pi-landstrip 0.18.34 → 0.18.36
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +57 -166
- package/dist/index.ts +1232 -938
- package/package.json +2 -2
- package/LICENSE +0 -201
package/README.md
CHANGED
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
# pi-landstrip
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
later.
|
|
3
|
+
Pi extension for sandboxed Bash, primary agents, and process-backed subagents.
|
|
4
|
+
Pi 0.82.0 and Node.js 22.19.0 or newer are required.
|
|
6
5
|
|
|
7
6
|
## Install
|
|
8
7
|
|
|
@@ -10,189 +9,81 @@ later.
|
|
|
10
9
|
pi install npm:pi-landstrip
|
|
11
10
|
```
|
|
12
11
|
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
```json
|
|
17
|
-
{
|
|
18
|
-
"packages": ["npm:pi-landstrip"]
|
|
19
|
-
}
|
|
20
|
-
```
|
|
21
|
-
|
|
22
|
-
The package includes Landstrip binaries for Linux, macOS, and Windows on x64 and
|
|
23
|
-
Arm64. If sandboxing is enabled but the binary or platform is unusable, Bash,
|
|
24
|
-
shell commands, and sandboxed workers fail closed. Only `--no-sandbox` or
|
|
25
|
-
`"enabled": false` permits execution without OS isolation.
|
|
12
|
+
The package includes Landstrip binaries for Linux, macOS, and Windows on x64
|
|
13
|
+
and Arm64. When sandboxing is enabled, an unusable binary or platform fails
|
|
14
|
+
closed. Use `--no-sandbox` or set `enabled` to `false` for unsandboxed execution.
|
|
26
15
|
|
|
27
16
|
## Permissions
|
|
28
17
|
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
| Category | Checked | Controls |
|
|
32
|
-
| -------- | --------------------------------------- | -------------------------------- |
|
|
33
|
-
| Agent | Before dispatch | Whether an agent may call a tool |
|
|
34
|
-
| Sandbox | Before file access and during processes | Filesystem and network resources |
|
|
35
|
-
|
|
36
|
-
Agent rules return `deny`, `ask`, or `allow`. An agent approval authorizes only
|
|
37
|
-
tool dispatch and cannot bypass a sandbox hard denial.
|
|
38
|
-
|
|
39
|
-
By default, primary `read`, `write`, `edit`, and `apply_patch` tools run in the
|
|
40
|
-
trusted Pi process and only agent permissions apply. Set
|
|
41
|
-
`toolFilesystemPolicy` to `"sandbox"` to preflight their paths against
|
|
42
|
-
`sandbox.json`. `denyWrite` remains a hard denial. If both agent and sandbox
|
|
43
|
-
approval are needed, Pi presents one prompt for the call.
|
|
44
|
-
|
|
45
|
-
AI Bash, `!`, `!!`, and subagent processes use OS isolation. Subagents rely on
|
|
46
|
-
that isolation instead of repeating file-tool preflight. Pi presents all agent
|
|
47
|
-
and sandbox requests through one FIFO prompt queue.
|
|
48
|
-
|
|
49
|
-
Sandbox approvals may apply once, for the session, to the project, or globally.
|
|
50
|
-
Persistent approvals update `.pi/sandbox.json` or
|
|
51
|
-
`~/.pi/agent/sandbox.json`. Headless requests that require approval are denied.
|
|
52
|
-
|
|
53
|
-
## Sandbox configuration
|
|
54
|
-
|
|
55
|
-
Sandbox policy merges in this order:
|
|
56
|
-
|
|
57
|
-
1. bundled [`sandbox.json`](./sandbox.json);
|
|
58
|
-
2. `~/.pi/agent/sandbox.json`;
|
|
59
|
-
3. `.pi/sandbox.json` for a trusted project.
|
|
18
|
+
Agent permissions control tool dispatch. Sandbox permissions control filesystem
|
|
19
|
+
and network access. Agent approval never bypasses a sandbox hard denial.
|
|
60
20
|
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
21
|
+
AI Bash, `!`, `!!`, and subagents use OS isolation. Primary file tools use the
|
|
22
|
+
trusted Pi process unless `toolFilesystemPolicy` is `"sandbox"`. Persistent
|
|
23
|
+
sandbox approvals update `.pi/sandbox.json` or `~/.pi/agent/sandbox.json`.
