operation: string; target: string; mechanism: string }
-  | { kind: 'launch'; program: string; source: string }
-  | { kind: 'usage'; message: string }
-  | { kind: 'internal'; detail: Record<string, string> };
+type LandstripDenialTrap = LandstripFilesystemTrap | LandstripNetworkTrap;
 
 interface LandstripBashCallbacks {
   onStderr?: (data: Buffer) => void;
@@ -107,6 +108,10 @@ interface LandstripBashCallbacks {
 
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 
+// Grace period after the child exits for its stdio to drain before we stop
+// waiting; matches pi's own bash backend so a backgrounded process cannot hang us.
+const EXIT_STDIO_GRACE_MS = 100;
+
 const packageDir = dirname(fileURLToPath(import.meta.url));
 type PermissionChoice = 'abort' | 'session' | 'project' | 'global';
 type NotificationLevel = Parameters<ExtensionContext['ui']['notify']>[1];
@@ -138,6 +143,11 @@ const PERMISSION_OPTIONS: PromptOption[] = [
   },
 ];
 
+const NETWORK_PERMISSION_OPTIONS: PromptOption[] = [
+  { label: 'Allow for this session only', key: 's', action: 'session' },
+  { label: 'Abort (keep blocked)', key: 'esc', action: 'abort' },
+];
+
 function loadConfig(cwd: string): SandboxConfig {
   const projectConfigPath = join(cwd, '.pi', 'sandbox.json');
   const globalConfigPath = join(getAgentDir(), 'sandbox.json');
@@ -294,8 +304,10 @@ function extractDomainsFromCommand(command: string): string[] {
 }
 
 function domainMatchesPattern(domain: string, pattern: string): boolean {
-  const normalizedDomain = domain.toLowerCase();
-  const normalizedPattern = pattern.toLowerCase();
+  // A trailing dot ("pastebin.com.") is the same host to DNS but would slip past
+  // a literal deny entry; strip it from both sides before matching.
+  const normalizedDomain = domain.toLowerCase().replace(/\.+$/, '');
+  const normalizedPattern = pattern.toLowerCase().replace(/\.+$/, '');
 
   if (normalizedPattern === '*') return true;
   if (normalizedPattern.startsWith('*.')) {
@@ -306,7 +318,7 @@ function domainMatchesPattern(domain: string, pattern: string): boolean {
   return normalizedDomain === normalizedPattern;
 }
 
-function domainMatchesAny(domain: string, patterns: string[]): boolean {
+export function domainMatchesAny(domain: string, patterns: string[]): boolean {
   return patterns.some((pattern) => domainMatchesPattern(domain, pattern));
 }
 
@@ -360,9 +372,14 @@ export function matchesPattern(filePath: string, patterns: string[], cwd: string
       : canonicalizePath(pattern, cwd);
 
     if (pattern.includes('*')) {
+      // Mirror landstrip's matcher: `**/` spans directories, `**` spans any run,
+      // but a single `*` stops at `/` — so `/srv/*/pub` cannot reach
+      // `/srv/a/secret/pub`. Compiling `*` to `.*` would over-match across `/`.
       const escaped = absPattern
         .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-        .replace(/\*\*\/|\*\*|\*/g, (token) => (token === '**/' ? '(?:.*/)?' : '.*'));
+        .replace(/\*\*\/|\*\*|\*/g, (token) =>
+          token === '**/' ? '(?:.*/)?' : token === '**' ? '.*' : '[^/]*',
+        );
       return new RegExp(`^${escaped}$`).test(abs);
     }
 
@@ -463,19 +480,34 @@ function normalizePathMatch(value: string, cwd: string): string | null {
   return isPathLike(value) ? normalizeBlockedPath(value, cwd) : null;
 }
 
-type LandstripFilesystemTrap = Extract<LandstripTrap, { kind: 'filesystem' }>;
-
 function isFilesystemTrap(trap: LandstripTrap): trap is LandstripFilesystemTrap {
   return trap.kind === 'filesystem';
 }
 
