pi-landstrip 0.17.34 → 0.17.36

package/README.md

@@ -16,7 +16,7 @@ The extension includes a shared [sandbox policy](./sandbox.json) and separate
 [agent configuration](./subagents.json). Global and trusted-project files can
 override both.
 
-Process-backed subagents require Pi >= 0.80.6 and < 0.82.0, and Node.js >= 22.19.0.
+Process-backed subagents require Pi >= 0.82.0, and Node.js >= 22.19.0.
 
 ## Installation
 
@@ -46,6 +46,16 @@ Alternatively, place the extension under `~/.pi/agent/extensions/` (global) or
 
 On unsupported platforms the extension loads but leaves sandboxing disabled.
 
+On Windows, Pi's Git Bash/MSYS shell cannot run under LPAC. The packaged policy
+therefore selects standard AppContainer explicitly. This is weaker than LPAC because
+resources granted to `ALL APPLICATION PACKAGES` remain visible; `/sandbox` and the
+status line report the active backend and mode. There is no silent
+LPAC-to-standard fallback.
+
+An optional restricted-user backend supports Git Bash without AppContainer. It
+requires one-time elevated host setup and persistent local accounts and WFP rules;
+see [Windows restricted-user setup](#windows-restricted-user-setup).
+
 ## Disabling
 
 Use the `--no-sandbox` flag, or set `enabled` to `false` in `sandbox.json`:
@@ -61,9 +71,10 @@ processes, but without the outer Landstrip OS sandbox. The extension warns once
 per session. Agent tool permissions still apply, but they are not an OS isolation
 boundary.
 
-Trusted project config overrides global config. `/sandbox` updates a trusted
-project sandbox file when present, otherwise the global file. Pi versions
-without a project-trust API use only global configuration.
+Trusted project config overrides global config except for the Windows backend,
+which can be selected only in the trusted global file. `/sandbox` updates a trusted
+project sandbox file when present, otherwise the global file. Pi versions without a
+project-trust API use only global configuration.
 
 ## Behavior
 
@@ -75,11 +86,12 @@ being approved.
 Project approvals are written to `.pi/sandbox.json`; global approvals are
 written to `~/.pi/agent/sandbox.json`.
 
-The main agent remains a normal Pi process. `pi-landstrip` replaces Bash
-execution, including AI `bash` calls and manually typed shell commands (`!` and
-`!!`), with a Landstrip-wrapped implementation. Network traffic uses an
-allowlist proxy when direct access is disabled. Pi's filesystem tools and plugin
-callbacks remain trusted code outside the Landstrip sandbox.
+The main agent remains a normal Pi process. `pi-landstrip` replaces Bash execution,
+including AI `bash` calls and manually typed shell commands (`!` and `!!`), with a
+Landstrip-wrapped implementation. Network traffic uses an allowlist proxy when
+direct access is disabled and the platform policy permits loopback; otherwise it is
+blocked. Pi's filesystem tools and plugin callbacks remain trusted code outside the
+Landstrip sandbox.
 
 By default, Bash and subagent processes have no direct network access. Reads are
 limited to the project, Git configuration, and `/dev/null`; writes are limited
@@ -132,9 +144,11 @@ The tool accepts the OpenCode task fields:
 Foreground tasks return the child result directly. Background tasks return a
 queued result and deliver completion automatically. Task rows show lifecycle
 state, current activity, tool-call count, elapsed time, and expandable output.
-Use `/subagents` or the task row's `/subagents <id>` command to inspect a child
-transcript. Completed and failed task metadata remains available after reload,
-and persisted sessions can be continued with `task_id`.
+Use `/subagents` to open an inspector with **Agents** and **Sessions** tabs. The
+Agents tab lists every available subagent type and its `built-in`, `global`, or
+`local` source. The Sessions tab inspects child transcripts; task rows can open a
+specific one with `/subagents <id>`. Completed and failed task metadata remains
+available after reload, and persisted sessions can be continued with `task_id`.
 
