pi-landstrip 0.16.7 → 0.16.9

package/README.md

@@ -1,29 +1,44 @@
 # pi-landstrip
 
-![pi-landstrip screenshot](screenshot.png)
+`pi-landstrip` is an extension for [pi](https://pi.dev/) providing a sandbox
+defined with a policy compatible with Anthropic's JSON format. It uses
+[`landstrip`](https://github.com/landstrip/landstrip) to implement the sandbox.
 
-Landlock-based sandboxing for [pi](https://pi.dev/) using
-[`landstrip`](https://github.com/landstrip/landstrip).
+`pi-landstrip` has a default policy [sandbox.json](./sandbox.json), and allows
+the define either or both global or project specific policies.
 
-## Install
+## Installing the extension
 
-```bash
+### Automatic install
+
+```
 pi install npm:pi-landstrip
 ```
 
 This installs `pi-landstrip` and its `@landstrip/landstrip` dependency, which
 includes platform-specific native binaries for Linux, macOS, and Windows.
 
-On unsupported platforms the extension loads but leaves sandboxing disabled.
+### Manual install
 
-## Configure
+Add the extension to `~/.pi/agent/settings.json` (global) or
+`.pi/settings.json` (project):
 
-Create `.pi/sandbox.json` in a project or `~/.pi/agent/sandbox.json` globally.
-Project config takes precedence.
+```json
+{
+  "packages": ["npm:pi-landstrip"]
+}
+```
 
-See [`sandbox.json`](./sandbox.json) for a starter config.
+Alternatively, drop the extension under `~/.pi/agent/extensions/` (global) or
+`.pi/extensions/` (project). See the pi
+[extensions](https://pi.dev/docs/latest/extensions) documentation for details.
 
-Use sandbox config to toggle sandboxing:
+On unsupported platforms the extension loads but leaves sandboxing disabled.
+
+## Disable
+
+Use the `--no-sandbox` flag, or set `enabled` to `false` in the sandbox
+config:
 
