pi-landstrip 0.20.1 → 0.20.2

package/README.md

@@ -15,8 +15,8 @@ unsandboxed execution.
 ## Permissions and configuration
 
 With sandboxing enabled, Bash (`bash`, `!`, `!!`) and workers are OS-isolated.
-Primary file tools remain in trusted Pi; `toolFilesystemPolicy: "sandbox"`
-adds policy checks, not isolation. Tool approval never bypasses hard denials.
+Primary file tools run in trusted Pi and preflight paths against the sandbox
+filesystem policy. Tool approval never bypasses hard denials.
 
 Configuration: bundled [`sandbox.json`](sandbox.json) → `~/.pi/agent/sandbox.json`
 → trusted-project `.pi/sandbox.json`. Arrays combine; later scalars win.
@@ -52,7 +52,6 @@ Configure `~/.pi/agent/landstrip.json`, trusted-project `.pi/landstrip.json`, or
 ```json
 {
   "maxSubagents": 2,
-  "toolFilesystemPolicy": "sandbox",
   "permission": { "task": { "*": "deny", "review": "allow" } }
 }
 ```

package/dist/index.ts

@@ -255,7 +255,6 @@ import {
   fuzzyFilter as fuzzyFilter2,
   matchesKey,
   Input,
-  SelectList,
   SettingsList,
   Text,
   truncateToWidth,
@@ -488,7 +487,6 @@ class PermissionPromptCoordinator {
 // config.ts
 var BUILT_IN_LANDSTRIP_CONFIG = {
   maxSubagents: 0,
-  toolFilesystemPolicy: "host",
   agent: {
     build: {
       description: "Implement and test requested changes",
@@ -561,7 +559,7 @@ function isProjectTrusted(ctx) {
   return trustContext.isProjectTrusted?.() ?? false;
 }
 var MAX_SUBAGENTS = 16;
-var LANDSTRIP_KEYS = ["maxSubagents", "agent", "permission", "toolFilesystemPolicy"];
+var LANDSTRIP_KEYS = ["maxSubagents", "agent", "permission"];
 var JSON_FORMAT = { formattingOptions: { insertSpaces: true, tabSize: 2, eol: `
 ` } };
 function ensureFinalNewline(content) {
@@ -625,12 +623,6 @@ function parseLandstripConfig(value, path, kind) {
   }
   if ("permission" in value)
     config.permission = value.permission;
-  if ("toolFilesystemPolicy" in value) {
-    if (value.toolFilesystemPolicy !== "host" && value.toolFilesystemPolicy !== "sandbox") {
-      throw new Error(`${path}: ${field("toolFilesystemPolicy")} must be host or sandbox`);
-    }
-    config.toolFilesystemPolicy = value.toolFilesystemPolicy;
-  }
   return config;
 }
 function readLandstripConfigSource(cwd, scope, agentDir) {
@@ -745,23 +737,6 @@ async function setMaxSubagentsConfigForScope(cwd, maxSubagents, scope, agentDir
 async function clearMaxSubagentsConfigForScope(cwd, scope, agentDir = getAgentDir()) {
   await writeMaxSubagentsConfigForScope(cwd, undefined, scope, agentDir);
 }
-async function writeToolFilesystemPolicyConfigForScope(cwd, policy, scope, agentDir) {
-  await updateLandstripConfigForScope(cwd, scope, agentDir, (landstrip) => {
-    if (policy === undefined)
-      delete landstrip.toolFilesystemPolicy;
-    else
-      landstrip.toolFilesystemPolicy = policy;
-  });
-}
-async function setToolFilesystemPolicyConfigForScope(cwd, policy, scope, agentDir = getAgentDir()) {
-  if (policy !== "host" && policy !== "sandbox") {
-    throw new Error("toolFilesystemPolicy must be host or sandbox");
-  }
-  await writeToolFilesystemPolicyConfigForScope(cwd, policy, scope, agentDir);
-}
-async function clearToolFilesystemPolicyConfigForScope(cwd, scope, agentDir = getAgentDir()) {
-  await writeToolFilesystemPolicyConfigForScope(cwd, undefined, scope, agentDir);
-}
 async function setAgentDisabledForScope(cwd, name, disabled, scope, agentDir = getAgentDir()) {
   await updateLandstripConfigForScope(cwd, scope, agentDir, (landstrip) => {
     if (landstrip.agent !== undefined && !isRecord2(landstrip.agent)) {
@@ -834,7 +809,6 @@ function loadLandstripConfig(cwd, includeProject = true, agentDir = getAgentDir(
   if (projectConfig)
     config = mergeValue(config, projectConfig);
   const maxSubagents = config.maxSubagents ?? 0;
-  const toolFilesystemPolicy = config.toolFilesystemPolicy ?? "host";
   if (!Number.isInteger(maxSubagents) || maxSubagents < 0 || maxSubagents > MAX_SUBAGENTS) {
     throw new Error(`maxSubagents must be an integer from 0 to ${MAX_SUBAGENTS}`);
   }
@@ -844,7 +818,6 @@ function loadLandstripConfig(cwd, includeProject = true, agentDir = getAgentDir(
     ...config,
     maxSubagents,
     agent: config.agent,
-    toolFilesystemPolicy,
     agentSources,
     agentPaths
   };
@@ -859,16 +832,6 @@ function loadMaxSubagentsSettings(cwd, includeProject = true, agentDir = getAgen
   }
   return { global, project };
 }
-function loadToolFilesystemPolicySettings(cwd, includeProject = true, agentDir = getAgentDir()) {
-  const global = loadLandstripConfig(cwd, false, agentDir).toolFilesystemPolicy;
-  if (!includeProject)
-    return { global };
-  const project = readLandstripConfigSource(cwd, "project", agentDir).config.toolFilesystemPolicy;
-  if (project !== undefined && project !== "host" && project !== "sandbox") {
-    throw new Error("toolFilesystemPolicy must be host or sandbox");
-  }
-  return { global, project };
-}
 
