@superjackfruitlabs/salaam 0.0.2 → 0.0.4

package/dist/src/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { SANDBOX_LEVELS } from './command-sandbox.js';
 import { acp } from './acp.js';
 import { homedir } from 'node:os';
 import { join, resolve, dirname } from 'node:path';
@@ -6,9 +7,12 @@ import { spawn } from 'node:child_process';
 import { randomUUID, randomBytes } from 'node:crypto';
 import { digest, object } from './protocol.js';
 import { fileURLToPath } from 'node:url';
-import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync, fsyncSync, } from 'node:fs';
+import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync, fsyncSync, existsSync, } from 'node:fs';
 import { VERSION } from './config.js';
 import { cliHelp, hasHelpFlag } from './cli-help.js';
+import { mcpCli, MCP_HELP } from './operator-mcp-cli.js';
+import { operatorMcpPath, readOperatorMcpFile } from './operator-mcp.js';
+import { defaultAgentPodConfig } from './agentpod-default-config.js';
 import { SalaamService } from './service.js';
 import { call } from './transport.js';
 import { attach, acquireControl, Outbox } from './attach.js';
@@ -29,6 +33,17 @@ async function main() {
         console.log('salaam ' + VERSION);
         return;
     }
+    if (args[0] === 'mcp') {
+        // Parsed before global help: a declared command's own flags follow "--".
+        const rest = args.slice(1);
+        const dash = rest.indexOf('--');
+        const flags = dash < 0 ? rest : rest.slice(0, dash);
+        if (!rest.length || flags.includes('--help') || flags.includes('-h'))
+            console.log(MCP_HELP);
+        else
+            console.log(mcpCli(rest));
+        return;
+    }
     if ((!args.length && !(process.stdin.isTTY && process.stdout.isTTY)) ||
         args[0] === 'help' ||
         hasHelpFlag(args)) {
@@ -388,7 +403,24 @@ async function main() {
         return;
     }
     if (group === 'host') {
-        const { planHost, readHost, hostUnit, runHost } = await import('./host.js');
+        const { planHost, readHost, hostUnit, runHost, hostReceipt, hostToolsUser, hostApprovalTtlMs, hostAllowsUnsandboxed, hostCommandNetwork, } = await import('./host.js');
+        if (verb?.startsWith('config-')) {
+            const file = option('--manifest');
+            if (!file)
+                throw Error('Supply --manifest FILE');
+            const { hostConfiguration } = await import('./host-configuration.js');
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of process.stdin) {
+                const data = Buffer.from(chunk);
+                size += data.length;
+                if (size > 65536)
+                    throw Error('Configuration request exceeds limit');
+                chunks.push(data);
+            }
+            console.log(JSON.stringify(await hostConfiguration(resolve(file), verb.slice(7), JSON.parse(Buffer.concat(chunks).toString('utf8')))));
+            return;
+        }
         if (verb === 'plan') {
             const file = option('--config');
             if (!file)
@@ -396,6 +428,42 @@ async function main() {
             console.log(JSON.stringify(await planHost(JSON.parse(readFileSync(resolve(file), 'utf8'))), null, 2));
             return;
         }
+        if (verb === 'bind') {
+            const { bindHost } = await import('./host-bind.js');
+            const required = (name) => {
+                const v = option(name);
+                if (!v)
+                    throw new Error('Supply ' + name);
+                return v;
+            };
+            console.log(JSON.stringify(await bindHost({
+                organization_id: required('--organization'),
+                node_id: required('--node'),
+                station_key: required('--station-key'),
+                workspace: required('--workspace'),
+                tools_user: required('--tools-user'),
+                files: required('--files'),
+                runtime_root: required('--runtime-root'),
+                runtime_image_digest: required('--runtime-image-digest'),
+                operator_group: option('--operator-group'),
+                dir: option('--dir'),
+                state: explicitState ? state : undefined,
+                provider: option('--provider'),
+                model: option('--model'),
+                mcp_config: option('--mcp-config'),
+                persona: option('--persona'),
+                managed_mcp_config: option('--managed-mcp-config'),
+            })));
+            return;
+        }
+        if (verb === 'unit-start') {
+            const { startHostUnit } = await import('./host-start.js');
+            const unit = option('--unit');
+            if (!unit || !explicitState)
+                throw new Error('Supply --unit UNIT and --state DIR');
+            console.log(JSON.stringify(await startHostUnit(unit, state)));
+            return;
+        }
         const file = option('--manifest');
         if (!file)
             throw new Error('Supply --manifest FILE');
@@ -424,13 +492,42 @@ async function main() {
             await runHost(file);
             return;
         }
+        if (verb === 'start') {
+            const { startHost } = await import('./host-start.js');
+            console.log(JSON.stringify(await startHost(file)));
+            return;
+        }
         if (verb === 'serve') {
             const m = readHost(file), service = await SalaamService.open({
                 stateDir: m.state,
