pi-landstrip 0.17.34 → 0.17.35

package/README.md

@@ -16,7 +16,7 @@ The extension includes a shared [sandbox policy](./sandbox.json) and separate
 [agent configuration](./subagents.json). Global and trusted-project files can
 override both.
 
-Process-backed subagents require Pi >= 0.80.6 and < 0.82.0, and Node.js >= 22.19.0.
+Process-backed subagents require Pi >= 0.80.6, and Node.js >= 22.19.0.
 
 ## Installation
 
@@ -46,6 +46,16 @@ Alternatively, place the extension under `~/.pi/agent/extensions/` (global) or
 
 On unsupported platforms the extension loads but leaves sandboxing disabled.
 
+On Windows, Pi's Git Bash/MSYS shell cannot run under LPAC. The packaged policy
+therefore selects standard AppContainer explicitly. This is weaker than LPAC because
+resources granted to `ALL APPLICATION PACKAGES` remain visible; `/sandbox` and the
+status line report the active backend and mode. There is no silent
+LPAC-to-standard fallback.
+
+An optional restricted-user backend supports Git Bash without AppContainer. It
+requires one-time elevated host setup and persistent local accounts and WFP rules;
+see [Windows restricted-user setup](#windows-restricted-user-setup).
+
 ## Disabling
 
 Use the `--no-sandbox` flag, or set `enabled` to `false` in `sandbox.json`:
@@ -61,9 +71,10 @@ processes, but without the outer Landstrip OS sandbox. The extension warns once
 per session. Agent tool permissions still apply, but they are not an OS isolation
 boundary.
 
-Trusted project config overrides global config. `/sandbox` updates a trusted
-project sandbox file when present, otherwise the global file. Pi versions
-without a project-trust API use only global configuration.
+Trusted project config overrides global config except for the Windows backend,
+which can be selected only in the trusted global file. `/sandbox` updates a trusted
+project sandbox file when present, otherwise the global file. Pi versions without a
+project-trust API use only global configuration.
 
 ## Behavior
 
@@ -75,11 +86,12 @@ being approved.
 Project approvals are written to `.pi/sandbox.json`; global approvals are
 written to `~/.pi/agent/sandbox.json`.
 
-The main agent remains a normal Pi process. `pi-landstrip` replaces Bash
-execution, including AI `bash` calls and manually typed shell commands (`!` and
-`!!`), with a Landstrip-wrapped implementation. Network traffic uses an
-allowlist proxy when direct access is disabled. Pi's filesystem tools and plugin
-callbacks remain trusted code outside the Landstrip sandbox.
+The main agent remains a normal Pi process. `pi-landstrip` replaces Bash execution,
+including AI `bash` calls and manually typed shell commands (`!` and `!!`), with a
+Landstrip-wrapped implementation. Network traffic uses an allowlist proxy when
+direct access is disabled and the platform policy permits loopback; otherwise it is
+blocked. Pi's filesystem tools and plugin callbacks remain trusted code outside the
+Landstrip sandbox.
 
 By default, Bash and subagent processes have no direct network access. Reads are
 limited to the project, Git configuration, and `/dev/null`; writes are limited
@@ -132,9 +144,11 @@ The tool accepts the OpenCode task fields:
 Foreground tasks return the child result directly. Background tasks return a
 queued result and deliver completion automatically. Task rows show lifecycle
 state, current activity, tool-call count, elapsed time, and expandable output.
-Use `/subagents` or the task row's `/subagents <id>` command to inspect a child
-transcript. Completed and failed task metadata remains available after reload,
-and persisted sessions can be continued with `task_id`.
+Use `/subagents` to open an inspector with **Agents** and **Sessions** tabs. The
+Agents tab lists every available subagent type and its `built-in`, `global`, or
+`local` source. The Sessions tab inspects child transcripts; task rows can open a
+specific one with `/subagents <id>`. Completed and failed task metadata remains
+available after reload, and persisted sessions can be continued with `task_id`.
 
 Session switching or shutdown stops live workers. After an unclean restart,
 unfinished work is marked interrupted; completed but undelivered background
@@ -162,11 +176,19 @@ Unsupported Pi versions still fail task startup.
   `sandbox.json`, then restart or continue the task in a fresh worker to apply
   additional filesystem access. Main-agent Bash can retry a command, but there
   is no live worker-policy update.
-- **Windows**: AppContainer cannot permit only the loopback proxy port, so
-  domain-proxied worker networking is unavailable and the worker has no network.
-  Setting `network.allowNetwork` to `true` is a degraded mode that permits model
-  access but gives the entire worker unrestricted network access; domain lists
-  are then not a boundary.
+- **Windows AppContainer**: the packaged policy selects standard AppContainer for
+  Pi's Git Bash/MSYS runtime. With `windows.allowLoopback: false` (the default), the
+  extension does not start an unreachable proxy and the worker has no network.
+  Setting `windows.allowLoopback` to `true` enables the domain proxy, but also gives
+  the AppContainer access to every local loopback service, not only the proxy port.
+  Setting `network.allowNetwork` to `true` instead gives the entire worker
+  unrestricted network access; domain lists are then not a boundary. Both opt-ins
+  are explicit security downgrades and produce warnings.
+- **Windows restricted user**: WFP blocks restricted accounts except for the
+  installed proxy port range, so domain-filtered proxying works without a broad
+  loopback exemption. `network.allowNetwork: true` leases a separately provisioned
+  unrestricted account. Filesystem grants are journaled and revoked after every
+  process tree exits.
 
 ### Credentials
 
@@ -182,13 +204,59 @@ first.
 
 Subagent configuration is read from `~/.pi/agent/subagents.json` and, for trusted
 projects, `.pi/subagents.json`. Project values override global values; both are
-merged over the packaged [defaults](./subagents.json). Sandbox policy remains in
-`~/.pi/agent/sandbox.json` and `.pi/sandbox.json`. Pi's `settings.json` contains
-only normal Pi settings, such as the `pi-landstrip` package entry.
+merged over the packaged [defaults](./subagents.json). The packaged subagent types
+are `explore`, `general`, and the OpenCode-compatible `scout` reconnaissance agent.
+
+Sandbox policy remains in `~/.pi/agent/sandbox.json` and `.pi/sandbox.json`. Pi's
+`settings.json` contains only normal Pi settings, such as the `pi-landstrip` package
+entry.
 
 `subagents.json` accepts only top-level `maxSubagents` and `subagents`; sandbox
 fields belong in `sandbox.json`.
 