-function extractBlockedPath(output: string, cwd: string): string | null {
-  const landstripErrors = parseLandstripTraps(output).filter(isFilesystemTrap);
+// filesystem and network traps report an access the policy denied; launch, usage
+// and internal traps report that landstrip itself failed.
+function isDenialTrap(trap: LandstripTrap): trap is LandstripDenialTrap {
+  return trap.kind === 'filesystem' || trap.kind === 'network';
+}
+
+// A `state: "query"` trap suspends the child's syscall until we answer it on the
+// trap socket. An `info` trap is terminal and carries a `query_id` of "0".
+export function isQueryTrap(trap: LandstripTrap): trap is LandstripDenialTrap {
+  return isDenialTrap(trap) && trap.state === 'query';
+}
+
+// Structured traps come only from the trap socket (fd 3); the sandboxed command
+// controls its own stderr and could forge a trap line, so these `extractBlocked*`
+// helpers must be fed only that trusted channel. Agent-controlled stderr is read
+// with the `extractNative*` regexes instead, which match a real kernel-denial
+// message rather than a JSON record.
+function extractBlockedPath(trapOutput: string, cwd: string): string | null {
+  const landstripErrors = parseLandstripTraps(trapOutput).filter(isFilesystemTrap);
   if (landstripErrors.length > 0) {
-    return normalizeBlockedPath(landstripErrors[0].file, cwd);
+    return normalizeBlockedPath(landstripErrors[0].path, cwd);
   }
 
-  return extractNativeDeniedPath(output, cwd);
+  return null;
 }
 
 function extractNativeDeniedPath(output: string, cwd: string): string | null {
@@ -522,75 +554,66 @@ function extractNativeWriteDeniedPath(output: string, cwd: string): string | nul
   return null;
 }
 
-function extractBlockedWritePath(output: string, cwd: string): string | null {
-  for (const error of parseLandstripTraps(output).filter(isFilesystemTrap)) {
+function extractBlockedWritePath(trapOutput: string, cwd: string): string | null {
+  for (const error of parseLandstripTraps(trapOutput).filter(isFilesystemTrap)) {
     if (error.operation === 'write') {
-      return normalizeBlockedPath(error.file, cwd);
+      return normalizeBlockedPath(error.path, cwd);
     }
   }
 
-  return extractNativeWriteDeniedPath(output, cwd);
+  return null;
 }
 
-function extractBlockedReadPath(output: string, cwd: string): string | null {
-  for (const error of parseLandstripTraps(output).filter(isFilesystemTrap)) {
+function extractBlockedReadPath(trapOutput: string, cwd: string): string | null {
+  for (const error of parseLandstripTraps(trapOutput).filter(isFilesystemTrap)) {
     if (error.operation === 'read') {
-      return normalizeBlockedPath(error.file, cwd);
+      return normalizeBlockedPath(error.path, cwd);
     }
   }
 
-  return extractNativeDeniedPath(output, cwd);
+  return null;
 }
 
-function asString(value: unknown): string | null {
-  return typeof value === 'string' ? value : null;
-}
+// landstrip emits each trap as a flat JSON record tagged by a `kind` discriminant
+// (`filesystem`, `network`, `launch`, `usage`, `internal`) alongside a stable
+// `code` and variant-specific fields. The declarations it ships are erased at
+// compile time, so validate the fields this extension reads before trusting a
+// decoded line.
+function isLandstripTrap(value: unknown): value is LandstripTrap {
+  if (typeof value !== 'object' || value === null) return false;
 
