pi-landstrip 0.18.14 → 0.18.16

package/README.md

@@ -168,18 +168,30 @@ Remove it with `npx @landstrip/landstrip windows uninstall`.
 
 ## Plugin API
 
-Other Pi extensions can discover the runtime with `useLandstrip` from
-`pi-landstrip/api`. The versioned runtime provides:
+Other Pi extensions can discover the v2 runtime with `useLandstrip` from
+`pi-landstrip/api`. The runtime provides:
 
 - `getContext()` for sandbox and task context.
-- `createBashTool()` for Landstrip-backed command tools.
+- `registerShellProvider()` for replacing POSIX shell invocation preparation.
 - `prepareProcess()` for one policy-aware process launch.
 - `registerWorkerExtension()` for trusted worker extensions.
 - `on()` for sandbox and subagent lifecycle events.
 
-Discovery is callback-based and independent of extension load order. Worker
-extensions are trusted code. Workers also receive an informational
-`LANDSTRIP_CONTEXT` environment value; it is not proof of authorization.
+A shell provider receives the command, working directory, composed command
+environment, and abort signal. It returns an executable, arguments, minimal
+launcher environment, required read paths, and optional cleanup. Landstrip adds
+platform variables required by its launcher, such as Windows `ProgramData`.
+Providers should pass the composed environment through a private temporary file,
+include that file in `readPaths`, and remove it in `dispose()`; do not copy secrets
+into `launcherEnv`. Landstrip remains responsible for starting the process, applying
+policy, proxying network access, handling traps, and prompting for additional
+access. Only one external provider can be active; disposing it restores the
+built-in POSIX provider.
+
+Use `provideLandstripShell()` to register a provider independently of extension
+load order. Shell providers and worker extensions are trusted code. Workers also
+receive an informational `LANDSTRIP_CONTEXT` environment value; it is not proof
+of authorization.
 
 ## Limits
 

package/api.ts

@@ -2,26 +2,20 @@
 // Copyright (C) Jarkko Sakkinen 2026
 
 import type { ChildProcess, SpawnOptions } from 'node:child_process';
+import type { Readable, Writable } from 'node:stream';
 
-import {
-  createBashToolDefinition,
-  type ExtensionAPI,
-  type ExtensionContext,
-} from '@earendil-works/pi-coding-agent';
-
-import type { RpcChildProcess } from './rpc-process.ts';
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
 
 export const LANDSTRIP_CONTEXT_ENV = 'LANDSTRIP_CONTEXT';
-export const LANDSTRIP_RUNTIME_VERSION = 1;
+export const LANDSTRIP_RUNTIME_VERSION = 2;
 
-const RUNTIME_REGISTER_EVENT = 'landstrip:runtime:register:v1';
-const RUNTIME_DISCOVER_EVENT = 'landstrip:runtime:discover:v1';
+const RUNTIME_REGISTER_EVENT = 'landstrip:runtime:register:v2';
+const RUNTIME_DISCOVER_EVENT = 'landstrip:runtime:discover:v2';
 
 export type LandstripSandboxState = 'enabled' | 'disabled' | 'unavailable';
-export type LandstripBashTool = ReturnType<typeof createBashToolDefinition>;
 
-export interface LandstripContextV1 {
-  readonly version: 1;
+export interface LandstripContextV2 {
+  readonly version: 2;
   readonly host: 'pi';
   readonly role: 'primary' | 'subagent';
   readonly sandbox: LandstripSandboxState;
@@ -38,6 +32,30 @@ export interface LandstripWorkerExtension {
   readonly entry: string;
 }
 
+export interface LandstripShellPrepareOptions {
+  readonly command: string;
+  readonly cwd: string;
+  /** Composed command environment; transport it without copying secrets into launcherEnv. */
+  readonly env: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+}
+
+export interface LandstripShellInvocation {
+  readonly executable: string;
+  readonly args: readonly string[];
+  /** Minimal environment for the Landstrip launcher and shell bootstrap process. */
+  readonly launcherEnv: NodeJS.ProcessEnv;
+  readonly readPaths?: readonly string[];
+  dispose?(): void | Promise<void>;
+}
+
+export interface LandstripShellProvider {
+  readonly id: string;
+  prepare(
+    options: LandstripShellPrepareOptions,
+  ): LandstripShellInvocation | Promise<LandstripShellInvocation>;
+}
+
 export interface LandstripProcessOptions {
   readonly command: string;
   readonly args: readonly string[];
@@ -58,25 +76,42 @@ export interface LandstripPreparedProcess {
   dispose(): Promise<void>;
 }
 