+The Windows sandbox fields are:
+
+```json
+{
+  "windows": {
+    "backend": "appContainer",
+    "appContainerMode": "standard",
+    "allowLoopback": false
+  }
+}
+```
+
+`backend` is `"appContainer"` or `"restrictedUser"`. It is a trusted host setting:
+only `~/.pi/agent/sandbox.json` can change it, and project configuration cannot
+override it. `appContainerMode` is `"lpac"` or `"standard"`; core Landstrip defaults
+to LPAC, while the Pi package defaults to standard mode for Git Bash compatibility.
+`allowLoopback` is independently opt-in and applies only to AppContainer.
+
+### Windows restricted-user setup
+
+Provision the backend once before selecting it in global configuration:
+
+```powershell
+npx @landstrip/landstrip windows setup
+npx @landstrip/landstrip windows status
+```
+
+Setup requests UAC elevation and defaults to eight restricted-network accounts, two
+unrestricted-network accounts, and proxy ports 60080-60111. Run
+`npx @landstrip/landstrip windows setup --help` for pool and port options. Then set
+`"backend": "restrictedUser"` in `~/.pi/agent/sandbox.json` and restart Pi.
+
+The extension checks installation health and reads the configured proxy range before
+launching a restricted worker. Restricted-user mode does not support
+`windows.allowLoopback` or `network.allowLocalBinding`. Remove the persistent
+accounts, WFP rules, runner, and recovered per-run ACL grants with:
+
+```powershell
+npx @landstrip/landstrip windows uninstall
+```
+
+A subagent configuration example follows:
+
 ```json
 {
   "maxSubagents": 2,

package/dist/index.ts

@@ -19,7 +19,7 @@ import {
   Socket as NetSocket
 } from "node:net";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join5, resolve as resolve2 } from "node:path";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join5, parse, resolve as resolve2 } from "node:path";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { fileURLToPath as fileURLToPath3, URL } from "node:url";
 import {
@@ -195,6 +195,12 @@ function mergeValue(base, override) {
   }
   return override;
 }
+function recordAgentSources(sources, config, source) {
+  if (!isRecord2(config.subagents) || !isRecord2(config.subagents.agent))
+    return;
+  for (const name of Object.keys(config.subagents.agent))
+    sources.set(name, source);
+}
 function getPiConfigPaths(cwd, fileName, agentDir = getAgentDir()) {
   return {
     globalPath: join2(agentDir, fileName),
@@ -217,17 +223,23 @@ async function setMaxSubagentsConfigForScope(cwd, maxSubagents, scope, agentDir
 }
 function loadLandstripConfig(cwd, includeProject = true, agentDir = getAgentDir()) {
   const { globalPath, projectPath } = getPiConfigPaths(cwd, "subagents.json", agentDir);
-  let config = readConfig(join2(packageDir, "subagents.json"));
-  config = mergeValue(config, readConfig(globalPath));
-  if (includeProject) {
-    config = mergeValue(config, readConfig(projectPath));
-  }
+  const builtInConfig = readConfig(join2(packageDir, "subagents.json"));
+  const globalConfig = readConfig(globalPath);
+  const projectConfig = includeProject ? readConfig(projectPath) : undefined;
+  const agentSources = new Map;
+  recordAgentSources(agentSources, builtInConfig, "built-in");
+  recordAgentSources(agentSources, globalConfig, "global");
+  if (projectConfig)
+    recordAgentSources(agentSources, projectConfig, "local");
+  let config = mergeValue(builtInConfig, globalConfig);
+  if (projectConfig)
+    config = mergeValue(config, projectConfig);
   if (!Number.isInteger(config.maxSubagents) || (config.maxSubagents ?? -1) < 0 || (config.maxSubagents ?? MAX_SUBAGENTS + 1) > MAX_SUBAGENTS) {
     throw new Error(`maxSubagents must be an integer from 0 to ${MAX_SUBAGENTS}`);
   }
   if (!isRecord2(config.subagents))
     throw new Error("subagents must be an object");
-  return config;
+  return { ...config, agentSources };
 }
 
 // agents.ts
@@ -295,7 +307,7 @@ function legacyConfigWarnings(piAgentDir) {
     return [];
   }
 }
-function normalizeAgent(name, raw) {
+function normalizeAgent(name, raw, source) {
   for (const field of ["description", "prompt", "model", "variant"]) {
     if (raw[field] !== undefined && typeof raw[field] !== "string") {
       throw new Error(`agent ${name} ${field} must be a string`);
@@ -333,6 +345,7 @@ function normalizeAgent(name, raw) {
   }
   return {
     name,
+    source,
     description: typeof raw.description === "string" ? raw.description : undefined,
     prompt: typeof raw.prompt === "string" ? raw.prompt : "",
     mode: raw.mode ?? "all",
@@ -352,10 +365,12 @@ function loadAgentCatalog(cwd, piAgentDir = getAgentDir2(), includeProject = tru
   const diagnostics = [];
   let maxSubagents = 0;
   let subagents = {};
+  let agentSources = new Map;
   try {
     const config = loadLandstripConfig(cwd, includeProject, piAgentDir);
     maxSubagents = config.maxSubagents;
     subagents = config.subagents;
+    agentSources = new Map(config.agentSources);
   } catch (error) {
     diagnostics.push(formatError(error));
   }
@@ -370,7 +385,7 @@ function loadAgentCatalog(cwd, piAgentDir = getAgentDir2(), includeProject = tru
         continue;
       }
       try {
-        const agent = normalizeAgent(name, value);
+        const agent = normalizeAgent(name, value, agentSources.get(name) ?? "built-in");
         if (agent)
           normalized.set(name, agent);
       } catch (error) {
@@ -866,12 +881,11 @@ var INSPECTOR_BODY_LINES = 16;
 var SUPPORTED_PI_MAJOR = 0;
 var MIN_SUPPORTED_PI_MINOR = 80;
 var MIN_SUPPORTED_PI_PATCH = 6;
-var MAX_SUPPORTED_PI_MINOR = 81;
 var cachedPiPackage;
 var piPackageResolved = false;
 function isSupportedPiVersion(version) {
   const [major, minor = -1, patch = -1] = version;
-  return version.length === 3 && Number.isInteger(major) && Number.isInteger(minor) && Number.isInteger(patch) && major === SUPPORTED_PI_MAJOR && minor >= MIN_SUPPORTED_PI_MINOR && minor <= MAX_SUPPORTED_PI_MINOR && (minor > MIN_SUPPORTED_PI_MINOR || patch >= MIN_SUPPORTED_PI_PATCH);
+  return version.length === 3 && Number.isInteger(major) && Number.isInteger(minor) && Number.isInteger(patch) && major === SUPPORTED_PI_MAJOR && (minor > MIN_SUPPORTED_PI_MINOR || minor === MIN_SUPPORTED_PI_MINOR && patch >= MIN_SUPPORTED_PI_PATCH);
 }
 function resolvePiPackage() {
   if (piPackageResolved)
@@ -1483,14 +1497,18 @@ ${this.primaryAgent.prompt}` };
       ctx.ui.notify("Subagent inspection is available in TUI mode", "warning");
       return;
     }
+    const catalog = this.getAgentCatalog(ctx);
+    for (const warning of catalog.warnings)
+      ctx.ui.notify(warning, "warning");
+    for (const diagnostic of catalog.diagnostics)
+      ctx.ui.notify(diagnostic, "warning");
+    const agents = availableSubagents(catalog).sort((a, b) => a.name.localeCompare(b.name));
     const tasks = [...this.tasks.values()];
-    if (tasks.length === 0) {
-      ctx.ui.notify("No subagent sessions in this session", "info");
-      return;
-    }
     const requested = args.trim();