|
|
64
24
|
|
|
65
|
-
|
|
66
|
-
| ----------------------------- | -------------------------------------------------------------------------------------------------- |
|
|
67
|
-
| `enabled` | `true` |
|
|
68
|
-
| `shell.readAccess` | `"host"` |
|
|
69
|
-
| `filesystem.denyRead` | `["/Users", "/home"]` |
|
|
70
|
-
| `filesystem.allowRead` | `[".", "~/.gitconfig", "~/.config/git/config", "/dev/null"]` |
|
|
71
|
-
| `filesystem.allowWrite` | `[".", "/dev/null"]` |
|
|
72
|
-
| `filesystem.denyWrite` | `["**/.env", "**/.env.*", "**/*.pem", "**/*.key", ".pi/sandbox.json", "~/.pi/agent/sandbox.json"]` |
|
|
73
|
-
| `network.allowNetwork` | `false` |
|
|
74
|
-
| `network.allowLocalBinding` | `false` |
|
|
75
|
-
| `network.allowAllUnixSockets` | `false` |
|
|
76
|
-
| `network.allowUnixSockets` | `[]` |
|
|
77
|
-
| `network.allowedDomains` | `[]` |
|
|
78
|
-
| `network.deniedDomains` | `[]` |
|
|
79
|
-
| `windows.appContainerMode` | `"standard"` |
|
|
80
|
-
| `windows.allowLoopback` | `false` |
|
|
25
|
+
## Sandbox settings
|
|
81
26
|
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
27
|
+
Policy merges from bundled `sandbox.json`, global
|
|
28
|
+
`~/.pi/agent/sandbox.json`, then trusted-project `.pi/sandbox.json`.
|
|
29
|
+
`/landstrip` opens the bottom management pane to inspect or toggle the policy.
|
|
85
30
|
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
31
|
+
```json
|
|
32
|
+
{
|
|
33
|
+
"enabled": true,
|
|
34
|
+
"shell": { "readAccess": "host" },
|
|
35
|
+
"filesystem": {
|
|
36
|
+
"allowWrite": ["."],
|
|
37
|
+
"denyWrite": ["**/.env", "**/*.pem"]
|
|
38
|
+
},
|
|
39
|
+
"network": { "allowNetwork": false }
|
|
40
|
+
}
|
|
41
|
+
```
|
|
95
42
|
|
|
96
|
-
|
|
97
|
-
|
|
43
|
+
See [`sandbox.json`](sandbox.json) for exact defaults. Workers always use policy
|
|
44
|
+
reads. Windows requires an explicit read allowlist.
|
|
98
45
|
|
|
99
|
-
|
|
100
|
-
- `.pi/landstrip.json`
|
|
46
|
+
## Agents
|
|
101
47
|
|
|
102
|
-
|
|
103
|
-
|
|
48
|
+
Configure agents in `~/.pi/agent/landstrip.json`, `.pi/landstrip.json`, or a
|
|
49
|
+
`landstrip` object in the matching Pi settings file:
|
|
104
50
|
|
|
105
51
|
```json
|
|
106
52
|
{
|
|
107
53
|
"maxSubagents": 2,
|
|
108
54
|
"toolFilesystemPolicy": "sandbox",
|
|
109
|
-
"agent": {
|
|
110
|
-
"review": {
|
|
111
|
-
"description": "Review without modifying files",
|
|
112
|
-
"mode": "subagent",
|
|
113
|
-
"prompt": "Report concrete findings.",
|
|
114
|
-
"permission": {
|
|
115
|
-
"edit": "deny",
|
|
116
|
-
"bash": "ask"
|
|
117
|
-
}
|
|
118
|
-
}
|
|
119
|
-
},
|
|
120
55
|
"permission": {
|
|
121
|
-
"task": {
|
|
122
|
-
"*": "deny",
|
|
123
|
-
"review": "allow"
|
|
124
|
-
}
|
|
56
|
+
"task": { "*": "deny", "review": "allow" }
|
|
125
57
|
}
|
|
126
58
|
}
|
|
127
59
|
```
|
|
128
60
|
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
| `toolFilesystemPolicy` | `"host"` | `"host"` or `"sandbox"` |
|
|
133
|
-
| `agent` | built-in agents | named agent definitions |
|
|
134
|
-
| `permission` | built-in rules | global tool/resource rules |
|
|
135
|
-
|
|
136
|
-
Agent definitions accept `name`, `description`, `prompt`, `mode`, `model`,
|
|
137
|
-
`variant`, `temperature`, `top_p`, `steps`, `color`, `hidden`, `disable`,
|
|
138
|
-
`options`, and `permission`. `mode` is `primary`, `subagent`, or `all` and
|
|
139
|
-
defaults to `all`. `/agents` Primary lists only `mode: primary` agents. The
|
|
140
|
-
Subagent tab lists `mode: subagent` and `mode: all` agents, including JSON and
|
|
141
|
-
Markdown definitions.