+export interface LandstripRpcChildProcess {
+  readonly stdin: Writable;
+  readonly stdout: Readable;
+  readonly stderr: Readable;
+  readonly exitCode: number | null;
+  readonly signalCode: NodeJS.Signals | null;
+  kill(signal?: NodeJS.Signals | number): boolean;
+  on(event: 'exit', listener: (code: number | null, signal: NodeJS.Signals | null) => void): this;
+  on(event: 'error', listener: (error: Error) => void): this;
+  once(event: 'spawn', listener: () => void): this;
+  once(event: 'error', listener: (error: Error) => void): this;
+  once(event: 'exit', listener: (code: number | null, signal: NodeJS.Signals | null) => void): this;
+  off(event: 'spawn', listener: () => void): this;
+  off(event: 'error', listener: (error: Error) => void): this;
+  off(event: 'exit', listener: (code: number | null, signal: NodeJS.Signals | null) => void): this;
+}
+
 export type LandstripSpawn = (
   command: string,
   args: readonly string[],
   options: SpawnOptions,
-) => ChildProcess | RpcChildProcess;
+) => ChildProcess | LandstripRpcChildProcess;
 
 export type LandstripEvent =
-  | { readonly type: 'sandbox.changed'; readonly context: LandstripContextV1 }
-  | { readonly type: 'subagent.start'; readonly context: LandstripContextV1 }
+  | { readonly type: 'sandbox.changed'; readonly context: LandstripContextV2 }
+  | { readonly type: 'subagent.start'; readonly context: LandstripContextV2 }
   | {
       readonly type: 'subagent.end';
-      readonly context: LandstripContextV1;
+      readonly context: LandstripContextV2;
       readonly status: 'completed' | 'cancelled' | 'error';
     };
 
-export interface PiLandstripRuntimeV1 {
-  readonly version: 1;
-  getContext(ctx?: ExtensionContext): LandstripContextV1;
-  createBashTool(cwd: string, ctx?: ExtensionContext): LandstripBashTool;
+export interface PiLandstripRuntimeV2 {
+  readonly version: 2;
+  getContext(ctx?: ExtensionContext): LandstripContextV2;
+  registerShellProvider(provider: LandstripShellProvider): () => void;
   prepareProcess(options: LandstripProcessOptions): Promise<LandstripPreparedProcess>;
   registerWorkerExtension(extension: LandstripWorkerExtension): () => void;
   getWorkerExtensions(): readonly LandstripWorkerExtension[];
@@ -87,13 +122,13 @@ export interface PiLandstripRuntimeV1 {
 }
 
 interface RuntimeRegistration {
-  readonly version: 1;
-  readonly runtime: PiLandstripRuntimeV1;
+  readonly version: 2;
+  readonly runtime: PiLandstripRuntimeV2;
 }
 
 interface RuntimeDiscovery {
-  readonly version: 1;
-  register(runtime: PiLandstripRuntimeV1): void;
+  readonly version: 2;
+  register(runtime: PiLandstripRuntimeV2): void;
 }
 
 interface EventBusLike {
@@ -109,12 +144,12 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
-function isRuntime(value: unknown): value is PiLandstripRuntimeV1 {
+function isRuntime(value: unknown): value is PiLandstripRuntimeV2 {
   return (
     isRecord(value) &&
     value.version === LANDSTRIP_RUNTIME_VERSION &&
     typeof value.getContext === 'function' &&
-    typeof value.createBashTool === 'function' &&
+    typeof value.registerShellProvider === 'function' &&
     typeof value.prepareProcess === 'function' &&
     typeof value.registerWorkerExtension === 'function' &&
     typeof value.getWorkerExtensions === 'function' &&
@@ -124,13 +159,13 @@ function isRuntime(value: unknown): value is PiLandstripRuntimeV1 {
 
 export function useLandstrip(
   pi: ExtensionAPI,
-  callback: (runtime: PiLandstripRuntimeV1) => void,
+  callback: (runtime: PiLandstripRuntimeV2) => void,
 ): () => void {
   const events = eventBus(pi);
   if (!events) return () => undefined;
 