-// landstrip emits each trap as a flat JSON record tagged by a `kind`
-// discriminant (`filesystem`, `network`, `launch`, `usage`, `internal`)
-// alongside a stable `code` and variant-specific fields.
-function parseLandstripTrap(obj: Record<string, unknown>): LandstripTrap | null {
+  const obj = value as Record<string, unknown>;
   switch (obj.kind) {
-    case 'filesystem': {
-      const operation = obj.operation;
-      const file = asString(obj.path);
-      if ((operation === 'read' || operation === 'write') && file !== null) {
-        return { kind: 'filesystem', operation, file, mechanism: asString(obj.mechanism) ?? '' };
-      }
-      return null;
-    }
-    case 'network': {
-      const operation = asString(obj.operation);
-      const target = asString(obj.target);
-      if (operation !== null && target !== null) {
-        return { kind: 'network', operation, target, mechanism: asString(obj.mechanism) ?? '' };
-      }
-      return null;
-    }
-    case 'launch': {
-      const program = asString(obj.program);
-      const source = asString(obj.message);
-      if (program !== null && source !== null) {
-        return { kind: 'launch', program, source };
-      }
-      return null;
-    }
-    case 'usage': {
-      const message = asString(obj.message);
-      return message !== null ? { kind: 'usage', message } : null;
-    }
-    case 'internal': {
-      const detail: Record<string, string> = {};
-      const raw = obj.detail;
-      if (typeof raw === 'object' && raw !== null && !Array.isArray(raw)) {
-        for (const [key, value] of Object.entries(raw)) {
-          if (typeof value === 'string') detail[key] = value;
-        }
-      }
-      return { kind: 'internal', detail };
-    }
+    case 'filesystem':
+      return (
+        (obj.operation === 'read' || obj.operation === 'write') &&
+        typeof obj.path === 'string' &&
+        typeof obj.query_id === 'string'
+      );
+    case 'network':
+      return (
+        typeof obj.operation === 'string' &&
+        typeof obj.target === 'string' &&
+        typeof obj.query_id === 'string'
+      );
+    case 'launch':
+      return typeof obj.program === 'string' && typeof obj.message === 'string';
+    case 'usage':
+      return typeof obj.message === 'string';
+    case 'internal':
+      return typeof obj.code === 'string' && typeof obj.message === 'string';
     default:
-      return null;
+      return false;
+  }
+}
+
+export function parseTrapLine(line: string): LandstripTrap | null {
+  try {
+    const parsed: unknown = JSON.parse(line);
+    return isLandstripTrap(parsed) ? parsed : null;
+  } catch {
+    // Ignore non-JSON lines (e.g. stderr from child processes)
+    return null;
   }
 }
 
@@ -598,44 +621,45 @@ function parseLandstripTraps(output: string): LandstripTrap[] {
   const traps: LandstripTrap[] = [];
 
   for (const line of output.trim().split('\n')) {
-    if (line.length === 0) continue;
-
-    try {
-      const parsed: unknown = JSON.parse(line);
-      if (typeof parsed !== 'object' || parsed === null) continue;
-      const trap = parseLandstripTrap(parsed as Record<string, unknown>);
-      if (trap) traps.push(trap);
-    } catch {
-      // Ignore non-JSON lines (e.g. stderr from child processes)
-    }
+    const trap = parseTrapLine(line);
+    if (trap) traps.push(trap);
   }
 
   return traps;
 }
 
-function formatLandstripTraps(traps: LandstripTrap[]): string {
+export function formatLandstripTraps(traps: LandstripTrap[]): string {
   return traps
     .map((trap) => {
       switch (trap.kind) {
         case 'filesystem':
-          return `landstrip: filesystem ${trap.operation} denied: ${trap.file} (${trap.mechanism})`;
+          return `landstrip: filesystem ${trap.operation} denied: ${trap.path} (${trap.mechanism})`;
         case 'network':
           return `landstrip: network ${trap.operation} denied: ${trap.target} (${trap.mechanism})`;
         case 'launch':
-          return `landstrip: launch failed: ${trap.program}: ${trap.source}`;
+          return `landstrip: launch failed: ${trap.program}: ${trap.message}`;
         case 'usage':
           return `landstrip: usage error: ${trap.message}`;
         case 'internal': {
-          const detail = Object.entries(trap.detail)
-            .map(([key, value]) => `${key}=${value}`)
-            .join(', ');
-          return detail ? `landstrip: internal error: ${detail}` : 'landstrip: internal error';
+          const mechanism = trap.mechanism ? ` (${trap.mechanism})` : '';
+          return `landstrip: ${trap.code}${mechanism}: ${trap.message}`;
         }
       }
     })
     .join('\n');
 }
 
+// The broker matches an answer to its query by the exact decimal `query_id`
+// string the trap carried. A numeric id fails its deserializer, the line is
+// dropped, and the child's syscall stays suspended.
+export function controlResponseLine(
+  queryId: string,
+  action: LandstripControlResponse['action'],
+): string {
+  const response: LandstripControlResponse = { query_id: queryId, action };
+  return JSON.stringify(response) + '\n';
+}
+
 function notify(ctx: ExtensionContext, message: string, level: NotificationLevel): void {
   if (!ctx.hasUI) return;
   ctx.ui.notify(message, level);
@@ -787,11 +811,8 @@ async function showPermissionPrompt(
           for (let i = 0; i < options.length; i++) {
             const option = options[i];
 
-            if (data === option.key) {
-              resolveChoice(option.action);
-              return;
-            }
-
+            // Match case-insensitively so a `confirm` option always arms its
+            // two-step gate; an exact-key shortcut here would skip it.
             if (data.toLowerCase() === option.key.toLowerCase()) {
               if (option.confirm) {
                 pendingAction = option.action;
@@ -848,6 +869,22 @@ function promptWriteBlock(ctx: ExtensionContext, filePath: string): Promise<Perm
   );
 }
 