-    let selected = requested ? tasks.findIndex((task) => task.id === requested || task.id.startsWith(requested)) : 0;
-    if (selected < 0) {
+    let tab = requested ? "sessions" : "agents";
+    let selectedAgent = 0;
+    let selectedTask = requested ? tasks.findIndex((task) => task.id === requested || task.id.startsWith(requested)) : 0;
+    if (selectedTask < 0) {
       ctx.ui.notify(`Unknown subagent task: ${requested}`, "error");
       return;
     }
@@ -1499,27 +1517,54 @@ ${this.primaryAgent.prompt}` };
     await ctx.ui.custom((tui, theme, _keybindings, done) => ({
       render: (width) => {
         const contentWidth = Math.max(1, width - 4);
-        const box = (title, lines2) => [
-          boxTop(theme, width, title),
+        const box = (lines2) => [
+          boxTop(theme, width, "Subagents"),
           ...lines2.map((line) => boxRow(theme, width, line)),
           boxBottom(theme, width)
         ];
-        if (!detail) {
-          const start = Math.max(0, Math.min(selected - 6, tasks.length - 12));
-          const shown2 = tasks.slice(start, start + 12);
-          const lines2 = [];
-          for (const [offset, task2] of shown2.entries()) {
+        const tabLabel = (label, active) => active ? theme.fg("accent", theme.bold(`[${label}]`)) : theme.fg("muted", label);
+        const tabs = `${tabLabel("Agents", tab === "agents")}  ${tabLabel(`Sessions ${tasks.length}`, tab === "sessions")}`;
+        if (tab === "agents") {
+          const start = Math.max(0, Math.min(selectedAgent - 5, agents.length - 11));
+          const shown2 = agents.slice(start, start + 11);
+          const nameWidth = Math.min(24, Math.max(5, ...agents.map((agent) => agent.name.length + 1)));
+          const lines2 = [
+            tabs,
+            "",
+            `  ${"AGENT".padEnd(nameWidth)} ${"SOURCE".padEnd(8)} DESCRIPTION`
+          ];
+          for (const [offset, agent] of shown2.entries()) {
             const index = start + offset;
-            const cursor = index === selected ? theme.fg("accent", "›") : " ";
-            const indent = "  ".repeat(Math.max(0, task2.depth - 1));
-            lines2.push(`${cursor} ${indent}${taskState(theme, task2)} ${theme.fg("accent", `@${task2.agent}`)} ${theme.fg("text", task2.description)} ${theme.fg("dim", task2.id.slice(0, 8))}`);
+            const cursor = index === selectedAgent ? theme.fg("accent", "›") : " ";
+            const name = `@${agent.name}`.padEnd(nameWidth);
+            const description = `${agent.description ?? "No description"}${agent.hidden ? " [hidden]" : ""}`;
+            lines2.push(`${cursor} ${theme.fg("accent", name)} ${theme.fg("dim", agent.source.padEnd(8))} ${theme.fg("text", description)}`);
+          }
+          if (agents.length === 0)
+            lines2.push("  No subagent types are configured.");
+          lines2.push("", theme.fg("dim", "↑↓ select  tab/→ sessions  esc close"));
+          return box(lines2);
+        }
+        if (!detail) {
+          const lines2 = [tabs, ""];
+          if (tasks.length === 0) {
+            lines2.push("No subagent sessions in this session.");
+          } else {
+            const start = Math.max(0, Math.min(selectedTask - 5, tasks.length - 11));
+            const shown2 = tasks.slice(start, start + 11);
+            for (const [offset, task2] of shown2.entries()) {
+              const index = start + offset;
+              const cursor = index === selectedTask ? theme.fg("accent", "›") : " ";
+              const indent = "  ".repeat(Math.max(0, task2.depth - 1));
+              lines2.push(`${cursor} ${indent}${taskState(theme, task2)} ${theme.fg("accent", `@${task2.agent}`)} ${theme.fg("text", task2.description)} ${theme.fg("dim", task2.id.slice(0, 8))}`);
+            }
           }
-          lines2.push("", theme.fg("dim", "↑↓ select  enter inspect  esc close"));
-          return box("Subagent Sessions", lines2);
+          lines2.push("", theme.fg("dim", "↑↓ select  enter inspect  tab/← agents  esc close"));
+          return box(lines2);
         }
-        const task = tasks[selected];
+        const task = tasks[selectedTask];
         if (!task)
-          return [];
+          return box([tabs, "", "No subagent sessions in this session."]);
         const siblings = tasks.filter((candidate) => candidate.parentTaskId === task.parentTaskId);
         const siblingIndex = siblings.findIndex((candidate) => candidate.id === task.id);
         const transcript = taskTranscript(task).flatMap((line) => line.split(`
@@ -1535,28 +1580,53 @@ ${this.primaryAgent.prompt}` };
           duration
         ].filter(Boolean);
         const lines = [
+          tabs,
+          "",
           `${theme.fg("accent", theme.bold(`@${task.agent}`))} ${theme.fg("text", task.description)}`,
           `${taskState(theme, task)} ${theme.fg("dim", metrics.join(" · "))}`,
           "",
           ...shown.map((line) => theme.fg("toolOutput", line))
         ];
-        while (lines.length < INSPECTOR_BODY_LINES + 3)
+        while (lines.length < INSPECTOR_BODY_LINES + 5)
           lines.push("");
         if (transcript.length > INSPECTOR_BODY_LINES) {
           lines.push(theme.fg("dim", `${scroll + 1}-${scroll + shown.length} of ${transcript.length}`));
         }
-        lines.push(theme.fg("dim", "Parent p/backspace  Prev ←  Next →  ↑↓ scroll  r refresh  esc back"));
-        return box("Subagent Session", lines.map((line) => truncateToWidth2(line, contentWidth)));
+        lines.push(theme.fg("dim", "Parent p/backspace  Prev ←  Next →  ↑↓ scroll  tab agents  esc back"));
+        return box(lines.map((line) => truncateToWidth2(line, contentWidth)));
       },
       handleInput: (data) => {
+        if (matchesKey(data, "tab")) {
+          tab = tab === "agents" ? "sessions" : "agents";
+          detail = false;
+          scroll = 0;
+          tui.requestRender();
+          return;
+        }
+        if (tab === "agents") {
+          if (matchesKey(data, "escape") || matchesKey(data, "ctrl+c"))
+            done();
+          else if (matchesKey(data, "up"))
+            selectedAgent = Math.max(0, selectedAgent - 1);
+          else if (matchesKey(data, "down") && agents.length > 0) {
+            selectedAgent = Math.min(agents.length - 1, selectedAgent + 1);
+          } else if (matchesKey(data, "right")) {
+            tab = "sessions";
+          } else
+            return;
+          tui.requestRender();
+          return;
+        }
         if (!detail) {
           if (matchesKey(data, "escape") || matchesKey(data, "ctrl+c"))
             done();
+          else if (matchesKey(data, "left"))
+            tab = "agents";
           else if (matchesKey(data, "up"))
-            selected = Math.max(0, selected - 1);
-          else if (matchesKey(data, "down"))
-            selected = Math.min(tasks.length - 1, selected + 1);
-          else if (matchesKey(data, "return")) {
+            selectedTask = Math.max(0, selectedTask - 1);
+          else if (matchesKey(data, "down") && tasks.length > 0) {