-  let current: PiLandstripRuntimeV1 | undefined;
-  const register = (runtime: PiLandstripRuntimeV1): void => {
+  let current: PiLandstripRuntimeV2 | undefined;
+  const register = (runtime: PiLandstripRuntimeV2): void => {
     if (runtime === current) return;
     current = runtime;
     callback(runtime);
@@ -139,16 +174,37 @@ export function useLandstrip(
     if (!isRecord(value) || value.version !== LANDSTRIP_RUNTIME_VERSION) return;
     if (isRuntime(value.runtime)) register(value.runtime);
   });
-  events.emit(RUNTIME_DISCOVER_EVENT, {
-    version: LANDSTRIP_RUNTIME_VERSION,
-    register,
-  } satisfies RuntimeDiscovery);
-  return unsubscribe;
+  try {
+    events.emit(RUNTIME_DISCOVER_EVENT, {
+      version: LANDSTRIP_RUNTIME_VERSION,
+      register,
+    } satisfies RuntimeDiscovery);
+    return unsubscribe;
+  } catch (error) {
+    unsubscribe();
+    throw error;
+  }
+}
+
+export function provideLandstripShell(
+  pi: ExtensionAPI,
+  provider: LandstripShellProvider,
+): () => void {
+  let unregisterProvider: (() => void) | undefined;
+  const stopDiscovery = useLandstrip(pi, (runtime) => {
+    const unregisterNext = runtime.registerShellProvider(provider);
+    unregisterProvider?.();
+    unregisterProvider = unregisterNext;
+  });
+  return () => {
+    stopDiscovery();
+    unregisterProvider?.();
+  };
 }
 
 export function publishLandstripRuntime(
   pi: ExtensionAPI,
-  runtime: PiLandstripRuntimeV1,
+  runtime: PiLandstripRuntimeV2,
 ): () => void {
   const events = eventBus(pi);
   if (!events) return () => undefined;
@@ -157,20 +213,25 @@ export function publishLandstripRuntime(
     if (!isRecord(value) || value.version !== LANDSTRIP_RUNTIME_VERSION) return;
     if (typeof value.register === 'function') value.register(runtime);
   });
-  events.emit(RUNTIME_REGISTER_EVENT, {
-    version: LANDSTRIP_RUNTIME_VERSION,
-    runtime,
-  } satisfies RuntimeRegistration);
-  return unsubscribe;
+  try {
+    events.emit(RUNTIME_REGISTER_EVENT, {
+      version: LANDSTRIP_RUNTIME_VERSION,
+      runtime,
+    } satisfies RuntimeRegistration);
+    return unsubscribe;
+  } catch (error) {
+    unsubscribe();
+    throw error;
+  }
 }
 
-export function encodeLandstripContext(context: LandstripContextV1): string {
+export function encodeLandstripContext(context: LandstripContextV2): string {
   return Buffer.from(JSON.stringify(context)).toString('base64url');
 }
 
 export function contextFromEnvironment(
   env: NodeJS.ProcessEnv = process.env,
-): LandstripContextV1 | undefined {
+): LandstripContextV2 | undefined {
   const encoded = env[LANDSTRIP_CONTEXT_ENV];
   if (!encoded) return undefined;
 
