@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/src/config.ts

@@ -2,6 +2,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { digest, textDigest } from './protocol.js';
+import { PI_PROVIDERS } from './provider-config.js';
 import { packageDigest } from './package-digest.js';
 
 let root = dirname(fileURLToPath(import.meta.url));
@@ -19,7 +20,7 @@ export const PI_ROOT = resolve(
 export const PI_CLI = join(PI_ROOT, 'dist/bundle/cli.js');
 export const HOUSE_EXTENSION = join(ROOT, 'dist/src/house-extension.js');
 export const POLICY = {
-  version: 6,
+  version: 14,
   tools: [
     'salaam_probe',
     'salaam_review',
@@ -30,6 +31,9 @@ export const POLICY = {
     'salaam_history',
     'salaam_files',
     'salaam_command',
+    'salaam_repository',
+    'salaam_findings',
+    'salaam_team',
   ],
   children: {
     maxDepth: 1,
@@ -37,13 +41,23 @@ export const POLICY = {
     parentRequestBudget: 16,
     maxChildRequestBudget: 8,
     authority: ['salaam_probe'],
+    worker_boundary: 'frozen-native-model-request-v1',
+    specialist_profiles: 'operator-admitted-snapshot-v1',
+    team_claims: 'task-step-generation-v1',
+    daemon_workers: 8,
+    messages: 'passive-durable-explicit-ack-v1',
+    writing: 'owned-draft-explicit-hash-bound-integration-v1',
+    external: 'operator-pinned-whole-runtime-explicit-invocation-v1',
+    a2a: 'pinned-peer-one-turn-analysis-explicit-invocation-v1',
   },
   providers: [
     'salaam-proof/scripted',
-    'anthropic/claude-sonnet-5-5',
-    'anthropic/claude-sonnet-4-6',
+    ...PI_PROVIDERS.flatMap((provider) =>
+      provider.getModels().map((model) => provider.id + '/' + model.id),
+    ).sort(),
   ],
   provider_retries: 0,
+  task_token_budget: 'capped-default-explicit-null-opt-out-v1',
   compaction: { strategy: 'explicit-task-checkpoint-v1', automatic: false, keepRecentTokens: 512 },
   external_effects: 'explicit-connector-and-operation-approval',
   coding: {
@@ -80,9 +94,26 @@ export function bundleDigest(): string {
     policy: POLICY_DIGEST,
     lock: textDigest(readFileSync(lockPath, 'utf8')),
     house: textDigest(readFileSync(HOUSE_EXTENSION, 'utf8')),
+    provider_usage: textDigest(readFileSync(join(ROOT, 'dist/src/provider-usage.js'), 'utf8')),
+    provider_model: textDigest(readFileSync(join(ROOT, 'dist/src/provider-model.js'), 'utf8')),
+    live_provider: textDigest(readFileSync(join(ROOT, 'dist/src/live-provider.js'), 'utf8')),
+    provider_payload: textDigest(readFileSync(join(ROOT, 'dist/src/provider-payload.js'), 'utf8')),
+    provider_transport: textDigest(
+      readFileSync(join(ROOT, 'dist/src/provider-transport.js'), 'utf8'),
+    ),
+    provider_auth: textDigest(readFileSync(join(ROOT, 'dist/src/provider-auth.js'), 'utf8')),
     claude: textDigest(readFileSync(join(ROOT, 'dist/src/claude-provider.js'), 'utf8')),
     provider_config: textDigest(readFileSync(join(ROOT, 'dist/src/provider-config.js'), 'utf8')),
     protocol: textDigest(readFileSync(join(ROOT, 'dist/src/protocol.js'), 'utf8')),
+    worker_boundary: textDigest(readFileSync(join(ROOT, 'dist/src/worker-boundary.js'), 'utf8')),
+    agent_profiles: textDigest(readFileSync(join(ROOT, 'dist/src/agent-profiles.js'), 'utf8')),
+    team_work: textDigest(readFileSync(join(ROOT, 'dist/src/team-work.js'), 'utf8')),
+    worker_workspaces: textDigest(
+      readFileSync(join(ROOT, 'dist/src/worker-workspaces.js'), 'utf8'),
+    ),
+    repository_snapshots: textDigest(
+      readFileSync(join(ROOT, 'dist/src/repository-snapshots.js'), 'utf8'),
+    ),
     transport: textDigest(readFileSync(join(ROOT, 'dist/src/transport.js'), 'utf8')),
   });
 }