 ```json
 {
@@ -31,17 +46,34 @@ Use sandbox config to toggle sandboxing:
 }
 ```
 
-Project config overrides global config.
-The `/sandbox` UI updates the project config when present, otherwise the global config.
+Project config overrides global config. The `/sandbox` UI updates the project
+config when present, otherwise the global config.
+
+## Behavior
+
+When pi asks for a sandboxed permission, the extension emits a host
+notification. After that the extension opens a dialog with the choices to allow
+once, allow for the session, persist for the project, persist globally, or
+reject. The dialog shows the exact path or domain being approved.
+
+Project approvals are written to `.pi/sandbox.json`; global approvals are
+written to `~/.pi/agent/sandbox.json`.
 
-## Usage
+When pi runs a bash command, the extension wraps it in `landstrip`. This
+applies to both the AI `bash` tool calls and manually typed shell-mode commands
+(`!` and `!!`). Network traffic is routed through an allowlist proxy when
+network access is off, and read/write tool access is blocked outside the
+configured filesystem allowlists. The default policy is strict: network access
+is off unless domains are allowed, reads are limited to the project,
+`~/.gitconfig`, and `/dev/null`, and writes are limited to the project and
+`/dev/null`.
 
-Use `/sandbox` inside Pi to show the active config and toggle sandboxing.
+Use `/sandbox` inside pi to show the active config and toggle sandboxing.
 
 ## License
 
 `pi-landstrip` is licensed under `MIT`. See [LICENSE](LICENSE) for more
 information.
 
-The bundled `@landstrip/landstrip` package is licensed under
+The bundled `@landstrip/landstrip` package is licensed separately as
 `Apache-2.0 AND LGPL-2.1-or-later`.

package/index.ts

@@ -2,7 +2,6 @@
 // Copyright (C) Jarkko Sakkinen 2026
 
 import { spawn, spawnSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
 import {
   existsSync,
   mkdirSync,
@@ -20,6 +19,7 @@ import {
   Socket as NetSocket,
 } from 'node:net';
 import { homedir, tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { URL } from 'node:url';
 
@@ -109,24 +109,7 @@ const LANDSTRIP_VERSION = [0, 16, 4] as const;
 const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 
-const DEFAULT_CONFIG: SandboxConfig = {
-  enabled: true,
-  network: {
-    allowNetwork: false,
-    allowLocalBinding: false,
-    allowAllUnixSockets: false,
-    allowUnixSockets: [],
-    allowedDomains: [],
-    deniedDomains: [],
-  },
-  filesystem: {
-    denyRead: ['/Users', '/home'],
-    allowRead: ['.', '~/.gitconfig', '~/.config/git/config', '/dev/null'],
-    allowWrite: ['.', '/dev/null'],
-    denyWrite: ['**/.env', '**/.env.*', '**/*.pem', '**/*.key'],
-  },
-};
-
+const packageDir = dirname(fileURLToPath(import.meta.url));
 type PermissionChoice = 'abort' | 'session' | 'project' | 'global';
 type NotificationLevel = Parameters<ExtensionContext['ui']['notify']>[1];
 
@@ -161,26 +144,32 @@ function loadConfig(cwd: string): SandboxConfig {
   const projectConfigPath = join(cwd, '.pi', 'sandbox.json');
   const globalConfigPath = join(getAgentDir(), 'sandbox.json');
 
-  let globalConfig: SandboxConfigFile = {};
-  let projectConfig: SandboxConfigFile = {};
+  if (!existsSync(globalConfigPath)) {
+    const templatePath = join(packageDir, 'sandbox.json');
+    mkdirSync(dirname(globalConfigPath), { recursive: true });
+    writeFileSync(globalConfigPath, readFileSync(templatePath, 'utf-8'), 'utf-8');
+  }
 
-  if (existsSync(globalConfigPath)) {
-    try {
-      globalConfig = JSON.parse(readFileSync(globalConfigPath, 'utf-8'));
-    } catch (error) {
-      console.error(`Warning: Could not parse ${globalConfigPath}: ${error}`);
-    }
+  let globalConfig: SandboxConfig = JSON.parse(
+    readFileSync(join(packageDir, 'sandbox.json'), 'utf-8'),
+  );
+  try {
+    const override = JSON.parse(readFileSync(globalConfigPath, 'utf-8'));
+    globalConfig = deepMerge(globalConfig, override);
+  } catch (error) {
+    console.error(`Warning: Could not parse ${globalConfigPath}: ${error}`);
   }
 
   if (existsSync(projectConfigPath)) {
     try {
-      projectConfig = JSON.parse(readFileSync(projectConfigPath, 'utf-8'));
+      const projectConfig = JSON.parse(readFileSync(projectConfigPath, 'utf-8'));
+      return deepMerge(globalConfig, projectConfig);
     } catch (error) {
       console.error(`Warning: Could not parse ${projectConfigPath}: ${error}`);
     }
   }
 
-  return deepMerge(deepMerge(DEFAULT_CONFIG, globalConfig), projectConfig);
+  return globalConfig;
 }
 
 function mergeArray(base: string[], override?: string[]): string[] {
@@ -1154,27 +1143,22 @@ export function createLandstripIntegration(
 
   function createSocketPair(): Promise<[NetSocket, NetSocket]> {
     return new Promise((resolve, reject) => {
-      const sockPath = join(tmpdir(), `.landstrip-sock-${randomBytes(8).toString('hex')}`);
       const server = createServer();
       server.on('error', reject);
       let client: NetSocket | null = null;
       server.on('connection', (serverEnd) => {
         server.removeListener('error', reject);
         server.close();
-        try {
-          rmSync(sockPath, { force: true });
-        } catch {
-          /* ok */
-        }
         if (client) {
           client.removeListener('error', reject);
           resolve([client, serverEnd]);
         }
       });
-      server.listen(sockPath, () => {
+      server.listen(0, '127.0.0.1', () => {
+        const addr = server.address() as AddressInfo;
         client = new NetSocket();
         client.on('error', reject);
-        client.connect(sockPath);
+        client.connect(addr.port, '127.0.0.1');
       });
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.16.7",
+  "version": "0.16.9",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",

package/sandbox.json

@@ -12,6 +12,13 @@
     "denyRead": ["/Users", "/home"],
     "allowRead": [".", "~/.gitconfig", "~/.config/git/config", "/dev/null"],
     "allowWrite": [".", "/dev/null"],
-    "denyWrite": ["**/.env", "**/.env.*", "**/*.pem", "**/*.key"]
+    "denyWrite": [
+      "**/.env",
+      "**/.env.*",
+      "**/*.pem",
+      "**/*.key",
+      ".pi/sandbox.json",
+      "~/.pi/agent/sandbox.json"
+    ]
   }
 }