pi-landstrip 0.18.43 → 0.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +78 -54
- package/dist/index.ts +762 -159
- package/dist/sandbox.json +1 -0
- package/dist/worker-auth-entry.js +299 -0
- package/package.json +7 -4
- package/sandbox.json +1 -0
package/README.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# pi-landstrip
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
Pi 0.82.0 and Node.js 22.19.0
|
|
3
|
+
Sandboxed Bash, primary agents, and process-backed subagents for Pi.
|
|
4
|
+
Requires Pi ≥0.82.0 and Node.js ≥22.19.0.
|
|
5
5
|
|
|
6
6
|
## Install
|
|
7
7
|
|
|
@@ -9,82 +9,106 @@ Pi 0.82.0 and Node.js 22.19.0 or newer are required.
|
|
|
9
9
|
pi install npm:pi-landstrip
|
|
10
10
|
```
|
|
11
11
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
12
|
+
Includes native binaries for Linux, macOS, and Windows on x64 and Arm64.
|
|
13
|
+
Enabled sandboxing fails closed if the binary or platform is unusable;
|
|
14
|
+
`--no-sandbox` or `enabled: false` explicitly permits unsandboxed execution.
|
|
15
15
|
|
|
16
|
-
## Permissions
|
|
16
|
+
## Permissions and configuration
|
|
17
17
|
|
|
18
|
-
Agent permissions
|
|
19
|
-
|
|
18
|
+
Agent permissions govern tool dispatch, not sandbox access: approval never
|
|
19
|
+
bypasses a sandbox hard denial. With sandboxing enabled, AI Bash, `!`, `!!`, and
|
|
20
|
+
subagents use OS isolation. Primary file tools run in trusted Pi; setting
|
|
21
|
+
`toolFilesystemPolicy: "sandbox"` applies filesystem policy checks, not OS isolation.
|
|
20
22
|
|
|
21
|
-
|
|
22
|
-
trusted Pi process unless `toolFilesystemPolicy` is `"sandbox"`. Persistent
|
|
23
|
-
sandbox approvals update `.pi/sandbox.json` or `~/.pi/agent/sandbox.json`.
|
|
24
|
-
|
|
25
|
-
## Sandbox settings
|
|
26
|
-
|
|
27
|
-
Policy merges from bundled `sandbox.json`, global
|
|
23
|
+
Policy merges from bundled [`sandbox.json`](sandbox.json), then
|
|
28
24
|
`~/.pi/agent/sandbox.json`, then trusted-project `.pi/sandbox.json`.
|
|
29
|
-
|
|
25
|
+
Arrays combine; later scalar values win. Persistent sandbox approvals update
|
|
26
|
+
the global or project file. Store only overrides:
|
|
30
27
|
|
|
31
28
|
```json
|
|
32
29
|
{
|
|
33
|
-
"
|
|
34
|
-
"
|
|
35
|
-
"filesystem": {
|
|
36
|
-
"allowWrite": ["."],
|
|
37
|
-
"denyWrite": ["**/.env", "**/*.pem"]
|
|
38
|
-
},
|
|
30
|
+
"shell": { "readAccess": "policy" },
|
|
31
|
+
"filesystem": { "allowWrite": ["."] },
|
|
39
32
|
"network": { "allowNetwork": false }
|
|
40
33
|
}
|
|
41
34
|
```
|
|
42
35
|
|
|
43
|
-
|
|
44
|
-
reads. Windows requires an explicit read allowlist.
|
|
36
|
+
The bundled shell default is `readAccess: "host"`; workers always use policy
|
|
37
|
+
reads. Windows requires an explicit read allowlist. Native policy and CLI
|
|
38
|
+
semantics are in [landstrip(1)](../landstrip/man/man1/landstrip.1).
|
|
39
|
+
Runtime seccomp traps and query approval are Linux-only. On macOS, `--trap`
|
|
40
|
+
reports setup/launch errors only and closes on successful exec.
|
|
41
|
+
|
|
42
|
+
Worker read boundaries:
|
|
45
43
|
|
|
46
|
-
|
|
44
|
+
- Bootstrap grants can override bundled `denyRead` defaults, never persisted
|
|
45
|
+
global or trusted-project denies. Denied startup resources prevent launch.
|
|
46
|
+
Legacy copies of `/home` or `/Users` count as explicit denies: remove them only
|
|
47
|
+
if unintended; bundled defaults remain. New global files start as `{}`.
|
|
48
|
+
- `filesystem.denyReadAlways` cannot be overridden by equal/nested read grants
|
|
49
|
+
or shell host reads. Private workers protect parent auth-file and lock roots
|
|
50
|
+
with this policy and `denyWrite`. Non-empty `denyReadAlways` and private worker
|
|
51
|
+
auth are unsupported on Windows.
|
|
52
|
+
- External skill, prompt, and theme directories may need explicit discovery
|
|
53
|
+
access. Prefer resource file paths: resolved-file grants do not cover enclosing
|
|
54
|
+
directories.