+            selectedTask = Math.min(tasks.length - 1, selectedTask + 1);
+          } else if (matchesKey(data, "return") && tasks.length > 0) {
             detail = true;
             scroll = 0;
           } else
@@ -1564,7 +1634,7 @@ ${this.primaryAgent.prompt}` };
           tui.requestRender();
           return;
         }
-        const task = tasks[selected];
+        const task = tasks[selectedTask];
         if (!task)
           return;
         if (matchesKey(data, "escape")) {
@@ -1579,7 +1649,7 @@ ${this.primaryAgent.prompt}` };
         } else if (data === "p" || matchesKey(data, "backspace")) {
           const parentIndex = task.parentTaskId ? tasks.findIndex((candidate) => candidate.id === task.parentTaskId) : -1;
           if (parentIndex >= 0)
-            selected = parentIndex;
+            selectedTask = parentIndex;
           else
             detail = false;
           scroll = 0;
@@ -1589,7 +1659,7 @@ ${this.primaryAgent.prompt}` };
           const offset = matchesKey(data, "left") ? -1 : 1;
           const sibling = siblings[siblingIndex + offset];
           if (sibling)
-            selected = tasks.indexOf(sibling);
+            selectedTask = tasks.indexOf(sibling);
           scroll = 0;
         } else if (data !== "r")
           return;
@@ -2188,7 +2258,7 @@ ${catalog.diagnostics.join(`
       throw new Error("Unable to resolve the running Pi package; process-backed subagents are unavailable");
     }
     if (!isSupportedPiVersion(pkg.version)) {
-      throw new Error(`Process-backed subagents require Pi >=0.80.6 <0.82.0; found ${pkg.version.join(".")}`);
+      throw new Error(`Process-backed subagents require Pi >=0.80.6; found ${pkg.version.join(".")}`);
     }
   }
   async handleWorkerRequest(task, rules, ctx, request) {
@@ -2575,7 +2645,9 @@ function loadSandboxConfig(cwd, includeProject) {
   if (includeProject && existsSync4(projectConfigPath)) {
     try {
       const projectConfig = JSON.parse(readFileSync4(projectConfigPath, "utf-8"));
-      return deepMerge(globalConfig, projectConfig);
+      const merged = deepMerge(globalConfig, projectConfig);
+      merged.windows.backend = globalConfig.windows.backend;
+      return merged;
     } catch (error) {
       console.error(`Warning: Could not parse ${projectConfigPath}: ${error}`);
     }
@@ -2590,6 +2662,7 @@ function mergeArray(base, override) {
 function deepMerge(base, overrides) {
   const network = overrides.network;
   const filesystem = overrides.filesystem;
+  const windows = overrides.windows;
   return {
     enabled: overrides.enabled ?? base.enabled,
     network: {
@@ -2605,9 +2678,43 @@ function deepMerge(base, overrides) {
       allowRead: mergeArray(base.filesystem.allowRead, filesystem?.allowRead),
       allowWrite: mergeArray(base.filesystem.allowWrite, filesystem?.allowWrite),
       denyWrite: mergeArray(base.filesystem.denyWrite, filesystem?.denyWrite)
+    },
+    windows: {
+      backend: windows?.backend ?? base.windows.backend,
+      appContainerMode: windows?.appContainerMode ?? base.windows.appContainerMode,
+      allowLoopback: windows?.allowLoopback ?? base.windows.allowLoopback
     }
   };
 }
+function windowsBackendArgs(config) {
+  if (process.platform !== "win32")
+    return [];
+  const backend = config.windows.backend === "restrictedUser" ? "restricted-user" : "app-container";
+  return ["--windows-backend", backend];
+}
+function shouldStartProxy(config) {
+  if (config.network.allowNetwork)
+    return false;
+  return process.platform !== "win32" || config.windows.backend === "restrictedUser" || config.windows.allowLoopback;
+}
+function restrictedUserProxyPortRange(config) {
+  if (process.platform !== "win32" || config.windows.backend !== "restrictedUser")
+    return;
+  const result = spawnSync(binaryPath(), ["windows", "status"], {
+    encoding: "utf-8",
+    windowsHide: true
+  });
+  if (result.error)
+    throw result.error;
+  if (result.status !== 0) {
+    throw new Error(result.stderr.trim() || "Restricted-user backend status check failed");
+  }
+  const status = JSON.parse(result.stdout);
+  if (status.installed !== true || status.healthy !== true || !Number.isInteger(status.proxyPortLow) || !Number.isInteger(status.proxyPortHigh) || status.proxyPortLow < 1 || status.proxyPortHigh < status.proxyPortLow) {
+    throw new Error('The Windows restricted-user backend is not installed or healthy. Run "landstrip windows setup".');
+  }
+  return { low: status.proxyPortLow, high: status.proxyPortHigh };
+}
 function getConfigPaths(cwd) {
   return getPiConfigPaths(cwd, "sandbox.json");
 }
@@ -2717,10 +2824,13 @@ function canonicalizePath(filePath, cwd) {
     }
   }
 }
+function normalizePathSeparators(path) {
+  return process.platform === "win32" ? path.replaceAll("\\", "/") : path;
+}
 function matchesPattern(filePath, patterns, cwd) {
-  const abs = canonicalizePath(filePath, cwd);
+  const abs = normalizePathSeparators(canonicalizePath(filePath, cwd));
   return patterns.some((pattern) => {
-    const absPattern = pattern.includes("*") ? expandPath(pattern, cwd) : canonicalizePath(pattern, cwd);
+    const absPattern = normalizePathSeparators(pattern.includes("*") ? expandPath(pattern, cwd) : canonicalizePath(pattern, cwd));
     if (pattern.includes("*")) {
       const escaped = absPattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\/|\*\*|\*/g, (token) => token === "**/" ? "(?:.*/)?" : token === "**" ? ".*" : "[^/]*");
       return new RegExp(`^${escaped}$`).test(abs);
@@ -2730,16 +2840,20 @@ function matchesPattern(filePath, patterns, cwd) {
   });
 }
 function normalizeBlockedPath(path, cwd) {
-  return canonicalizePath(isAbsolute2(path) ? path : join5(cwd, path), cwd);
+  const nativePath = process.platform === "win32" && /^\/[a-zA-Z](?:\/|$)/.test(path) ? `${path[1]}:${path.slice(2)}` : path;
+  return canonicalizePath(isAbsolute2(nativePath) ? nativePath : join5(cwd, nativePath), cwd);
 }
 function pathUnderDirectory(filePath, dir) {
-  if (filePath === dir)
+  const normalizedFilePath = normalizePathSeparators(filePath);
+  const normalizedDir = normalizePathSeparators(dir);
+  if (normalizedFilePath === normalizedDir)
     return true;
-  const sep2 = dir.endsWith("/") ? "" : "/";
-  return filePath.startsWith(dir + sep2);
+  const sep2 = normalizedDir.endsWith("/") ? "" : "/";
+  return normalizedFilePath.startsWith(normalizedDir + sep2);
 }
 function sessionScopeFor(filePath, baseDirectory) {
   const dir = dirname3(filePath);
+  const normalizedDir = normalizePathSeparators(dir);
   const home = homedir3();
   const boundaries = new Set;
   if (home)
@@ -2750,12 +2864,13 @@ function sessionScopeFor(filePath, baseDirectory) {
       boundaries.add(realHome);
   } catch {}
   for (const boundary of boundaries) {
+    const normalizedBoundary = normalizePathSeparators(boundary);
     if (pathUnderDirectory(dir, boundary)) {
-      const rest = dir.slice(boundary.length).replace(/^\/+/, "");