+// The broker knows only address:port, and no sandbox.json field can express a
+// grant for one: allowedDomains is a hostname list enforced by the proxy, and the
+// landstrip network policy is all-or-nothing (allowNetwork, allowLocalBinding).
+// So a connection is granted for the session or not at all.
+function promptNetworkBlock(
+  ctx: ExtensionContext,
+  operation: string,
+  target: string,
+): Promise<PermissionChoice> {
+  return showPermissionPrompt(
+    ctx,
+    `Network blocked: ${operation} to "${target}"`,
+    NETWORK_PERMISSION_OPTIONS,
+  );
+}
+
 // The binary is bundled and version-locked to @landstrip/landstrip via npm, so
 // compatibility is settled at install time; only confirm it is runnable here.
 function landstripAvailable(): boolean {
@@ -869,6 +906,11 @@ export function writeEnvFile(
   const lines: string[] = [];
   for (const [key, value] of Object.entries(env)) {
     if (value === undefined) continue;
+    // bash exports non-identifier names (e.g. a `BASH_FUNC_foo%%` function
+    // export) that `export NAME=...` rejects; emitting one makes `source` exit
+    // non-zero and the `&&`-chained command never runs. Skip what the shell
+    // itself cannot set.
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
     // Escape single quotes: ' -> '\''
     const escaped = value.replace(/'/g, "'\\''");
     lines.push(`export ${key}='${escaped}'`);
@@ -974,11 +1016,13 @@ export function createLandstripIntegration(
   const sessionAllowedDomains: string[] = [];
   const sessionAllowedReadPaths: string[] = [];
   const sessionAllowedWritePaths: string[] = [];
+  const sessionAllowedTargets: string[] = [];
 
   function resetSessionAllowances(): void {
     sessionAllowedDomains.length = 0;
     sessionAllowedReadPaths.length = 0;
     sessionAllowedWritePaths.length = 0;
+    sessionAllowedTargets.length = 0;
   }
 
   function getEffectiveAllowedDomains(config: SandboxConfig): string[] {
@@ -1032,6 +1076,31 @@ export function createLandstripIntegration(
     noteScope(ctx, 'Read', choice, filePath, scope);
   }
 
+  // Gate a read of `filePath` against allowRead/denyRead, prompting when blocked.
+  // Returns a block result when the user aborts, otherwise undefined once access
+  // is settled. Shared by the read, grep, ls and find tools.
+  async function gateReadAccess(
+    ctx: ExtensionContext,
+    config: SandboxConfig,
+    filePath: string,
+  ): Promise<{ block: true; reason: string } | undefined> {
+    if (readAllowed(filePath, getEffectiveAllowRead(config), config.filesystem.denyRead, ctx.cwd)) {
+      return undefined;
+    }
+    const choice = await promptReadBlock(
+      ctx,
+      filePath,
+      matchesPattern(filePath, config.filesystem.denyRead, ctx.cwd)
+        ? 'granting allowRead will override it'
+        : undefined,
+    );
+    if (choice === 'abort') {
+      return { block: true, reason: `Sandbox: read access denied for "${filePath}"` };
+    }
+    await applyReadChoice(ctx, choice, filePath, ctx.cwd);
+    return undefined;
+  }
+
   async function applyWriteChoice(
     ctx: ExtensionContext,
     choice: Exclude<PermissionChoice, 'abort'>,
@@ -1104,6 +1173,17 @@ export function createLandstripIntegration(
       return domainMatchesAny(domain, getEffectiveAllowedDomains(config));
     }
 