@@ -191,7 +252,7 @@ export function contextFromEnvironment(
     ) {
       return undefined;
     }
-    return value as unknown as LandstripContextV1;
+    return value as unknown as LandstripContextV2;
   } catch {
     return undefined;
   }

package/dist/index.ts

@@ -36,9 +36,9 @@ import {
 
 // api.ts
 var LANDSTRIP_CONTEXT_ENV = "LANDSTRIP_CONTEXT";
-var LANDSTRIP_RUNTIME_VERSION = 1;
-var RUNTIME_REGISTER_EVENT = "landstrip:runtime:register:v1";
-var RUNTIME_DISCOVER_EVENT = "landstrip:runtime:discover:v1";
+var LANDSTRIP_RUNTIME_VERSION = 2;
+var RUNTIME_REGISTER_EVENT = "landstrip:runtime:register:v2";
+var RUNTIME_DISCOVER_EVENT = "landstrip:runtime:discover:v2";
 function eventBus(pi) {
   return pi.events;
 }
@@ -57,11 +57,16 @@ function publishLandstripRuntime(pi, runtime) {
     if (typeof value.register === "function")
       value.register(runtime);
   });
-  events.emit(RUNTIME_REGISTER_EVENT, {
-    version: LANDSTRIP_RUNTIME_VERSION,
-    runtime
-  });
-  return unsubscribe;
+  try {
+    events.emit(RUNTIME_REGISTER_EVENT, {
+      version: LANDSTRIP_RUNTIME_VERSION,
+      runtime
+    });
+    return unsubscribe;
+  } catch (error) {
+    unsubscribe();
+    throw error;
+  }
 }
 function encodeLandstripContext(context) {
   return Buffer.from(JSON.stringify(context)).toString("base64url");
@@ -3510,7 +3515,7 @@ ${catalog.diagnostics.join(`
   }
   taskContext(task, ctx) {
     const context = this.integration.getContext?.(ctx) ?? {
-      version: 1,
+      version: 2,
       host: "pi",
       role: "primary",
       sandbox: "unavailable",
@@ -4275,7 +4280,7 @@ function extractNativeDeniedPath(output, cwd) {
 }
 function extractNativeWriteDeniedPath(output, cwd) {
   const denial = String.raw`(?:Access is denied\.?|Operation not permitted|Permission denied)`;
-  let match = output.match(new RegExp(String.raw`(?:[Uu]nable to create|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\n]*['"]([^'"\n]+)['"][^\r\n]{0,120}${denial}`, "im"));
+  let match = output.match(new RegExp(String.raw`(?:[Uu]nable to create|failed to create(?: directory)?|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\x60\r\n]*['"\x60]([^'"\x60\r\n]+)['"\x60](?:[^\r\n]*\r?\n){0,3}[^\r\n]{0,120}${denial}`, "im"));
   if (match)
     return normalizePathMatch(match[1], cwd);
   match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: cannot create(?: directory)? '?([^'\n]+?)'?(?: for writing)?: ${denial}$`, "im"));
@@ -4488,6 +4493,51 @@ function writeEnvFile(env, proxyPort, proxyToken) {
 `), "utf-8");
   return { dir, path };
 }
+var POSIX_SHELL_PROVIDER_ID = "posix";
+function createPosixShellProvider() {
+  return {
+    id: POSIX_SHELL_PROVIDER_ID,
+    prepare(options) {
+      if (options.signal?.aborted)
+        throw new Error("aborted");
+      const { shell, args } = getShellConfig(SettingsManager.create(options.cwd).getShellPath());
+      const envFile = writeEnvFile(options.env, null);
+      let disposed = false;
+      return {
+        executable: shell,
+        args: [...args, `source '${envFile.path}' && ${options.command}`],
+        launcherEnv: { PATH: process.env.PATH, HOME: process.env.HOME },
+        readPaths: [envFile.path],
+        dispose() {
+          if (disposed)
+            return;
+          disposed = true;
+          rmSync2(envFile.dir, { recursive: true, force: true });
+        }
+      };
+    }
+  };
+}
+function shellEnvironment(env, cwd, proxyPort, proxyToken) {
+  const result = { ...process.env, ...env, PWD: resolve3(cwd) };
+  if (proxyPort === null)
+    return result;
+  const credentials = proxyToken === undefined ? "" : `landstrip:${proxyToken}@`;
+  const url = `http://${credentials}127.0.0.1:${proxyPort}`;
+  for (const name of PROXY_ENVIRONMENT_VARIABLES)
+    result[name] = url;
+  result.NO_PROXY = "";
+  result.no_proxy = "";
+  return result;
+}
+function createLandstripLauncherEnvironment(providerEnv, hostEnv = process.env, platform = process.platform) {
+  if (platform !== "win32" || hostEnv.ProgramData === undefined)
+    return providerEnv;