+      const rest = normalizedDir.slice(normalizedBoundary.length).replace(/^\/+/, "");
       const first = rest.split("/")[0];
       if (!first)
         return filePath;
-      return boundary.endsWith("/") ? boundary + first : `${boundary}/${first}`;
+      return join5(boundary, first);
     }
   }
   if (pathUnderDirectory(dir, baseDirectory))
@@ -2781,7 +2896,7 @@ function readAllowed(path, allowRead, denyRead, cwd) {
 }
 function isPathLike(value) {
   const trimmed = value.trim();
-  return trimmed === "~" || trimmed.startsWith("/") || trimmed.startsWith("~/") || trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith(".") || trimmed.includes("/");
+  return trimmed === "~" || trimmed.startsWith("/") || trimmed.startsWith("\\\\") || /^[a-zA-Z]:[\\/]/.test(trimmed) || trimmed.startsWith("~/") || trimmed.startsWith("~\\") || trimmed.startsWith("./") || trimmed.startsWith(".\\") || trimmed.startsWith("../") || trimmed.startsWith("..\\") || trimmed.startsWith(".") || trimmed.includes("/") || trimmed.includes("\\");
 }
 function normalizePathMatch(value, cwd) {
   return isPathLike(value) ? normalizeBlockedPath(value, cwd) : null;
@@ -2803,28 +2918,27 @@ function extractBlockedPath(trapOutput, cwd) {
   return null;
 }
 function extractNativeDeniedPath(output, cwd) {
-  let match = output.match(/['"]([^'"\n]+)['"]:\s+(?:Operation not permitted|Permission denied)/);
+  const denial = String.raw`(?:Access is denied\.?|Operation not permitted|Permission denied)`;
+  let match = output.match(new RegExp(String.raw`['"]([^'"\n]+)['"][^\r\n]{0,120}${denial}`, "i"));
   if (match)
     return normalizePathMatch(match[1], cwd);
-  match = output.match(/(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/);
+  match = output.match(new RegExp(String.raw`(?:^|:\s+)((?:[a-zA-Z]:[\\/]|\\\\|/|\.{1,2}[\\/])[^\r\n]*?):\s+${denial}$`, "im"));
   if (match)
     return normalizePathMatch(match[1], cwd);
-  match = output.match(/^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: (?:Operation not permitted|Permission denied)$/m);
+  match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: ${denial}$`, "im"));
   if (match)
     return normalizePathMatch(match[1], cwd);
-  match = output.match(/^[a-zA-Z0-9_-]+: (\/[^:\n]+): (?:Operation not permitted|Permission denied)$/m);
-  if (match)
-    return normalizeBlockedPath(match[1], cwd);
   return null;
 }
 function extractNativeWriteDeniedPath(output, cwd) {
-  let match = output.match(/(?:[Uu]nable to create|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\n]*['"]([^'"\n]+)['"]:\s+(?:Operation not permitted|Permission denied)/m);
+  const denial = String.raw`(?:Access is denied\.?|Operation not permitted|Permission denied)`;
+  let match = output.match(new RegExp(String.raw`(?:[Uu]nable to create|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\n]*['"]([^'"\n]+)['"][^\r\n]{0,120}${denial}`, "im"));
   if (match)
     return normalizePathMatch(match[1], cwd);
-  match = output.match(/^[a-zA-Z0-9_-]+: cannot create(?: directory)? '?([^'\n]+?)'?(?: for writing)?: (?:Operation not permitted|Permission denied)$/m);
+  match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: cannot create(?: directory)? '?([^'\n]+?)'?(?: for writing)?: ${denial}$`, "im"));
   if (match)
     return normalizePathMatch(match[1], cwd);
-  match = output.match(/^[a-zA-Z0-9_-]+: couldn't open temporary file (\/[^:\n]+): (?:Operation not permitted|Permission denied)$/m);
+  match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: couldn't open temporary file ((?:[a-zA-Z]:[\\/]|\\\\|/)[^\r\n]*?): ${denial}$`, "im"));
   if (match)
     return normalizePathMatch(match[1], cwd);
   return null;
@@ -3010,7 +3124,7 @@ function landstripDisplayPath() {
     return "unavailable";
   }
 }
-function writeEnvFile(env, proxyPort) {
+function writeEnvFile(env, proxyPort, proxyToken) {
   const lines = [];
   for (const [key, value] of Object.entries(env)) {
     if (value === undefined)
@@ -3021,7 +3135,8 @@ function writeEnvFile(env, proxyPort) {
     lines.push(`export ${key}='${escaped}'`);
   }
   if (proxyPort !== null) {
-    const url = `http://127.0.0.1:${proxyPort}`;
+    const credentials = proxyToken === undefined ? "" : `landstrip:${proxyToken}@`;
+    const url = `http://${credentials}127.0.0.1:${proxyPort}`;
     for (const name of PROXY_ENVIRONMENT_VARIABLES) {
       lines.push(`export ${name}='${url}'`);
     }
@@ -3208,11 +3323,45 @@ function createLandstripIntegration(options = {}) {
   function getEffectiveAllowedDomains(config, allowances) {
     return mergeAllowances(config.network.allowedDomains, sessionAllowedDomains, allowances?.domains);
   }
-  function getEffectiveAllowRead(config, allowances) {
-    return mergeAllowances(config.filesystem.allowRead, sessionAllowedReadPaths, allowances?.readPaths);
+  function getEffectiveAllowRead(config, cwd, allowances) {
+    const paths = mergeAllowances(config.filesystem.allowRead, sessionAllowedReadPaths, allowances?.readPaths);
+    if (process.platform !== "win32")
+      return paths;
+    return paths.filter((path) => !path.startsWith("/") && (path.includes("*") || existsSync4(expandPath(path, cwd))));
   }
   function getEffectiveAllowWrite(config, allowances) {
-    return mergeAllowances(config.filesystem.allowWrite, sessionAllowedWritePaths, allowances?.writePaths);
+    const paths = mergeAllowances(config.filesystem.allowWrite, sessionAllowedWritePaths, allowances?.writePaths);
+    return process.platform === "win32" ? paths.filter((path) => !path.startsWith("/")) : paths;
+  }
+  function getEffectiveDenyRead(config, cwd) {
+    if (process.platform !== "win32")
+      return config.filesystem.denyRead;
+    const volumeRoot = parse(resolve2(cwd)).root;
+    return [...new Set([...config.filesystem.denyRead, volumeRoot])];
+  }
+  function hasBaselineWindowsApplicationAccess(filePath) {
+    const normalizedPath = normalizePathSeparators(resolve2(filePath)).toLowerCase();
+    const systemRoots = [
+      process.env.ProgramFiles,
+      process.env["ProgramFiles(x86)"],
+      process.env.ProgramW6432,
+      process.env.SystemRoot
+    ];
+    return systemRoots.some((root) => {
+      if (!root)
+        return false;
+      return pathUnderDirectory(normalizedPath, normalizePathSeparators(resolve2(root)).toLowerCase());
+    });
+  }
+  function withWindowsProcessReadAccess(allowances, command, cwd, additionalPaths = []) {
+    if (process.platform !== "win32")
+      return allowances;
+    const executable = resolve2(cwd, command);
+    const executablePaths = hasBaselineWindowsApplicationAccess(executable) ? [] : [executable];
+    return {
+      ...allowances,
+      readPaths: [...new Set([...allowances.readPaths, ...executablePaths, ...additionalPaths])]
+    };
   }
   async function applyDomainChoice(choice, domain, cwd, allowances) {
     const { globalPath, projectPath } = getConfigPaths(cwd);
@@ -3275,11 +3424,12 @@ function createLandstripIntegration(options = {}) {
         ...proxyPort !== null ? { httpProxyPort: proxyPort } : {}