 // opencode-agents.ts
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
@@ -1121,7 +1084,6 @@ function validateAgentRaw(name, raw) {
 function loadAgentCatalog(cwd, piAgentDir = getAgentDir2(), includeProject = true) {
   const diagnostics = [];
   let maxSubagents = 0;
-  let toolFilesystemPolicy = "host";
   let configuredAgents = {};
   let configuredPermission;
   let agentSources = new Map;
@@ -1129,7 +1091,6 @@ function loadAgentCatalog(cwd, piAgentDir = getAgentDir2(), includeProject = tru
   try {
     const config = loadLandstripConfig(cwd, includeProject, piAgentDir);
     maxSubagents = config.maxSubagents;
-    toolFilesystemPolicy = config.toolFilesystemPolicy;
     configuredAgents = config.agent;
     configuredPermission = config.permission;
     agentSources = new Map(config.agentSources);
@@ -1194,7 +1155,7 @@ function loadAgentCatalog(cwd, piAgentDir = getAgentDir2(), includeProject = tru
   } catch (error) {
     diagnostics.push(formatError(error));
   }
-  return { agents: normalized, permissions, diagnostics, maxSubagents, toolFilesystemPolicy };
+  return { agents: normalized, permissions, diagnostics, maxSubagents };
 }
 function permissionMatches(pattern, permission) {
   return pattern === "*" || minimatch(permission, pattern, { dot: true });
@@ -1558,13 +1519,12 @@ var sandboxSubcommand = {
 };
 var settingsSubcommand = {
   name: "settings",
-  summary: "Manage concurrency and filesystem tool policies",
+  summary: "Manage subagent concurrency settings",
   pane: (argv) => argv.rest ? undefined : "settings",
   run: (_argv, { ctx }) => {
     const projectTrusted = isProjectTrusted(ctx);
     const maxSubagents = loadMaxSubagentsSettings(ctx.cwd, projectTrusted);
-    const policy = loadToolFilesystemPolicySettings(ctx.cwd, projectTrusted);
-    ctx.ui.notify(`Settings: maxSubagents=${maxSubagents.project ?? maxSubagents.global} · toolFilesystemPolicy=${policy.project ?? policy.global}`, "info");
+    ctx.ui.notify(`Settings: maxSubagents=${maxSubagents.project ?? maxSubagents.global}`, "info");
   }
 };
 var agentsSubcommand = {
@@ -3628,7 +3588,6 @@ class SubagentRuntime {
   primaryRules;
   primaryConfigurationError = false;
   maxSubagents = 0;
-  toolFilesystemPolicy = "host";
   primaryAgentSwitching = false;
   shuttingDown = false;
   activeSessionId;
@@ -3736,7 +3695,7 @@ ${this.primaryAgent.prompt}` };
         }
       }
       const filesystem = filesystemToolAccesses(event.toolName, input, ctx.cwd);
-      if (this.toolFilesystemPolicy === "sandbox" && filesystem) {
+      if (filesystem && typeof this.integration.authorizeFilesystemToolAccess === "function") {
         if (!filesystem.valid) {
           return { block: true, reason: `Filesystem path unavailable for ${event.toolName}` };
         }
@@ -3822,7 +3781,6 @@ ${this.primaryAgent.prompt}` };
     refreshDeletableAgents();
     let overview = this.integration.sandboxCallbacks?.overview?.(ctx.cwd, projectTrusted);
     let maxSubagentsSettings = loadMaxSubagentsSettings(ctx.cwd, projectTrusted);
-    let policySettings = loadToolFilesystemPolicySettings(ctx.cwd, projectTrusted);
     let settingsList;
     let saving = false;
     let confirmingSandboxDisable = false;
@@ -3935,9 +3893,8 @@ ${this.primaryAgent.prompt}` };
       const settingValue = (project, global) => project === undefined ? `${global} (global)` : String(project);
       const syncSettingsList = () => {
         settingsList?.updateValue("maxSubagents", settingValue(maxSubagentsSettings.project, maxSubagentsSettings.global));
-        settingsList?.updateValue("toolFilesystemPolicy", settingValue(policySettings.project, policySettings.global));
       };
-      const saveSetting = (id, value) => {
+      const saveSetting = (_id, value) => {
         if (!projectTrusted) {
           ctx.ui.notify("Project settings require a trusted project", "warning");
           syncSettingsList();
@@ -3945,35 +3902,24 @@ ${this.primaryAgent.prompt}` };
         }
         let save;
         let notifyMessage;
-        if (id === "maxSubagents") {
-          if (value === INHERIT || value === "") {