+  return { ...providerEnv, ProgramData: hostEnv.ProgramData };
+}
+function createWindowsDenyRead(denyRead, volumeRoot) {
+  return [...new Set([...denyRead.filter((path) => !path.startsWith("/")), volumeRoot])];
+}
 function parseProxyPort(value, defaultPort) {
   const rawPort = value ?? String(defaultPort);
   if (!/^\d+$/.test(rawPort))
@@ -4576,6 +4626,8 @@ function createLandstripIntegration(options = {}) {
   let unsandboxedWorkerWarningShown = false;
   let activeContext;
   let unpublishRuntime;
+  const defaultShellProvider = createPosixShellProvider();
+  let externalShellProvider;
   const eventHandlers = new Set;
   const workerExtensions = new Map;
   const sessionAllowedDomains = [];
@@ -4617,6 +4669,29 @@ function createLandstripIntegration(options = {}) {
     eventHandlers.add(listener);
     return () => eventHandlers.delete(listener);
   }
+  function registerShellProvider(provider) {
+    const id = provider.id.trim();
+    if (!id)
+      throw new Error("Shell provider id must not be empty");
+    if (id === POSIX_SHELL_PROVIDER_ID) {
+      throw new Error(`Shell provider id "${POSIX_SHELL_PROVIDER_ID}" is reserved`);
+    }
+    if (externalShellProvider) {
+      throw new Error(`Shell provider "${externalShellProvider.id}" is already registered; cannot register "${id}"`);
+    }
+    externalShellProvider = provider;
+    let disposed = false;
+    return () => {
+      if (disposed)
+        return;
+      disposed = true;
+      if (externalShellProvider === provider)
+        externalShellProvider = undefined;
+    };
+  }
+  function activeShellProvider() {
+    return externalShellProvider ?? defaultShellProvider;
+  }
   function registerWorkerExtension(extension) {
     const id = extension.id.trim();
     if (!id)
@@ -4677,7 +4752,7 @@ function createLandstripIntegration(options = {}) {
     if (process.platform !== "win32")
       return config.filesystem.denyRead;
     const volumeRoot = parse(resolve3(cwd)).root;
-    return [...new Set([...config.filesystem.denyRead, volumeRoot])];
+    return createWindowsDenyRead(config.filesystem.denyRead, volumeRoot);
   }
   function hasBaselineWindowsApplicationAccess(filePath) {
     const normalizedPath = normalizePathSeparators(resolve3(filePath)).toLowerCase();
@@ -4786,13 +4861,13 @@ function createLandstripIntegration(options = {}) {
 `, "utf-8");
     return { dir, path };
   }
-  function startProxy(ctx, allowances, signal, authorization, portRange) {
+  function startProxy(ctx, cwd, allowances, signal, authorization, portRange) {
     const sockets = new Set;
     async function domainAllowed(domain) {
-      const config = loadConfig(ctx.cwd);
+      const config = loadConfig(cwd);
       if (domainMatchesAny(domain, config.network.deniedDomains))
         return false;
-      return ensureDomainAllowed(ctx, domain, ctx.cwd, allowances, signal);
+      return ensureDomainAllowed(ctx, domain, cwd, allowances, signal);
     }
     function trackUpstream(upstream, client, settled) {
       sockets.add(upstream);
@@ -5120,7 +5195,7 @@ function createLandstripIntegration(options = {}) {
     const config = loadConfig(options2.cwd);
     const proxyToken = randomBytes(32).toString("base64url");
     const proxyAuthorization = `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString("base64")}`;
-    const proxy = shouldStartProxy(config) ? await startProxy(options2.ctx, processAllowances, options2.signal, proxyAuthorization, restrictedUserProxyPortRange()) : null;
+    const proxy = shouldStartProxy(config) ? await startProxy(options2.ctx, options2.cwd, processAllowances, options2.signal, proxyAuthorization, restrictedUserProxyPortRange()) : null;
     let policy;
     let trapSocket;
     let childEnd;
@@ -5222,32 +5297,55 @@ function createLandstripIntegration(options = {}) {
       async exec(command, cwd, { onData, signal, timeout, env }) {
         if (!existsSync5(cwd))
           throw new Error(`Working directory does not exist: ${cwd}`);
-        const { shell, args } = getShellConfig(SettingsManager.create(cwd).getShellPath());
+        const provider = activeShellProvider();
