pi-landstrip 0.16.3 → 0.16.5

package/index.ts

@@ -1,19 +1,8 @@
 // SPDX-License-Identifier: MIT
 // Copyright (C) Jarkko Sakkinen 2026
 
-import type {
-  AgentToolResult,
-  AgentToolUpdateCallback,
-  BashToolDetails,
-  BashToolInput,
-  ExtensionAPI,
-  ExtensionContext,
-  Theme,
-} from '@earendil-works/pi-coding-agent';
-
-import { binaryPath } from '@landstrip/landstrip';
-
 import { spawn, spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import {
   existsSync,
   mkdirSync,
@@ -34,6 +23,16 @@ import { homedir, tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { URL } from 'node:url';
 
+import type {
+  AgentToolResult,
+  AgentToolUpdateCallback,
+  BashToolDetails,
+  BashToolInput,
+  ExtensionAPI,
+  ExtensionContext,
+  Theme,
+} from '@earendil-works/pi-coding-agent';
+
 import {
   type BashOperations,
   createBashToolDefinition,
@@ -44,7 +43,7 @@ import {
   withFileMutationQueue,
 } from '@earendil-works/pi-coding-agent';
 import { Key, matchesKey, truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
-import { randomBytes } from 'node:crypto';
+import { binaryPath } from '@landstrip/landstrip';
 
 interface SandboxFilesystemConfig {
   denyRead: string[];
@@ -328,12 +327,8 @@ function allowsAllDomains(allowedDomains: string[]): boolean {
   return allowedDomains.includes('*');
 }
 
-function shouldPromptForWrite(
-  path: string,
-  allowWrite: string[],
-  patternMatcher: (path: string, patterns: string[]) => boolean,
-): boolean {
-  return allowWrite.length === 0 || !patternMatcher(path, allowWrite);
+function shouldPromptForWrite(path: string, allowWrite: string[]): boolean {
+  return allowWrite.length === 0 || !matchesPattern(path, allowWrite);
 }
 
 function expandPath(filePath: string): string {
@@ -1004,12 +999,15 @@ export function createLandstripIntegration(
     return { dir, path };
   }
 
-  function startProxy(
-    ctx: ExtensionContext,
-    cwd: string,
-  ): Promise<{ port: number; stop: () => Promise<void> }> {
+  function startProxy(cwd: string): Promise<{ port: number; stop: () => Promise<void> }> {
     const sockets = new Set<Socket>();
 
+    function domainAllowed(domain: string): boolean {
+      const config = loadConfig(cwd);
+      if (domainMatchesAny(domain, config.network.deniedDomains)) return false;
+      return domainMatchesAny(domain, getEffectiveAllowedDomains(config));
+    }
+
     async function handleConnect(client: Socket, target: string, rest: Buffer): Promise<void> {
       const endpoint = splitHostPort(target, 443);
       if (!endpoint || !Number.isFinite(endpoint.port)) {
@@ -1017,7 +1015,7 @@ export function createLandstripIntegration(
         return;
       }
 
-      if (!(await ensureDomainAllowed(ctx, endpoint.host, cwd))) {
+      if (!domainAllowed(endpoint.host)) {
         denyProxyRequest(client);
         return;
       }
@@ -1065,7 +1063,7 @@ export function createLandstripIntegration(
         }
       }
 
-      if (!(await ensureDomainAllowed(ctx, url.hostname, cwd))) {
+      if (!domainAllowed(url.hostname)) {
         denyProxyRequest(client);
         return;
       }
@@ -1187,7 +1185,7 @@ export function createLandstripIntegration(
         const { shell, args } = getShellConfig(SettingsManager.create(cwd).getShellPath());
         const config = loadConfig(cwd);
         const allowNetwork = config.network.allowNetwork;
-        const proxy = allowNetwork ? null : await startProxy(ctx, cwd);
+        const proxy = allowNetwork ? null : await startProxy(cwd);
         const policy = writePolicyFile(cwd, proxy?.port ?? null);
         const landstripArgs = ['--trap-fd', '3', '-p', policy.path, shell, ...args, command];
 