+    // Track the upstream socket so stop() tears it down, and abandon a still-
+    // connecting upstream when its client goes away — otherwise a connect to a
+    // black-holed host lingers in SYN-retry (~2 min), leaking an fd per request.
+    function trackUpstream(upstream: Socket, client: Socket, settled: () => boolean): void {
+      sockets.add(upstream);
+      upstream.once('close', () => sockets.delete(upstream));
+      client.once('close', () => {
+        if (!settled()) upstream.destroy();
+      });
+    }
+
     async function handleConnect(client: Socket, target: string, rest: Buffer): Promise<void> {
       const endpoint = splitHostPort(target, 443);
       if (!endpoint || !Number.isFinite(endpoint.port)) {
@@ -1122,6 +1202,7 @@ export function createLandstripIntegration(
         client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
         pipeSockets(client, upstream, rest);
       });
+      trackUpstream(upstream, client, () => settled);
       upstream.once('error', () => {
         if (settled) return;
         settled = true;
@@ -1182,6 +1263,7 @@ export function createLandstripIntegration(
         upstream.write(`${rewrittenHeader}\r\n\r\n`);
         pipeSockets(client, upstream, rest);
       });
+      trackUpstream(upstream, client, () => settled);
       upstream.once('error', () => {
         if (settled) return;
         settled = true;
@@ -1281,10 +1363,28 @@ export function createLandstripIntegration(
         const config = loadConfig(cwd);
         const allowNetwork = config.network.allowNetwork;
         const proxy = allowNetwork ? null : await startProxy(cwd);
-        const policy = writePolicyFile(cwd, proxy?.port ?? null);
-        const envFile = writeEnvFile({ ...process.env, ...env }, proxy?.port ?? null);
-        const wrappedCommand = `source '${envFile.path}' && ${command}`;
-        const landstripArgs = ['--trap-fd', '3', '-p', policy.path, shell, ...args, wrappedCommand];
+
+        // Started/created before the child exists, so tear them down on any early
+        // failure too — the env file holds a copy of the environment (secrets),
+        // and the proxy keeps a listening socket. Idempotent: safe to call twice.
+        let policy: ReturnType<typeof writePolicyFile> | undefined;
+        let envFile: ReturnType<typeof writeEnvFile> | undefined;
+        const teardownResources = () => {
+          void proxy?.stop();
+          if (policy) rmSync(policy.dir, { recursive: true, force: true });
+          if (envFile) rmSync(envFile.dir, { recursive: true, force: true });
+        };
+
+        let landstripArgs: string[];
+        try {
+          policy = writePolicyFile(cwd, proxy?.port ?? null);
+          envFile = writeEnvFile({ ...process.env, ...env }, proxy?.port ?? null);
+          const wrappedCommand = `source '${envFile.path}' && ${command}`;
+          landstripArgs = ['--trap-fd', '3', '-p', policy.path, shell, ...args, wrappedCommand];
+        } catch (error) {
+          teardownResources();
+          throw error;
+        }
 
         return new Promise((resolvePromise, reject) => {
           (async () => {
@@ -1299,10 +1399,8 @@ export function createLandstripIntegration(
               cleaned = true;
               if (timeoutHandle) clearTimeout(timeoutHandle);
               signal?.removeEventListener('abort', onAbort);
-              void proxy?.stop();
+              teardownResources();
               trapSocket.destroy();
-              rmSync(policy.dir, { recursive: true, force: true });
-              rmSync(envFile.dir, { recursive: true, force: true });
             };
 
             const child = spawn(binaryPath(), landstripArgs, {
@@ -1339,18 +1437,85 @@ export function createLandstripIntegration(
             let stderrAcc = '';
             let errorFdAcc = '';
 
+            let execSettled = false;
+            let childExited = false;
+            let childExitCode: number | null = null;
+            let postExitTimer: NodeJS.Timeout | undefined;
+            let stdoutEnded = child.stdout === null;
+            let stderrEnded = child.stderr === null;
+
+            const finalizeExec = (code: number | null): void => {
+              if (execSettled) return;
+              execSettled = true;
+              if (postExitTimer) clearTimeout(postExitTimer);
+              // Stop tracking the inherited pipes: a backgrounded grandchild can
+              // hold them open after the command itself exits, so 'close' would
+              // otherwise never arrive.
+              child.stdout?.destroy();
+              child.stderr?.destroy();
+              void (async () => {
+                cleanup();
+                if (signal?.aborted) {
+                  reject(new Error('aborted'));
+                  return;
+                }
+                if (timedOut) {
+                  reject(new Error(`timeout:${timeout}`));
+                  return;
+                }
+
+                // Structured traps are trusted only from the trap socket (fd 3);
+                // the command's own stderr is read with the native regexes, which
+                // reflect a real kernel denial rather than a forgeable JSON line.
+                const blockedPath =
+                  extractBlockedPath(errorFdAcc, cwd) ?? extractNativeDeniedPath(stderrAcc, cwd);
+                if (!blockedPath && ctx.hasUI) {
+                  const traps = parseLandstripTraps(errorFdAcc);
+                  const denials = traps.filter(isDenialTrap);
+                  if (denials.length > 0) {
+                    const formatted = formatLandstripTraps(denials);
+                    notify(ctx, `Sandbox blocked an operation: ${formatted}`, 'warning');
+                  }
+
+                  const failures = traps.filter((trap) => !isDenialTrap(trap));
+                  if (failures.length > 0) {
+                    notify(ctx, `Sandbox failed: ${formatLandstripTraps(failures)}`, 'error');
+                  }
+                }
+
+                resolvePromise({ exitCode: code });
+              })().catch(reject);
+            };
+
+            const maybeFinalizeAfterExit = (): void => {
+              if (childExited && !execSettled && stdoutEnded && stderrEnded) {
+                finalizeExec(childExitCode);
+              }
+            };
+
             child.stdout?.on('data', onData);
             child.stderr?.on('data', (data: Buffer) => {
               stderrAcc += data.toString('utf8');
               callbacks.onStderr?.(data);
               onData(data);
             });
+            child.stdout?.once('end', () => {
+              stdoutEnded = true;
+              maybeFinalizeAfterExit();
+            });
+            child.stderr?.once('end', () => {
+              stderrEnded = true;
+              maybeFinalizeAfterExit();
+            });
             let trapBuffer = '';
             let queryChain: Promise<void> = Promise.resolve();
 