       },
       filesystem: {
-        denyRead: config.filesystem.denyRead,
-        allowRead: getEffectiveAllowRead(config, allowances),
+        denyRead: getEffectiveDenyRead(config, cwd),
+        allowRead: getEffectiveAllowRead(config, cwd, allowances),
         allowWrite: getEffectiveAllowWrite(config, allowances),
         denyWrite: config.filesystem.denyWrite
-      }
+      },
+      windows: config.windows
     };
   }
   function writePolicyFile(cwd, proxyPort, allowances) {
@@ -3289,7 +3439,7 @@ function createLandstripIntegration(options = {}) {
 `, "utf-8");
     return { dir, path };
   }
-  function startProxy(ctx, allowances, signal, authorization) {
+  function startProxy(ctx, allowances, signal, authorization, portRange) {
     const sockets = new Set;
     async function domainAllowed(domain) {
       const config = loadConfig(ctx.cwd);
@@ -3421,24 +3571,33 @@ function createLandstripIntegration(options = {}) {
     const server = createServer(handleClient);
     let stopped = false;
     return new Promise((resolve3, reject) => {
-      server.on("error", reject);
-      server.listen(0, "127.0.0.1", () => {
-        server.removeListener("error", reject);
-        const address = server.address();
-        resolve3({
-          port: address.port,
-          stop: () => new Promise((done) => {
-            if (stopped) {
-              done();
-              return;
-            }
-            stopped = true;
-            for (const socket of sockets)
-              socket.destroy();
-            server.close(() => done());
-          })
+      const listen = (port) => {
+        server.once("error", (error) => {
+          if (error.code === "EADDRINUSE" && portRange && port < portRange.high) {
+            listen(port + 1);
+            return;
+          }
+          reject(error);
         });
-      });
+        server.listen(port, "127.0.0.1", () => {
+          server.removeAllListeners("error");
+          const address = server.address();
+          resolve3({
+            port: address.port,
+            stop: () => new Promise((done) => {
+              if (stopped) {
+                done();
+                return;
+              }
+              stopped = true;
+              for (const socket of sockets)
+                socket.destroy();
+              server.close(() => done());
+            })
+          });
+        });
+      };
+      listen(portRange?.low ?? 0);
     });
   }
   function createSocketPair() {
@@ -3479,7 +3638,7 @@ function createLandstripIntegration(options = {}) {
     }
     const path = normalizeBlockedPath(trap.path, cwd);
     const config = loadConfig(cwd);
-    const allowed = trap.operation === "read" ? readAllowed(path, getEffectiveAllowRead(config, allowances), config.filesystem.denyRead, cwd) : !matchesPattern(path, config.filesystem.denyWrite, cwd) && !shouldPromptForWrite(path, getEffectiveAllowWrite(config, allowances), cwd);
+    const allowed = trap.operation === "read" ? readAllowed(path, getEffectiveAllowRead(config, cwd, allowances), config.filesystem.denyRead, cwd) : !matchesPattern(path, config.filesystem.denyWrite, cwd) && !shouldPromptForWrite(path, getEffectiveAllowWrite(config, allowances), cwd);
     if (allowed)
       return { action: "allow" };
     if (trap.operation === "write" && matchesPattern(path, config.filesystem.denyWrite, cwd)) {
@@ -3599,10 +3758,11 @@ function createLandstripIntegration(options = {}) {
       writePaths: [...options2.writePaths],
       targets: []
     };
+    const processAllowances = withWindowsProcessReadAccess(allowances, options2.command, options2.cwd);
     const config = loadConfig(options2.cwd);
     const proxyToken = randomBytes(32).toString("base64url");
     const proxyAuthorization = `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString("base64")}`;
-    const proxy = config.network.allowNetwork ? null : await startProxy(options2.ctx, allowances, options2.signal, proxyAuthorization);
+    const proxy = shouldStartProxy(config) ? await startProxy(options2.ctx, processAllowances, options2.signal, proxyAuthorization, restrictedUserProxyPortRange(config)) : null;
     let policy;
     let trapSocket;
     let childEnd;
@@ -3610,11 +3770,13 @@ function createLandstripIntegration(options = {}) {
     try {
       if (options2.signal?.aborted)
         throw new Error("Task cancelled");
-      policy = writePolicyFile(options2.cwd, proxy?.port ?? null, allowances);
-      [trapSocket, childEnd] = await createSocketPair();
-      if (options2.signal?.aborted)
-        throw new Error("Task cancelled");
-      attachWorkerTrap(trapSocket, options2.ctx, options2.cwd, allowances, options2.signal);
+      policy = writePolicyFile(options2.cwd, proxy?.port ?? null, processAllowances);
+      if (process.platform !== "win32") {
+        [trapSocket, childEnd] = await createSocketPair();
+        if (options2.signal?.aborted)
+          throw new Error("Task cancelled");
+        attachWorkerTrap(trapSocket, options2.ctx, options2.cwd, processAllowances, options2.signal);
+      }
     } catch (error) {
       trapSocket?.destroy();
       childEnd?.destroy();
@@ -3624,6 +3786,7 @@ function createLandstripIntegration(options = {}) {
       throw error;
     }
     const workerPolicy = policy;
+    const workerTrapSocket = trapSocket;
     const workerChildEnd = childEnd;
     const workerEnv = { ...options2.env };
     if (proxy) {
@@ -3643,14 +3806,24 @@ function createLandstripIntegration(options = {}) {
       if (spawned)
         throw new Error("Prepared process can only be spawned once");
       spawned = true;
-      const child = spawn2(binaryPath(), ["--trap-fd", "3", "-p", workerPolicy.path, options2.command, ...options2.args], {
+      const landstripArgs = [
+        ...windowsBackendArgs(config),
+        "-p",
+        workerPolicy.path,
+        options2.command,
+        ...options2.args
+      ];
+      const stdio = workerChildEnd ? ["pipe", "pipe", "pipe", workerChildEnd] : ["pipe", "pipe", "pipe"];
+      if (workerChildEnd)
+        landstripArgs.unshift("--trap-fd", "3");
+      const child = spawn2(binaryPath(), landstripArgs, {
         ...spawnOptions,
         cwd: options2.cwd,
         env: workerEnv,
         detached: true,
-        stdio: ["pipe", "pipe", "pipe", workerChildEnd]
+        stdio
       });
-      workerChildEnd.destroy();
+      workerChildEnd?.destroy();
       patchProcessGroupKill(child);
       preparedChild = child;
       return child;
@@ -3665,8 +3838,8 @@ function createLandstripIntegration(options = {}) {
         disposePromise ??= (async () => {
           disposed = true;
           await stopPreparedChild(preparedChild);
-          trapSocket.destroy();
-          workerChildEnd.destroy();
+          workerTrapSocket?.destroy();
+          workerChildEnd?.destroy();
           rmSync2(workerPolicy.dir, { recursive: true, force: true });
           await proxy?.stop();
         })();
@@ -3692,10 +3865,12 @@ function createLandstripIntegration(options = {}) {