@@ -1249,9 +1247,114 @@ export function createLandstripIntegration(
               callbacks.onStderr?.(data);
               onData(data);
             });
+            let trapBuffer = '';
+            let queryChain: Promise<void> = Promise.resolve();
+
+            const respondQuery = (queryId: number, action: 'allow' | 'deny'): void => {
+              if (trapSocket.destroyed) return;
+              trapSocket.write(JSON.stringify({ query_id: queryId, action }) + '\n');
+            };
+
+            // Surface a denial through the error-fd accumulator so the post-close
+            // notify and the runBashWithOptionalRetry prompt/retry paths still work.
+            const appendErrorLine = (line: string): void => {
+              const infoLine = line + '\n';
+              errorFdAcc += infoLine;
+              callbacks.onErrorFd?.(Buffer.from(infoLine, 'utf8'));
+            };
+
+            // Answer a landstrip query (state:"query"). The broker suspends the
+            // child's syscall until we respond allow/deny on the trap socket.
+            const handleQuery = (
+              queryId: number,
+              operation: LandstripOperation,
+              rawPath: string,
+              rawLine: string,
+            ): void => {
+              const path = normalizeBlockedPath(rawPath, cwd);
+              const config = loadConfig(cwd);
+              const isAllowed = (cfg: SandboxConfig): boolean =>
+                operation === 'read'
+                  ? !matchesPattern(path, cfg.filesystem.denyRead) &&
+                    matchesPattern(path, getEffectiveAllowRead(cfg))
+                  : !matchesPattern(path, cfg.filesystem.denyWrite) &&
+                    !shouldPromptForWrite(path, getEffectiveAllowWrite(cfg));
+
+              if (isAllowed(config)) {
+                respondQuery(queryId, 'allow');
+                return;
+              }
+              // Without an interactive prompt, deny and let the retry path grant.
+              if (!ctx.hasUI || !callbacks.promptOnBlock) {
+                appendErrorLine(rawLine);
+                respondQuery(queryId, 'deny');
+                return;
+              }
+              // denyWrite is a hard block: never prompt to override it.
+              if (operation === 'write' && matchesPattern(path, config.filesystem.denyWrite)) {
+                respondQuery(queryId, 'deny');
+                return;
+              }
+              // Serialize prompts so concurrent queries never overlap on screen and
+              // a path granted by one prompt auto-allows later queries for it.
+              queryChain = queryChain
+                .then(async () => {
+                  const cfg = loadConfig(cwd);
+                  if (isAllowed(cfg)) {
+                    respondQuery(queryId, 'allow');
+                    return;
+                  }
+                  const choice =
+                    operation === 'read'
+                      ? await promptReadBlock(
+                          ctx,
+                          path,
+                          matchesPattern(path, cfg.filesystem.denyRead)
+                            ? 'granting allowRead will override it'
+                            : undefined,
+                        )
+                      : await promptWriteBlock(ctx, path);
+                  if (choice === 'abort') {
+                    respondQuery(queryId, 'deny');
+                    return;
+                  }
+                  if (operation === 'read') await applyReadChoice(choice, path, cwd);
+                  else await applyWriteChoice(choice, path, cwd);
+                  respondQuery(queryId, 'allow');
+                })
+                .catch(() => respondQuery(queryId, 'deny'));
+            };
+
             trapSocket.on('data', (data: Buffer) => {
-              errorFdAcc += data.toString('utf8');
-              callbacks.onErrorFd?.(data);
+              trapBuffer += data.toString('utf8');
+              let nl = trapBuffer.indexOf('\n');
+              while (nl !== -1) {
+                const line = trapBuffer.slice(0, nl);
+                trapBuffer = trapBuffer.slice(nl + 1);
+                nl = trapBuffer.indexOf('\n');
+                if (line.length === 0) continue;
+                let obj: Record<string, unknown> | null = null;
+                try {
+                  const parsed: unknown = JSON.parse(line);
+                  if (typeof parsed === 'object' && parsed !== null) {
+                    obj = parsed as Record<string, unknown>;
+                  }
+                } catch {
+                  obj = null;
+                }
+                if (
+                  obj &&
+                  obj.state === 'query' &&
+                  typeof obj.query_id === 'number' &&
+                  (obj.operation === 'read' || obj.operation === 'write') &&
+                  typeof obj.path === 'string'
+                ) {
+                  handleQuery(obj.query_id, obj.operation, obj.path, line);
+                } else {
+                  // Informational trap (network denials, etc.): keep for post-close handling.
+                  appendErrorLine(line);
+                }
+              }
             });
 