-            save = clearMaxSubagentsConfigForScope(ctx.cwd, "project");
-            notifyMessage = "Project maxSubagents inherits Global";
-          } else {
-            const parsed = Number(value);
-            if (!/^\d+$/.test(value) || !Number.isSafeInteger(parsed) || parsed < 0 || parsed > MAX_SUBAGENTS) {
-              ctx.ui.notify(`Enter a whole number between 0 and ${MAX_SUBAGENTS}`, "error");
-              syncSettingsList();
-              return;
-            }
-            save = setMaxSubagentsConfigForScope(ctx.cwd, parsed, "project");
-            notifyMessage = `Project maxSubagents = ${parsed}`;
-          }
-        } else if (value === INHERIT) {
-          save = clearToolFilesystemPolicyConfigForScope(ctx.cwd, "project");
-          notifyMessage = "Project toolFilesystemPolicy inherits Global";
+        if (value === INHERIT || value === "") {
+          save = clearMaxSubagentsConfigForScope(ctx.cwd, "project");
+          notifyMessage = "Project maxSubagents inherits global setting";
         } else {
-          const policy = value === "host" ? "host" : "sandbox";
-          save = setToolFilesystemPolicyConfigForScope(ctx.cwd, policy, "project");
-          notifyMessage = `Project toolFilesystemPolicy = ${policy}`;
+          const parsed = Number(value);
+          if (!/^\d+$/.test(value) || !Number.isSafeInteger(parsed) || parsed < 0 || parsed > MAX_SUBAGENTS) {
+            ctx.ui.notify(`Enter a whole number between 0 and ${MAX_SUBAGENTS}`, "error");
+            syncSettingsList();
+            return;
+          }
+          save = setMaxSubagentsConfigForScope(ctx.cwd, parsed, "project");
+          notifyMessage = `Project maxSubagents = ${parsed}`;
         }
         saving = true;
         tui.requestRender();
         save.then(() => {
           maxSubagentsSettings = loadMaxSubagentsSettings(ctx.cwd, projectTrusted);
-          policySettings = loadToolFilesystemPolicySettings(ctx.cwd, projectTrusted);
           this.setMaxSubagents(maxSubagentsSettings.project ?? maxSubagentsSettings.global);
-          this.toolFilesystemPolicy = policySettings.project ?? policySettings.global;
           ctx.ui.notify(notifyMessage, "info");
         }).catch((error) => ctx.ui.notify(`Could not save setting: ${formatError(error)}`, "error")).finally(() => {
           saving = false;
@@ -3986,7 +3932,7 @@ ${this.primaryAgent.prompt}` };
           id: "maxSubagents",
           label: "Maximum Subagents",
           currentValue: settingValue(maxSubagentsSettings.project, maxSubagentsSettings.global),
-          description: "Concurrent subagent tasks. Enter to edit, empty to inherit Global.",
+          description: "Concurrent subagent tasks. Enter to edit, empty to inherit global setting.",
           submenu: (_currentValue, doneEditing) => {
             const input = new Input;
             input.focused = true;
@@ -3998,38 +3944,6 @@ ${this.primaryAgent.prompt}` };
             input.onEscape = () => doneEditing(undefined);
             return input;
           }
-        },
-        {
-          id: "toolFilesystemPolicy",
-          label: "Filesystem Tool Policy",
-          currentValue: settingValue(policySettings.project, policySettings.global),
-          description: "How file tools resolve paths. Enter to choose.",
-          submenu: (_currentValue, doneEditing) => {
-            const options = [
-              {
-                value: INHERIT,
-                label: "inherit",
-                description: `Use Global (${policySettings.global})`
-              },
-              { value: "host", label: "host", description: "Resolve paths on the host" },
-              {
-                value: "sandbox",
-                label: "sandbox",
-                description: "Resolve paths inside the sandbox"
-              }
-            ];
-            const list = new SelectList(options, options.length, {
-              selectedPrefix: (text) => theme.fg("accent", text),
-              selectedText: (text) => theme.fg("accent", text),
-              description: (text) => theme.fg("dim", text),