           throw new Error(`Working directory does not exist: ${cwd}`);
         const { shell, args } = getShellConfig(SettingsManager.create(cwd).getShellPath());
         const config = loadConfig(cwd);
-        const allowNetwork = config.network.allowNetwork;
-        const proxy = allowNetwork ? null : await startProxy(ctx, allowances, signal);
+        const proxyToken = randomBytes(32).toString("base64url");
+        const proxyAuthorization = `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString("base64")}`;
+        const proxy = shouldStartProxy(config) ? await startProxy(ctx, allowances, signal, proxyAuthorization, restrictedUserProxyPortRange(config)) : null;
         let policy;
         let envFile;
+        let processAllowances = allowances;
         let teardownPromise;
         const teardownResources = () => {
           teardownPromise ??= (async () => {
@@ -3709,10 +3884,20 @@ function createLandstripIntegration(options = {}) {
         };
         let landstripArgs;
         try {
-          policy = writePolicyFile(cwd, proxy?.port ?? null, allowances);
-          envFile = writeEnvFile({ ...process.env, ...env, PWD: resolve2(cwd) }, proxy?.port ?? null);
+          envFile = writeEnvFile({ ...process.env, ...env, PWD: resolve2(cwd) }, proxy?.port ?? null, proxy ? proxyToken : undefined);
+          processAllowances = withWindowsProcessReadAccess(allowances, shell, cwd, [envFile.path]);
+          policy = writePolicyFile(cwd, proxy?.port ?? null, processAllowances);
           const wrappedCommand = `source '${envFile.path}' && ${command}`;
-          landstripArgs = ["--trap-fd", "3", "-p", policy.path, shell, ...args, wrappedCommand];
+          landstripArgs = [
+            ...windowsBackendArgs(config),
+            "-p",
+            policy.path,
+            shell,
+            ...args,
+            wrappedCommand
+          ];
+          if (process.platform !== "win32")
+            landstripArgs.unshift("--trap-fd", "3");
         } catch (error) {
           await teardownResources();
           throw error;
@@ -3722,7 +3907,10 @@ function createLandstripIntegration(options = {}) {
             let timeoutHandle;
             let timedOut = false;
             let cleaned = false;
-            const [trapSocket, childEnd] = await createSocketPair();
+            let trapSocket;
+            let childEnd;
+            if (process.platform !== "win32")
+              [trapSocket, childEnd] = await createSocketPair();
             const cleanup = async () => {
               if (cleaned)
                 return;
@@ -3730,24 +3918,20 @@ function createLandstripIntegration(options = {}) {
               if (timeoutHandle)
                 clearTimeout(timeoutHandle);
               signal?.removeEventListener("abort", onAbort);
-              trapSocket.destroy();
+              trapSocket?.destroy();
               await teardownResources();
             };
+            const stdio = childEnd ? ["ignore", "pipe", "pipe", childEnd] : ["ignore", "pipe", "pipe"];
             const child = spawn2(binaryPath(), landstripArgs, {
               cwd,
               env: { PATH: process.env.PATH, HOME: process.env.HOME },
               detached: true,
-              stdio: ["ignore", "pipe", "pipe", childEnd]
+              stdio
             });
-            childEnd.destroy();
+            patchProcessGroupKill(child);
+            childEnd?.destroy();
             function killChild() {
-              if (child.pid === undefined)
-                return;
-              try {
-                process.kill(-child.pid, "SIGKILL");
-              } catch {
-                child.kill("SIGKILL");
-              }
+              child.kill("SIGKILL");
             }
             function onAbort() {
               killChild();
@@ -3824,7 +4008,7 @@ function createLandstripIntegration(options = {}) {
             let trapBuffer = "";
             let queryChain = Promise.resolve();
             const respondQuery = (queryId, action) => {
-              if (trapSocket.destroyed)
+              if (!trapSocket || trapSocket.destroyed)
                 return;
               trapSocket.write(controlResponseLine(queryId, action));
             };
@@ -3834,7 +4018,7 @@ function createLandstripIntegration(options = {}) {
               errorFdAcc += infoLine;
               callbacks.onErrorFd?.(Buffer.from(infoLine, "utf8"));
             };
-            trapSocket.on("data", (data) => {
+            trapSocket?.on("data", (data) => {
               trapBuffer += trapDecoder.write(data);
               let nl = trapBuffer.indexOf(`
 `);
@@ -3848,7 +4032,7 @@ function createLandstripIntegration(options = {}) {
                 const trap = parseTrapLine(line);
                 if (trap && isQueryTrap(trap)) {
                   queryChain = queryChain.then(async () => {
-                    const result = await resolveTrapQuery(trap, ctx, cwd, allowances, callbacks.promptOnBlock === true, signal);
+                    const result = await resolveTrapQuery(trap, ctx, cwd, processAllowances, callbacks.promptOnBlock === true, signal);
                     if (result.reason === "unprompted" || !isFilesystemTrap(trap) && result.reason === "rejected") {
                       appendErrorLine(line);
                     }
@@ -3924,7 +4108,7 @@ function createLandstripIntegration(options = {}) {
   ${globalPath}`, "warning");
         return null;
       }
-      const needsPrompt = operation === "read" ? !matchesPattern(blockedPath, getEffectiveAllowRead(config, allowances), ctx.cwd) : shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config, allowances), ctx.cwd);
+      const needsPrompt = operation === "read" ? !matchesPattern(blockedPath, getEffectiveAllowRead(config, ctx.cwd, allowances), ctx.cwd) : shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config, allowances), ctx.cwd);
       if (needsPrompt) {
         const choice = operation === "read" ? await promptReadBlock(ctx, blockedPath, matchesPattern(blockedPath, config.filesystem.denyRead, ctx.cwd) ? "granting allowRead will override it" : undefined, signal) : await promptWriteBlock(ctx, blockedPath, signal);
         if (choice === "abort")
@@ -4010,6 +4194,16 @@ ${message}
       return;
     notify(ctx, 'Network sandbox allows all domains because network.allowedDomains contains "*".', "warning");
   }
+  function warnIfWindowsSecurityDowngraded(ctx, config) {
+    if (process.platform !== "win32" || config.windows.backend !== "appContainer")
+      return;
+    if (config.windows.appContainerMode === "standard") {
+      notify(ctx, "Windows uses standard AppContainer mode, which is weaker than LPAC isolation.", "warning");
+    }
+    if (config.windows.allowLoopback) {
+      notify(ctx, "Windows loopback access includes all local loopback services, not only the Landstrip proxy.", "warning");
+    }
+  }
   function enableStatus(ctx, config) {
     if (!hasTuiStatus(ctx))
       return;