|
|
142
|
-
|
|
143
|
-
The built-in primary agents are `build` and `plan`; built-in subagents are
|
|
144
|
-
`general`, `scout`, and `explore`. Pi also loads Markdown agents from
|
|
145
|
-
`~/.pi/agent/agents/` and `.pi/agents/`. Project definitions overlay global
|
|
146
|
-
definitions. Configured fields overlay Markdown agents with the same name, so a
|
|
147
|
-
model-only `landstrip.json` entry keeps the Markdown agent's mode, prompt, and
|
|
148
|
-
permissions.
|
|
61
|
+
`maxSubagents` accepts 0 through 16. Agent definitions can override model,
|
|
62
|
+
prompt, mode, options, and permissions. Global definitions load before trusted
|
|
63
|
+
project definitions.
|
|
149
64
|
|
|
150
65
|
## Commands and tasks
|
|
151
66
|
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
export default function permissionReviewer(pi: ExtensionAPI): void {
|
|
177
|
-
provideLandstripPermissionAsk(pi, {
|
|
178
|
-
id: 'example-reviewer',
|
|
179
|
-
async decide(request) {
|
|
180
|
-
if (request.toolName === 'bash' && request.input.command === 'git status') {
|
|
181
|
-
return { decision: 'allow' };
|
|
182
|
-
}
|
|
183
|
-
return { decision: 'abstain' };
|
|
184
|
-
},
|
|
185
|
-
});
|
|
186
|
-
}
|
|
187
|
-
```
|
|
188
|
-
|
|
189
|
-
The provider receives the tool name and input, pending permission/resource pairs,
|
|
190
|
-
the primary or subagent context, and an abort signal. `allow` approves that call,
|
|
191
|
-
`deny` blocks it, and `abstain` uses the normal UI prompt or headless denial.
|
|
192
|
-
Provider errors also fall back safely. Only one provider may be registered at a
|
|
193
|
-
time; the helper works regardless of extension load order and returns a disposer.
|
|
194
|
-
|
|
195
|
-
## License
|
|
196
|
-
|
|
197
|
-
`pi-landstrip` is licensed under `Apache-2.0`. The bundled Landstrip package is
|
|
198
|
-
licensed separately as `Apache-2.0 AND LGPL-2.1-or-later`.
|
|
67
|
+
| Command | Action |
|
|
68
|
+
| --------------------------------- | --------------------------------------------- |
|
|
69
|
+
| `/landstrip status` | Show sandbox, primary-agent, and task status. |
|
|
70
|
+
| `/landstrip settings` | Manage concurrency and file-tool policy. |
|
|
71
|
+
| `/landstrip sandbox [on\|off]` | Inspect or toggle OS isolation. |
|
|
72
|
+
| `/landstrip agents [@name]` | List or select the primary agent. |
|
|
73
|
+
| `/landstrip subagents` | List configured process subagents. |
|
|
74
|
+
| `/landstrip tasks [list]` | List task sessions. |
|
|
75
|
+
| `/landstrip tasks kill <task-id>` | Terminate one task session. |
|
|
76
|
+
| `/landstrip logs [task-id]` | Open task logs in the TUI. |
|
|
77
|
+
| `/landstrip help` | Open command and shortcut help. |
|
|
78
|
+
|
|
79
|
+
In the TUI, bare `/landstrip` opens the management pane and a bare task ID opens
|
|
80
|
+
its logs. Task IDs may be shortened only to a unique prefix. `Ctrl+Shift+A`
|
|
81
|
+
cycles primary agents while Pi is idle.
|
|
82
|
+
|
|
83
|
+
The `task` tool starts isolated workers. Set `background: true` to return
|
|
84
|
+
immediately and use `task_id` to continue a saved task.
|
|
85
|
+
In a running or queued task's log view, press `Enter` to send a steering message.
|
|
86
|
+
|
|
87
|
+
## Licensing
|
|
88
|
+
|
|
89
|
+
[Apache 2.0](../../LICENSE-APACHE-2.0).
|