         const config = loadConfig(cwd);
         const proxyToken = randomBytes(32).toString("base64url");
         const proxyAuthorization = `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString("base64")}`;
-        const proxy = shouldStartProxy(config) ? await startProxy(ctx, allowances, signal, proxyAuthorization, restrictedUserProxyPortRange()) : null;
+        const proxy = shouldStartProxy(config) ? await startProxy(ctx, cwd, allowances, signal, proxyAuthorization, restrictedUserProxyPortRange()) : null;
         let policy;
-        let envFile;
+        let invocation;
         let processAllowances = allowances;
         let teardownPromise;
         const teardownResources = () => {
-          teardownPromise ??= (async () => {
-            await proxy?.stop();
-            if (policy)
-              rmSync2(policy.dir, { recursive: true, force: true });
-            if (envFile)
-              rmSync2(envFile.dir, { recursive: true, force: true });
-          })();
+          teardownPromise ??= Promise.all([
+            Promise.resolve().then(() => invocation?.dispose?.()),
+            Promise.resolve().then(() => {
+              if (policy)
+                rmSync2(policy.dir, { recursive: true, force: true });
+            }),
+            Promise.resolve().then(() => proxy?.stop())
+          ]).then(() => {
+            return;
+          });
           return teardownPromise;
         };
         let landstripArgs;
         try {
-          envFile = writeEnvFile({ ...process.env, ...env, PWD: resolve3(cwd) }, proxy?.port ?? null, proxy ? proxyToken : undefined);
-          processAllowances = withWindowsProcessReadAccess(allowances, shell, cwd, [envFile.path]);
+          invocation = await provider.prepare({
+            command,
+            cwd,
+            env: shellEnvironment(env, cwd, proxy?.port ?? null, proxy ? proxyToken : undefined),
+            signal
+          });
+          if (!invocation.executable.trim()) {
+            throw new Error(`Shell provider "${provider.id}" returned an empty executable`);
+          }
+          if (signal?.aborted)
+            throw new Error("aborted");
+          processAllowances = {
+            ...allowances,
+            readPaths: [...allowances.readPaths, ...invocation.readPaths ?? []]
+          };
+          processAllowances = withWindowsProcessReadAccess(processAllowances, invocation.executable, cwd);
           policy = writePolicyFile(cwd, proxy?.port ?? null, processAllowances);
-          const wrappedCommand = `source '${envFile.path}' && ${command}`;
-          landstripArgs = ["run", "-p", policy.path, "--", shell, ...args, wrappedCommand];
+          landstripArgs = [
+            "run",
+            "-p",
+            policy.path,
+            "--",
+            invocation.executable,
+            ...invocation.args
+          ];
           if (process.platform !== "win32")
             landstripArgs.splice(1, 0, "--trap-fd", "3");
         } catch (error) {
@@ -5255,14 +5353,19 @@ function createLandstripIntegration(options = {}) {
           throw error;
         }
         return new Promise((resolvePromise, reject) => {
+          let pendingSocketPair;
           (async () => {
             let timeoutHandle;
             let timedOut = false;
             let cleaned = false;
             let trapSocket;
             let childEnd;
-            if (process.platform !== "win32")
-              [trapSocket, childEnd] = await createSocketPair();
+            if (process.platform !== "win32") {
+              pendingSocketPair = await createSocketPair();
+              [trapSocket, childEnd] = pendingSocketPair;
+            }
+            if (signal?.aborted)
+              throw new Error("aborted");
             const cleanup = async () => {
               if (cleaned)
                 return;
@@ -5276,12 +5379,13 @@ function createLandstripIntegration(options = {}) {
             const stdio = childEnd ? ["ignore", "pipe", "pipe", childEnd] : ["ignore", "pipe", "pipe"];
             const child = spawn2(binaryPath(), landstripArgs, {