package/src/credentials.ts

@@ -73,7 +73,10 @@ export function saveApiKey(value: string, path = credentialPath()): void {
     closeSync(directory);
   }
 }
-export async function readSecret(): Promise<string> {
+export async function readSecret(
+  label = 'Claude API key (hidden): ',
+  signal?: AbortSignal,
+): Promise<string> {
   if (!process.stdin.isTTY) {
     let input = '';
     for await (const chunk of process.stdin) {
@@ -82,7 +85,7 @@ export async function readSecret(): Promise<string> {
     }
     return input;
   }
-  process.stderr.write('Claude API key (hidden): ');
+  process.stderr.write(label);
   const stdin = process.stdin,
     wasRaw = stdin.isRaw;
   stdin.setRawMode(true);
@@ -90,6 +93,7 @@ export async function readSecret(): Promise<string> {
   return new Promise((resolve, reject) => {
     let key = '';
     const done = (error?: Error) => {
+      signal?.removeEventListener('abort', aborted);
       stdin.off('data', data);
       stdin.setRawMode(wasRaw);
       stdin.pause();
@@ -117,6 +121,9 @@ export async function readSecret(): Promise<string> {
         }
       }
     };
+    const aborted = () => done(new Error('Credential entry cancelled'));
+    signal?.addEventListener('abort', aborted, { once: true });
     stdin.on('data', data);
+    if (signal?.aborted) aborted();
   });
 }

package/src/external-runtime.ts

@@ -0,0 +1,54 @@
+import type { HarnessCheckpoint } from './harness-protocol.js';
+import type { HarnessTarget } from './harness-probe.js';
+import type { WorkerBinding } from './worker-boundary.js';
+import type { WorkspaceTree } from './workspaces.js';
+import type { A2ACheckpoint } from './a2a-protocol.js';
+
+export type ExternalCheckpoint = HarnessCheckpoint | A2ACheckpoint;
+
+/** Operator configuration only. Project profiles cannot select executables, endpoints or credentials. */
+export interface ExternalRuntime {
+  id: string;
+  kind: 'harness' | 'a2a';
+  target: HarnessTarget | 'a2a';
+  version: string;
+  config_digest: string;
+  adapter_digest: string;
+  execution_identity: { version: string; kernel: string; arch: string };
+  boundary_digest: string;
+  engine_id: string;
+  evidence: 'proven' | 'fixture';
+  model_usage: 'unknown';
+  provider_route?: { provider: string; model: string; wire: string; wire_model: string };
+  output_cap: number | null;
+  max_model_requests: number | null;
+  files: boolean;
+  commands: boolean;
+}
+export interface ExternalHooks {
+  failed(error: Error): void;
+  modelRequest(id: string, bytes: number, output: number): void;
+  checkpoint(value: ExternalCheckpoint): undefined;
+  receipt(value: unknown): undefined;
+  permission(method: string, params: Record<string, unknown>): Promise<'approve' | 'deny'>;
+  toolResult(id: string, success: boolean, receipt: unknown): void;
+  assertActive(): void;
+}
+export interface ExternalBackend {
+  prepare?(): Promise<void>;
+  close?(): Promise<void>;
+  runtimes(): ExternalRuntime[];
+  validate(runtime: ExternalRuntime): void;
+  assertAuthority?(runtime: ExternalRuntime, tools: readonly string[]): void;
+  execute(
+    binding: WorkerBinding,
+    run: string,
+    prompt: string,
+    tree: WorkspaceTree,
+    hooks: ExternalHooks,
+  ): Promise<{ result: unknown }>;
+  /** Read only after stop has confirmed all owned processes are gone. */
+  collect(run: string, runtime: ExternalRuntime): WorkspaceTree;
+  /** Must reconcile owned resources by durable run ID even if creation's reply was lost. */
+  stop(run: string, runtime: ExternalRuntime, receipt: unknown): Promise<unknown>;
+}