|
|
47
55
|
|
|
48
|
-
|
|
49
|
-
|
|
56
|
+
## Agents and tasks
|
|
57
|
+
|
|
58
|
+
Configure `~/.pi/agent/landstrip.json`, trusted-project `.pi/landstrip.json`, or
|
|
59
|
+
`landstrip` in the corresponding Pi settings file. Global definitions load first.
|
|
50
60
|
|
|
51
61
|
```json
|
|
52
62
|
{
|
|
53
63
|
"maxSubagents": 2,
|
|
54
64
|
"toolFilesystemPolicy": "sandbox",
|
|
55
|
-
"permission": {
|
|
56
|
-
"task": { "*": "deny", "review": "allow" }
|
|
57
|
-
}
|
|
65
|
+
"permission": { "task": { "*": "deny", "review": "allow" } }
|
|
58
66
|
}
|
|
59
67
|
```
|
|
60
68
|
|
|
61
|
-
`maxSubagents` accepts 0
|
|
62
|
-
|
|
63
|
-
|
|
69
|
+
`maxSubagents` accepts 0–16. Agent definitions can override model, prompt, mode,
|
|
70
|
+
options, and permissions.
|
|
71
|
+
|
|
72
|
+
`/landstrip` opens the management pane; `/landstrip help` lists commands and
|
|
73
|
+
shortcuts. Common commands:
|
|
74
|
+
|
|
75
|
+
| Command | Action |
|
|
76
|
+
| --------------------------------- | ------------------------------- |
|
|
77
|
+
| `/landstrip status` | Inspect sandbox, agents, tasks. |
|
|
78
|
+
| `/landstrip settings` | Set concurrency/file policy. |
|
|
79
|
+
| `/landstrip sandbox [on\|off]` | Inspect/toggle OS isolation. |
|
|
80
|
+
| `/landstrip agents [@name]` | List/select primary agents. |
|
|
81
|
+
| `/landstrip subagents` | List process subagents. |
|
|
82
|
+
| `/landstrip tasks [list]` | List task sessions. |
|
|
83
|
+
| `/landstrip tasks kill <task-id>` | Terminate a task. |
|
|
84
|
+
| `/landstrip logs [task-id]` | Open task logs. |
|
|
85
|
+
|
|
86
|
+
Task IDs accept unique prefixes; bare IDs open logs in the pane.
|
|
87
|
+
`Ctrl+Shift+A` cycles primary agents while Pi is idle. The `task` tool accepts
|
|
88
|
+
`background: true` for immediate return and `task_id` to continue a saved task.
|
|
89
|
+
Press `Enter` in running/queued task logs to steer the worker.
|
|
90
|
+
|
|
91
|
+
### Worker environment and authentication
|
|
92
|
+
|
|
93
|
+
Workers start `--offline`: install resources and refresh model catalogs in the
|
|
94
|
+
parent first. Model/auth requests still need permitted endpoints.
|
|
64
95
|
|
|
65
|
-
|
|
96
|
+
Workers inherit only runtime paths, locale, certificate paths, and supported Pi
|
|
97
|
+
configuration—not parent API keys, tool tokens, proxy URLs, or arbitrary variables.
|
|
98
|
+
The parent refreshes selected-provider auth and sends it through a private Unix
|
|
99
|
+
pipe, never arguments or worker environment. Environment-based tool logins need
|
|
100
|
+
separate configuration; authenticated workers fail before spawning on Windows.
|
|
66
101
|
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
| `/landstrip sandbox [on\|off]` | Inspect or toggle OS isolation. |
|
|
72
|
-
| `/landstrip agents [@name]` | List or select the primary agent. |
|
|
73
|
-
| `/landstrip subagents` | List configured process subagents. |
|
|
74
|
-
| `/landstrip tasks [list]` | List task sessions. |
|
|
75
|
-
| `/landstrip tasks kill <task-id>` | Terminate one task session. |
|
|
76
|
-
| `/landstrip logs [task-id]` | Open task logs in the TUI. |
|
|
77
|
-
| `/landstrip help` | Open command and shortcut help. |
|
|
102
|
+
Selected Bedrock, Vertex, and Azure settings also travel privately. Ambient AWS
|
|
103
|
+
profiles need an explicit region for non-ARN models; custom credential-chain
|
|
104
|
+
environment paths are unsupported (use scoped keys or a Bedrock bearer token).
|
|
105
|
+
Provider credential files still need filesystem permission.
|
|
78
106
|
|
|
79
|
-
|
|
80
|
-
its logs. Task IDs may be shortened only to a unique prefix. `Ctrl+Shift+A`
|
|
81
|
-
cycles primary agents while Pi is idle.
|
|
107
|
+
## Development
|
|
82
108
|
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
In a running or queued task's log view, press `Enter` to send a steering message.
|
|
109
|
+
From this package: `npm ci`, then `npm run all` (format, lint, typecheck, build,
|
|
110
|
+
and tests; building requires Bun). For a read-only formatting check: `npm run ci:fmt`.
|
|
86
111
|
|
|
87
|
-
##
|
|
112
|
+
## License
|
|
88
113
|
|
|
89
|
-
|
|
90
|
-
for more information.
|
|
114
|
+
Apache-2.0; see [LICENSE](LICENSE).
|