               cwd,
-              env: { PATH: process.env.PATH, HOME: process.env.HOME },
+              env: createLandstripLauncherEnvironment(invocation.launcherEnv),
               detached: true,
               stdio
             });
             patchProcessGroupKill(child);
             childEnd?.destroy();
+            pendingSocketPair = undefined;
             function killChild() {
               child.kill("SIGKILL");
             }
@@ -5295,6 +5399,8 @@ function createLandstripIntegration(options = {}) {
               }, timeout * 1000);
             }
             signal?.addEventListener("abort", onAbort, { once: true });
+            if (signal?.aborted)
+              onAbort();
             let stderrAcc = "";
             let errorFdAcc = "";
             let execSettled = false;
@@ -5419,9 +5525,9 @@ function createLandstripIntegration(options = {}) {
               }
             });
             child.once("close", (code) => finalizeExec(code));
-          })().catch(async (error) => {
-            await teardownResources();
-            reject(error);
+          })().catch((error) => {
+            pendingSocketPair?.forEach((socket) => socket.destroy());
+            teardownResources().then(() => reject(error), (cleanupError) => reject(new AggregateError([error, cleanupError], "Shell setup and cleanup failed")));
           });
         });
       }
@@ -5662,19 +5768,22 @@ ${message}
       return enableSandbox(ctx);
     return true;
   }
-  function createBashTool(cwd, ctx, requireSandbox = false) {
+  function createBashTool(cwd) {
     const localBash = createPlainBashTool(cwd);
     return {
       ...localBash,
       label: "bash (landstrip)",
-      async execute(id, params, signal, onUpdate, callCtx) {
-        const effectiveCtx = ctx ?? callCtx;
-        if (!effectiveCtx || !ensureSandboxState(effectiveCtx)) {
-          if (requireSandbox)
-            throw new Error("Sandbox is unavailable; refusing subagent command");
-          return localBash.execute(id, params, signal, onUpdate, effectiveCtx);
+      description: "Execute commands with the active Landstrip shell provider.",
+      async execute(id, params, signal, onUpdate, ctx) {
+        if (!ctx)
+          throw new Error("Sandbox context is unavailable");
+        if (!ensureSandboxState(ctx)) {
+          if (sandboxState === "unavailable") {
+            throw new Error("Sandbox is unavailable; refusing command");
+          }
+          return localBash.execute(id, params, signal, onUpdate, ctx);
         }
-        return runBashWithOptionalRetry(id, params, signal, onUpdate, effectiveCtx);
+        return runBashWithOptionalRetry(id, params, signal, onUpdate, ctx);
       }
     };
   }
@@ -5690,8 +5799,12 @@ ${message}
     if (shouldRegisterBashTool)
       pi.registerTool(createBashTool(localCwd));
     pi.on("user_bash", async (_event, ctx) => {
-      if (!ensureSandboxState(ctx))
+      if (!ensureSandboxState(ctx)) {
+        if (sandboxState === "unavailable") {
+          throw new Error("Sandbox is unavailable; refusing command");
+        }
         return;
+      }
       return { operations: createLandstripBashOps(ctx, { promptOnBlock: true }) };
     });
     pi.on("session_start", async (_event, ctx) => {
@@ -5844,7 +5957,7 @@ ${target.path}`);
   const integration = {
     version: LANDSTRIP_RUNTIME_VERSION,
     getContext,
-    createBashTool,
+    registerShellProvider,
     prepareProcess,
     prepareRpcWorker,
     registerWorkerExtension,
@@ -5870,6 +5983,10 @@ export {
   extractNativeDeniedPath,
   domainMatchesAny,
   pi_landstrip_default as default,
+  createWindowsDenyRead,
+  createPosixShellProvider,
+  createLandstripLauncherEnvironment,
   createLandstripIntegration,
-  controlResponseLine
+  controlResponseLine,
+  POSIX_SHELL_PROVIDER_ID
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.18.14",
+  "version": "0.18.16",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.18.14",
+    "@landstrip/landstrip": "^0.18.16",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "yaml": "^2.9.0"