-            const respondQuery = (queryId: number, action: 'allow' | 'deny'): void => {
+            const respondQuery = (
+              queryId: string,
+              action: LandstripControlResponse['action'],
+            ): void => {
               if (trapSocket.destroyed) return;
-              trapSocket.write(JSON.stringify({ query_id: queryId, action }) + '\n');
+              trapSocket.write(controlResponseLine(queryId, action));
             };
 
             // Surface a denial through the error-fd accumulator so the post-close
@@ -1364,7 +1529,7 @@ export function createLandstripIntegration(
             // Answer a landstrip query (state:"query"). The broker suspends the
             // child's syscall until we respond allow/deny on the trap socket.
             const handleQuery = (
-              queryId: number,
+              queryId: string,
               operation: LandstripOperation,
               rawPath: string,
               rawLine: string,
@@ -1422,6 +1587,42 @@ export function createLandstripIntegration(
                 .catch(() => respondQuery(queryId, 'deny'));
             };
 
+            // A denied connect or bind is a query too, and the broker re-issues it
+            // itself once we allow. The target is address:port, so a grant only
+            // lasts for the session (see promptNetworkBlock).
+            const handleNetworkQuery = (
+              queryId: string,
+              operation: string,
+              target: string,
+              rawLine: string,
+            ): void => {
+              if (sessionAllowedTargets.includes(target)) {
+                respondQuery(queryId, 'allow');
+                return;
+              }
+              if (!ctx.hasUI || !callbacks.promptOnBlock) {
+                appendErrorLine(rawLine);
+                respondQuery(queryId, 'deny');
+                return;
+              }
+              queryChain = queryChain
+                .then(async () => {
+                  if (sessionAllowedTargets.includes(target)) {
+                    respondQuery(queryId, 'allow');
+                    return;
+                  }
+                  const choice = await promptNetworkBlock(ctx, operation, target);
+                  if (choice === 'abort') {
+                    appendErrorLine(rawLine);
+                    respondQuery(queryId, 'deny');
+                    return;
+                  }
+                  sessionAllowedTargets.push(target);
+                  respondQuery(queryId, 'allow');
+                })
+                .catch(() => respondQuery(queryId, 'deny'));
+            };
+
             trapSocket.on('data', (data: Buffer) => {
               trapBuffer += data.toString('utf8');
               let nl = trapBuffer.indexOf('\n');
@@ -1430,66 +1631,49 @@ export function createLandstripIntegration(
                 trapBuffer = trapBuffer.slice(nl + 1);
                 nl = trapBuffer.indexOf('\n');
                 if (line.length === 0) continue;
-                let obj: Record<string, unknown> | null = null;
-                try {
-                  const parsed: unknown = JSON.parse(line);
-                  if (typeof parsed === 'object' && parsed !== null) {
-                    obj = parsed as Record<string, unknown>;
+                const trap = parseTrapLine(line);
+                // An unanswered query holds the child's syscall, so every query
+                // gets an answer; anything else is informational and kept for
+                // post-close handling.
+                if (trap && isQueryTrap(trap)) {
+                  if (isFilesystemTrap(trap)) {
+                    handleQuery(trap.query_id, trap.operation, trap.path, line);
+                  } else {
+                    handleNetworkQuery(trap.query_id, trap.operation, trap.target, line);
                   }
-                } catch {
-                  obj = null;
-                }
-                if (
-                  obj &&
-                  obj.state === 'query' &&
-                  typeof obj.query_id === 'number' &&
-                  (obj.operation === 'read' || obj.operation === 'write') &&
-                  typeof obj.path === 'string'
-                ) {
-                  handleQuery(obj.query_id, obj.operation, obj.path, line);
                 } else {
-                  // Informational trap (network denials, etc.): keep for post-close handling.
                   appendErrorLine(line);
                 }
               }
             });
 