-              scrollInfo: (text) => theme.fg("dim", text),
-              noMatch: (text) => theme.fg("dim", text)
-            });
-            list.setSelectedIndex(options.findIndex((option) => option.value === (policySettings.project ?? INHERIT)));
-            list.onSelect = (item) => doneEditing(item.value);
-            list.onCancel = () => doneEditing(undefined);
-            return list;
-          }
         }
       ];
       settingsList = new SettingsList(items, INSPECTOR_BODY_LINES, {
@@ -6296,7 +6210,6 @@ ${renderTaskResult(task.id, failed ? "error" : "completed", value)}`;
     this.primaryConfigurationError = false;
     const catalog = this.loadCatalog(ctx.cwd, getAgentDir4(), isProjectTrusted(ctx));
     this.maxSubagents = catalog.maxSubagents;
-    this.toolFilesystemPolicy = catalog.toolFilesystemPolicy;
     this.semaphore = new Semaphore(this.maxSubagents);
     if (catalog.diagnostics.length > 0) {
       this.invalidatePrimaryAgent(catalog, ctx);
@@ -6365,7 +6278,6 @@ ${renderTaskResult(task.id, failed ? "error" : "completed", value)}`;
       return false;
     this.primaryAgent = agent;
     this.primaryRules = mergePermissionRules(catalog.permissions, agent.permissions);
-    this.toolFilesystemPolicy = catalog.toolFilesystemPolicy;
     this.primaryConfigurationError = false;
     this.broker.reset();
     this.pi.registerTool(this.createTaskTool(undefined, this.primaryRules, ctx));
@@ -7087,8 +6999,16 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
         return [`${access.operation}\x00${path}`, { ...access, path }];
       })).values()
     ];
+    if (getNoSandboxFlag())
+      return { allowed: true, prompted: false };
+    const blockedAccesses = (config) => {
+      const enforceReads = enforcesShellReadPolicy(config.shell.readAccess);
+      return normalized.filter((access) => access.operation === "read" ? enforceReads && !readAllowed(access.path, getEffectiveAllowRead(config, ctx.cwd), getEffectiveDenyRead(config, ctx.cwd), ctx.cwd) : shouldPromptForWrite(access.path, getEffectiveAllowWrite(config), ctx.cwd));
+    };
     const current = () => {
       const config = loadConfig(ctx.cwd);
+      if (!config.enabled)
+        return { allowed: true, prompted: false };
       for (const access of normalized) {
         if (matchesPattern(access.path, access.operation === "read" ? config.filesystem.denyReadAlways : mergeArray(config.filesystem.denyWriteAlways, config.filesystem.denyWrite), ctx.cwd)) {
           return {
@@ -7098,8 +7018,7 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
           };
         }
       }
-      const blocked = normalized.filter((access) => access.operation === "read" ? !readAllowed(access.path, getEffectiveAllowRead(config, ctx.cwd), getEffectiveDenyRead(config, ctx.cwd), ctx.cwd) : shouldPromptForWrite(access.path, getEffectiveAllowWrite(config), ctx.cwd));
-      return blocked.length === 0 ? { allowed: true, prompted: false } : undefined;
+      return blockedAccesses(config).length === 0 ? { allowed: true, prompted: false } : undefined;
     };
     const existing = current();
     if (existing)
@@ -7108,8 +7027,7 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
       return { allowed: false, prompted: false, reason: "Filesystem access requires approval" };
     }
     return permissionPrompts.resolve(current, async (promptSignal) => {
-      const config = loadConfig(ctx.cwd);
-      const blocked = normalized.filter((access) => access.operation === "read" ? !readAllowed(access.path, getEffectiveAllowRead(config, ctx.cwd), getEffectiveDenyRead(config, ctx.cwd), ctx.cwd) : shouldPromptForWrite(access.path, getEffectiveAllowWrite(config), ctx.cwd));
+      const blocked = blockedAccesses(loadConfig(ctx.cwd));
       const paths = blocked.map(({ operation, path }) => `${operation}: ${path}`).join(`
 `);
       const note = options.authorizationNote ? `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.20.1",
+    "@landstrip/landstrip-api": "^0.20.2",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "undici": "^8.9.0",