@@ -4021,6 +4215,9 @@ ${message}
     if (config.network.allowNetwork) {
       networkLabel = "unrestricted";
       networkColor = "warning";
+    } else if (process.platform === "win32" && config.windows.backend === "appContainer" && !config.windows.allowLoopback) {
+      networkLabel = "blocked";
+      networkColor = "accent";
     } else if (allowsAllDomains(config.network.allowedDomains)) {
       networkLabel = "any domain";
       networkColor = "warning";
@@ -4031,7 +4228,14 @@ ${message}
     const sep2 = theme.fg("dim", "·");
     const net = theme.fg(networkColor, networkLabel);
     const write = theme.fg("accent", `${config.filesystem.allowWrite.length} write paths`);
-    setTuiStatus(ctx, "sandbox", `${dot} ${label}  ${sep2}  ${net}  ${sep2}  ${write}`);
+    const fields = [`${dot} ${label}`, net, write];
+    if (process.platform === "win32") {
+      const backend = config.windows.backend;
+      const standard = backend === "appContainer" && config.windows.appContainerMode === "standard";
+      const label2 = backend === "restrictedUser" ? "restricted user" : `${config.windows.appContainerMode} AppContainer`;
+      fields.splice(1, 0, theme.fg(standard ? "warning" : "accent", label2));
+    }
+    setTuiStatus(ctx, "sandbox", fields.join(`  ${sep2}  `));
   }
   const headlessWarnings = new Set;
   function warnUnsandboxed(ctx, message, level) {
@@ -4061,6 +4265,7 @@ ${message}
     sandboxReady = true;
     setSandboxState("enabled", ctx);
     warnIfAllDomainsAllowed(ctx, config);
+    warnIfWindowsSecurityDowngraded(ctx, config);
     enableStatus(ctx, config);
     return true;
   }
@@ -4191,7 +4396,7 @@ ${message}
               section("Config");
               item("project", text(projectPath));
               item("global", text(globalPath));
-              const networkMode = config.network.allowNetwork ? "unrestricted" : "proxied";
+              const networkMode = config.network.allowNetwork ? "unrestricted" : process.platform === "win32" && config.windows.backend === "appContainer" && !config.windows.allowLoopback ? "blocked" : "proxied";
               section("Network", networkMode);
               item("allow network", boolValue(config.network.allowNetwork));
               item("allowed", listValue(config.network.allowedDomains));
@@ -4205,6 +4410,16 @@ ${message}
               item("allow read", listValue(config.filesystem.allowRead));
               item("allow write", listValue(config.filesystem.allowWrite));
               item("deny write", listValue(config.filesystem.denyWrite));
+              if (process.platform === "win32") {
+                section("Windows");
+                const backend = config.windows.backend;
+                item("backend", text(backend === "restrictedUser" ? "restricted user" : "AppContainer"));
+                if (backend === "appContainer") {
+                  const mode = config.windows.appContainerMode;
+                  item("container", mode === "standard" ? theme.fg("warning", `${mode} (weaker)`) : text(mode));
+                  item("loopback", boolValue(config.windows.allowLoopback));
+                }
+              }
               if (sessionAllowedReadPaths.length > 0 || sessionAllowedWritePaths.length > 0) {
                 section("Session grants");
                 if (sessionAllowedReadPaths.length > 0) {
@@ -4479,6 +4694,8 @@ export {
   isQueryTrap,
   isPublicProxyAddress,
   formatLandstripTraps,
+  extractNativeWriteDeniedPath,
+  extractNativeDeniedPath,
   domainMatchesAny,
   pi_landstrip_default as default,
   createLandstripIntegration,

package/dist/sandbox.json

@@ -20,5 +20,10 @@
       ".pi/sandbox.json",
       "~/.pi/agent/sandbox.json"
     ]
+  },
+  "windows": {
+    "backend": "appContainer",
+    "appContainerMode": "standard",
+    "allowLoopback": false
   }
 }

package/dist/subagents.json

@@ -19,6 +19,23 @@
         "prompt": "Complete the delegated task autonomously. Return one concise result to the parent.",
         "permission": { "todowrite": "deny" }
       },
+      "scout": {
+        "description": "Fast codebase reconnaissance with concise handoff findings",
+        "mode": "subagent",
+        "prompt": "Scout the codebase without modifying it. Return concise findings with exact file references, key code, architecture, and a recommended starting point.",
+        "permission": {
+          "*": "deny",
+          "read": {
+            "*": "allow",
+            "**/*.env": "ask",
+            "**/*.env.*": "ask",
+            "**/*.env.example": "allow"
+          },
+          "glob": "allow",
+          "grep": "allow",
+          "list": "allow"
+        }
+      },
       "explore": {
         "description": "Fast read-focused agent for exploring codebases",
         "mode": "subagent",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.17.34",
+  "version": "0.17.35",
   "description": "Sandbox-aware Pi subagents and interactive command permissions",
   "keywords": [
     "landstrip",
@@ -30,7 +30,7 @@
     "build": "node -e \"const fs = require('node:fs'); fs.rmSync('dist', { recursive: true, force: true }); fs.mkdirSync('dist'); for (const file of ['sandbox.json', 'subagents.json']) fs.copyFileSync(file, 'dist/' + file)\" && bun build index.ts --outfile dist/index.ts --target=node --packages=external",
     "prepack": "npm run build",
     "fmt": "oxfmt *.ts package.json tsconfig.json subagents.json sandbox.json .oxfmtrc.json README.md",
-    "lint": "oxlint *.ts",
+    "lint": "oxlint .",
     "check": "tsc --noEmit",
     "test": "npm run build && vitest run",
     "all": "npm run fmt && npm run lint && npm run check && npm run test",
@@ -40,7 +40,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.17.34",
+    "@landstrip/landstrip": "^0.17.35",
     "minimatch": "^10.2.5"
   },
   "devDependencies": {

package/sandbox.json

@@ -20,5 +20,10 @@
       ".pi/sandbox.json",
       "~/.pi/agent/sandbox.json"
     ]
+  },
+  "windows": {
+    "backend": "appContainer",
+    "appContainerMode": "standard",
+    "allowLoopback": false
   }
 }

package/subagents.json

@@ -19,6 +19,23 @@
         "prompt": "Complete the delegated task autonomously. Return one concise result to the parent.",
         "permission": { "todowrite": "deny" }
       },
+      "scout": {
+        "description": "Fast codebase reconnaissance with concise handoff findings",
+        "mode": "subagent",
+        "prompt": "Scout the codebase without modifying it. Return concise findings with exact file references, key code, architecture, and a recommended starting point.",
+        "permission": {
+          "*": "deny",
+          "read": {
+            "*": "allow",
+            "**/*.env": "ask",
+            "**/*.env.*": "ask",
+            "**/*.env.example": "allow"
+          },
+          "glob": "allow",
+          "grep": "allow",
+          "list": "allow"
+        }
+      },
       "explore": {
         "description": "Fast read-focused agent for exploring codebases",
         "mode": "subagent",