             child.on('error', (error) => {
+              if (execSettled) return;
+              execSettled = true;
+              if (postExitTimer) clearTimeout(postExitTimer);
               cleanup();
               reject(error);
             });
 
-            child.on('close', (code) => {
-              void (async () => {
-                cleanup();
-                if (signal?.aborted) {
-                  reject(new Error('aborted'));
-                  return;
-                }
-                if (timedOut) {
-                  reject(new Error(`timeout:${timeout}`));
-                  return;
-                }
-
-                const errorOutput = errorFdAcc || stderrAcc;
-
-                // Filesystem denials are now answered live during execution; only
-                // informational traps (network, etc.) remain to surface here.
-                const blockedPath =
-                  extractBlockedPath(errorOutput, cwd) ??
-                  (errorFdAcc ? extractBlockedPath(stderrAcc, cwd) : null);
-                if (!blockedPath && ctx.hasUI) {
-                  const landstripErrors = parseLandstripTraps(errorOutput);
-                  if (landstripErrors.length > 0) {
-                    const formatted = formatLandstripTraps(landstripErrors);
-                    notify(ctx, `Sandbox blocked an operation: ${formatted}`, 'warning');
-                  }
-                }
-
-                resolvePromise({ exitCode: code });
-              })().catch(reject);
+            // Settle on 'exit' — the command itself has ended — rather than
+            // waiting for 'close', which only fires once every inherited stdio
+            // pipe is closed. A backgrounded process holding one open would
+            // otherwise block us indefinitely.
+            child.once('exit', (code) => {
+              childExited = true;
+              childExitCode = code;
+              maybeFinalizeAfterExit();
+              if (!execSettled) {
+                postExitTimer = setTimeout(() => finalizeExec(code), EXIT_STDIO_GRACE_MS);
+              }
             });
-          })().catch(reject);
+            child.once('close', (code) => finalizeExec(code));
+          })().catch((error: unknown) => {
+            // A failure before the child is wired (e.g. createSocketPair) never
+            // reaches cleanup(); free the proxy and temp dirs here too.
+            teardownResources();
+            reject(error);
+          });
         });
       },
     };
@@ -1598,7 +1782,7 @@ export function createLandstripIntegration(
       const fallbackOutput = `${stderrOutput}\n${errorText}`;
       const blockedWritePath =
         extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
-        extractBlockedWritePath(fallbackOutput, ctx.cwd);
+        extractNativeWriteDeniedPath(fallbackOutput, ctx.cwd);
       if (blockedWritePath) {
         const retryResult = await retryWithWriteAccess(blockedWritePath);
         if (retryResult) return retryResult;
@@ -1606,13 +1790,13 @@ export function createLandstripIntegration(
 
       const blockedReadPath =
         extractBlockedReadPath(landstripErrorOutput, ctx.cwd) ??
-        extractBlockedReadPath(fallbackOutput, ctx.cwd);
+        extractNativeDeniedPath(fallbackOutput, ctx.cwd);
       if (blockedReadPath) {
         const retryResult = await retryWithReadAccess(blockedReadPath);
         if (retryResult) return retryResult;
       }
 