 Session switching or shutdown stops live workers. After an unclean restart,
 unfinished work is marked interrupted; completed but undelivered background
@@ -162,11 +176,19 @@ Unsupported Pi versions still fail task startup.
   `sandbox.json`, then restart or continue the task in a fresh worker to apply
   additional filesystem access. Main-agent Bash can retry a command, but there
   is no live worker-policy update.
-- **Windows**: AppContainer cannot permit only the loopback proxy port, so
-  domain-proxied worker networking is unavailable and the worker has no network.
-  Setting `network.allowNetwork` to `true` is a degraded mode that permits model
-  access but gives the entire worker unrestricted network access; domain lists
-  are then not a boundary.
+- **Windows AppContainer**: the packaged policy selects standard AppContainer for
+  Pi's Git Bash/MSYS runtime. With `windows.allowLoopback: false` (the default), the
+  extension does not start an unreachable proxy and the worker has no network.
+  Setting `windows.allowLoopback` to `true` enables the domain proxy, but also gives
+  the AppContainer access to every local loopback service, not only the proxy port.
+  Setting `network.allowNetwork` to `true` instead gives the entire worker
+  unrestricted network access; domain lists are then not a boundary. Both opt-ins
+  are explicit security downgrades and produce warnings.
+- **Windows restricted user**: WFP blocks restricted accounts except for the
+  installed proxy port range, so domain-filtered proxying works without a broad
+  loopback exemption. `network.allowNetwork: true` leases a separately provisioned
+  unrestricted account. Filesystem grants are journaled and revoked after every
+  process tree exits.
 
 ### Credentials
 
@@ -182,13 +204,84 @@ first.
 
 Subagent configuration is read from `~/.pi/agent/subagents.json` and, for trusted
 projects, `.pi/subagents.json`. Project values override global values; both are
-merged over the packaged [defaults](./subagents.json). Sandbox policy remains in
-`~/.pi/agent/sandbox.json` and `.pi/sandbox.json`. Pi's `settings.json` contains
-only normal Pi settings, such as the `pi-landstrip` package entry.
+merged over the packaged [defaults](./subagents.json). The packaged subagent types
+are `explore`, `general`, and the OpenCode-compatible `scout` reconnaissance agent.
+
+Sandbox policy remains in `~/.pi/agent/sandbox.json` and `.pi/sandbox.json`. Pi's
+`settings.json` contains normal Pi settings, such as the `pi-landstrip` package
+entry, plus optional `landstrip.opencode` import flags:
+
+```json
+{
+  "packages": ["npm:pi-landstrip"],
+  "landstrip": {
+    "opencode": {
+      "showGlobalAgents": false,
+      "showLocalAgents": false
+    }
+  }
+}
+```
+
+Both flags default to `false`. When enabled:
+
+- `showGlobalAgents` imports Markdown agents from the OpenCode global config
+  directory (`$OPENCODE_CONFIG_DIR`, or `$XDG_CONFIG_HOME/opencode`, or
+  `~/.config/opencode`) under `agent/` and `agents/`.
+- `showLocalAgents` imports Markdown agents from the trusted project's
+  `.opencode/agent/` and `.opencode/agents/` directories.
+
+OpenCode local agents override OpenCode global agents. Pi agent definitions
+from `subagents.json` (built-in, global, and local) take precedence over OpenCode
+imports with the same name; conflicts are silent. Local OpenCode agents are
+skipped when the project is untrusted, regardless of the flag.
 
 `subagents.json` accepts only top-level `maxSubagents` and `subagents`; sandbox
 fields belong in `sandbox.json`.
 
+The Windows sandbox fields are:
+
+```json
+{
+  "windows": {
+    "backend": "appContainer",
+    "appContainerMode": "standard",
+    "allowLoopback": false
+  }
+}
+```
+
+`backend` is `"appContainer"` or `"restrictedUser"`. It is a trusted host setting:
+only `~/.pi/agent/sandbox.json` can change it, and project configuration cannot
+override it. `appContainerMode` is `"lpac"` or `"standard"`; core Landstrip defaults
+to LPAC, while the Pi package defaults to standard mode for Git Bash compatibility.
+`allowLoopback` is independently opt-in and applies only to AppContainer.
+
+### Windows restricted-user setup
+
+Provision the backend once before selecting it in global configuration:
+
+```powershell
+npx @landstrip/landstrip windows setup
+npx @landstrip/landstrip windows status
+```
+
+Setup requests UAC elevation and defaults to eight restricted-network accounts, two
+unrestricted-network accounts, and proxy ports 60080-60111. Run
+`npx @landstrip/landstrip windows setup --help` for pool and port options. Then set
+`"backend": "restrictedUser"` in `~/.pi/agent/sandbox.json` and restart Pi.
+
+The extension checks installation health and reads the configured proxy range before
+launching a restricted worker. Restricted-user mode does not support
+`windows.allowLoopback` or `network.allowLocalBinding`. Remove the persistent
+accounts, WFP rules, runner, and recovered per-run ACL grants with:
+
+```powershell
+npx @landstrip/landstrip windows uninstall
+```
+
+A subagent configuration example follows:
+
 ```json
 {
   "maxSubagents": 2,