             child.on('error', (error) => {
@@ -1273,40 +1376,12 @@ export function createLandstripIntegration(
 
                 const errorOutput = errorFdAcc || stderrAcc;
 
+                // Filesystem denials are now answered live during execution; only
+                // informational traps (network, etc.) remain to surface here.
                 const blockedPath =
                   extractBlockedPath(errorOutput, cwd) ??
                   (errorFdAcc ? extractBlockedPath(stderrAcc, cwd) : null);
-                const blockedWritePath =
-                  extractBlockedWritePath(errorOutput, cwd) ??
-                  (errorFdAcc ? extractBlockedWritePath(stderrAcc, cwd) : null);
-                if (blockedPath && ctx.hasUI && callbacks.promptOnBlock) {
-                  const config = loadConfig(cwd);
-                  const isDeniedByDenyRead = matchesPattern(
-                    blockedPath,
-                    config.filesystem.denyRead,
-                  );
-                  const isReadAllowed = matchesPattern(blockedPath, getEffectiveAllowRead(config));
-                  const isWriteAllowed = !shouldPromptForWrite(
-                    blockedPath,
-                    getEffectiveAllowWrite(config),
-                    matchesPattern,
-                  );
-
-                  if (blockedWritePath === blockedPath && !isWriteAllowed) {
-                    const choice = await promptWriteBlock(ctx, blockedPath);
-                    if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
-                  } else if (isDeniedByDenyRead || !isReadAllowed) {
-                    const choice = await promptReadBlock(
-                      ctx,
-                      blockedPath,
-                      isDeniedByDenyRead ? 'granting allowRead will override it' : undefined,
-                    );
-                    if (choice !== 'abort') await applyReadChoice(choice, blockedPath, cwd);
-                  } else if (!isWriteAllowed) {
-                    const choice = await promptWriteBlock(ctx, blockedPath);
-                    if (choice !== 'abort') await applyWriteChoice(choice, blockedPath, cwd);
-                  }
-                } else if (!blockedPath && ctx.hasUI) {
+                if (!blockedPath && ctx.hasUI) {
                   const landstripErrors = parseLandstripTraps(errorOutput);
                   if (landstripErrors.length > 0) {
                     const formatted = formatLandstripTraps(landstripErrors);
@@ -1361,7 +1436,7 @@ export function createLandstripIntegration(
         return null;
       }
 
-      if (shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config), matchesPattern)) {
+      if (shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config))) {
         const choice = await promptWriteBlock(ctx, blockedPath);
         if (choice === 'abort') return null;
         await applyWriteChoice(choice, blockedPath, ctx.cwd);
@@ -1677,7 +1752,7 @@ export function createLandstripIntegration(
           };
         }
 
-        if (shouldPromptForWrite(filePath, getEffectiveAllowWrite(config), matchesPattern)) {
+        if (shouldPromptForWrite(filePath, getEffectiveAllowWrite(config))) {
           const choice = await promptWriteBlock(ctx, filePath);
           if (choice === 'abort') {
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.16.3",
+  "version": "0.16.5",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",