-      const landstripErrors = parseLandstripTraps(landstripErrorOutput || errorText);
+      const landstripErrors = parseLandstripTraps(landstripErrorOutput);
       if (landstripErrors.length > 0) {
         throw new Error(formatLandstripTraps(landstripErrors));
       }
@@ -1625,7 +1809,7 @@ export function createLandstripIntegration(
     }
     const blockedWritePath =
       extractBlockedWritePath(landstripErrorOutput, ctx.cwd) ??
-      extractBlockedWritePath(stderrOutput, ctx.cwd);
+      extractNativeWriteDeniedPath(stderrOutput, ctx.cwd);
     if (blockedWritePath) {
       const retryResult = await retryWithWriteAccess(blockedWritePath);
       if (retryResult) return retryResult;
@@ -1633,7 +1817,7 @@ export function createLandstripIntegration(
 
     const blockedReadPath =
       extractBlockedReadPath(landstripErrorOutput, ctx.cwd) ??
-      extractBlockedReadPath(stderrOutput, ctx.cwd);
+      extractNativeDeniedPath(stderrOutput, ctx.cwd);
     if (!blockedReadPath) return result;
 
     const retryResult = await retryWithReadAccess(blockedReadPath);
@@ -1690,20 +1874,37 @@ export function createLandstripIntegration(
     setTuiStatus(ctx, 'sandbox', `${dot} ${label}  ${sep}  ${net}  ${sep}  ${write}`);
   }
 
+  const headlessWarnings = new Set<string>();
+
+  // When sandboxing cannot be applied, bash falls back to running unsandboxed.
+  // notify() is a no-op without a UI, so in headless/RPC mode also print to
+  // stderr (once per message) rather than failing open silently.
+  function warnUnsandboxed(ctx: ExtensionContext, message: string, level: NotificationLevel): void {
+    notify(ctx, message, level);
+    if (!ctx.hasUI && !headlessWarnings.has(message)) {
+      headlessWarnings.add(message);
+      console.error(`pi-landstrip: ${message}`);
+    }
+  }
+
   function enableSandbox(ctx: ExtensionContext): boolean {
     const config = loadConfig(ctx.cwd);
 
     if (!SUPPORTED_PLATFORMS.has(process.platform)) {
       sandboxEnabled = false;
       sandboxReady = false;
-      notify(ctx, `landstrip sandboxing is not supported on ${process.platform}`, 'warning');
+      warnUnsandboxed(
+        ctx,
+        `landstrip sandboxing is not supported on ${process.platform}`,
+        'warning',
+      );
       return false;
     }
 
     if (!landstripAvailable()) {
       sandboxEnabled = false;
       sandboxReady = false;
-      notify(
+      warnUnsandboxed(
         ctx,
         `landstrip was not found. Reinstall with: npm install @landstrip/landstrip`,
         'error',
@@ -1813,17 +2014,28 @@ export function createLandstripIntegration(
       }
 
       if (isToolCallEventType('read', event)) {
-        const filePath = canonicalizePath(event.input.path, ctx.cwd);
-        if (!matchesPattern(filePath, getEffectiveAllowRead(config), ctx.cwd)) {
-          const choice = await promptReadBlock(ctx, filePath);
-          if (choice === 'abort') {
-            return {
-              block: true,
-              reason: `Sandbox: read access denied for "${filePath}"`,
-            };
-          }
-          await applyReadChoice(ctx, choice, filePath, ctx.cwd);
-        }
+        const result = await gateReadAccess(
+          ctx,
+          config,
+          canonicalizePath(event.input.path, ctx.cwd),
+        );
+        if (result) return result;
+      }
+
+      // grep, ls and find read their target path (default: the cwd) and recurse
+      // into it, so gate them against allowRead/denyRead like the read tool —
+      // otherwise they run in-process, unsandboxed, and defeat denyRead.
+      if (
+        isToolCallEventType('grep', event) ||
+        isToolCallEventType('ls', event) ||
+        isToolCallEventType('find', event)
+      ) {
+        const result = await gateReadAccess(
+          ctx,
+          config,
+          canonicalizePath(event.input.path ?? '.', ctx.cwd),
+        );
+        if (result) return result;
       }
 
       if (isToolCallEventType('write', event) || isToolCallEventType('edit', event)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.16.29",
+  "version": "0.17.2",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",
@@ -8,14 +8,13 @@
     "pi-package",
     "sandbox"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/landstrip/pi-landstrip.git"
+    "url": "git+https://github.com/landstrip/landstrip.git"
   },
   "files": [
     "index.ts",
-    "landstrip.d.ts",
     "README.md",
     "sandbox.json"
   ],
@@ -33,7 +32,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-tui": "^0.78.0",
-    "@landstrip/landstrip": "^0.16.23"
+    "@landstrip/landstrip": "^0.17.2"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.74.2",

package/landstrip.d.ts

@@ -1,3 +0,0 @@
-declare module '@landstrip/landstrip' {
-  function binaryPath(): string;
-}