-                codingRoot: m.coding_root,
-                codingSocket: m.coding_socket,
+                ...(m.schema === 1
+                    ? { codingRoot: m.coding_root, codingSocket: m.coding_socket, expectedExecution: m }
+                    : {
+                        agentpodConfig: m.agentpod_config,
+                        ...((m.schema === 3 || m.schema === 4 || m.schema === 5 || m.schema === 6) &&
+                            m.managed_mcp
+                            ? { managedMcp: m.managed_mcp }
+                            : {}),
+                        ...((m.schema === 4 || m.schema === 5 || m.schema === 6) && m.managed_toolkit
+                            ? { managedToolkitConfig: m.managed_toolkit }
+                            : {}),
+                        ...(m.schema === 5 || m.schema === 6 ? { stationConfig: m.station_execution } : {}),
+                        ...(m.schema === 6 ? { agentpodWorkProgression: true } : {}),
+                        ...(m.schema === 6 && m.operator_access
+                            ? { operatorAccess: m.operator_access }
+                            : {}),
+                        ...(m.schema === 6 && m.operator_mcp
+                            ? { operatorMcpConfig: m.operator_mcp.config }
+                            : {}),
+                        ...(m.schema === 6 && m.persona ? { personaConfig: m.persona } : {}),
+                    }),
+                hostManifestDigest: digest(m),
+                hostReceipt: hostReceipt(m),
+                toolsUser: hostToolsUser(m),
                 providerRoute: m.provider,
-                expectedExecution: m,
+                approvalTtlMs: hostApprovalTtlMs(m),
+                ...(hostAllowsUnsandboxed(m) ? { unsandboxedCommands: 'allow' } : {}),
+                ...(hostCommandNetwork(m) ? { commandNetwork: hostCommandNetwork(m) } : {}),
             });
             if (process.connected)
                 process.once('disconnect', () => void service.close());
@@ -441,7 +538,7 @@ async function main() {
                 process.disconnect?.();
             return;
         }
-        throw new Error('Use host plan, unit, run or inspect');
+        throw new Error('Use host plan, start, unit, run or inspect');
     }
     if (group === 'remote' && verb) {
         const { remote } = await import('./remote.js');
@@ -1078,6 +1175,54 @@ async function main() {
         }), null, 2));
         return;
     }
+    if (group === 'session' && verb === 'revocation' && id) {
+        console.log(JSON.stringify(await call(socket, `/v1/sessions/${id}/revocation`), null, 2));
+        return;
+    }
+    if (group === 'session' && verb === 'revoke' && id) {
+        const reason = option('--reason');
+        if (!reason)
+            throw new Error('Supply --reason');
+        const request_id = option('--request-id') ?? randomUUID();
+        const saved = await call(socket, `/v1/sessions/${id}/revocation`);
+        if (saved?.request_id === request_id && saved.session_id === id) {
+            if (saved.reason !== reason)
+                throw new Error('Request ID already binds a different reason');
+            console.log(JSON.stringify(saved, null, 2));
+            return;
+        }
+        const client = randomUUID();
+        const lease = await acquireControl(socket, id, client, args.includes('--takeover'));
+        const controller = { client_id: client, token: lease.token };
+        try {
+            console.log(JSON.stringify({ request_id }));
+            for (let retry = 0;; retry++) {
+                const snapshot = await call(socket, `/v1/sessions/${id}/snapshot`);
+                try {
+                    console.log(JSON.stringify(await call(socket, `/v1/sessions/${id}/revoke`, {
+                        ...controller,
+                        request_id,
+                        expected_revision: snapshot.revision,
+                        reason,
+                    }), null, 2));
+                    break;
+                }
+                catch (error) {
+                    if (error.code !== 'revision_conflict' || retry >= 7)
+                        throw error;
+                }
+            }
+        }
+        finally {
+            await call(socket, `/v1/sessions/${id}/control`, {
+                ...controller,
+                request_id: randomUUID(),
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
     if (group === 'session' && verb === 'cancel' && id) {
         const attempt = option('--attempt');
         if (!attempt)
@@ -1163,16 +1308,25 @@ async function main() {
         }
         const effectSocket = option('--effect-socket');
         const opaque = args.includes('--effect-opaque');
-        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), a2aListenConfig = option('--a2a-listen-config');
+        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), agentpodConfig = option('--agentpod-config') ?? defaultAgentPodConfig(process.env, existsSync), a2aListenConfig = option('--a2a-listen-config'), mcpConfig = resolve(option('--mcp-config') ?? operatorMcpPath(process.env)), toolsUser = option('--tools-user') ?? (process.env.SALAAM_TOOLS_USER || undefined), localSandbox = option('--local-sandbox') ?? (process.env.SALAAM_LOCAL_SANDBOX || undefined), unsandboxedCommands = option('--unsandboxed-commands') ?? (process.env.SALAAM_UNSANDBOXED_COMMANDS || undefined);
+        if (localSandbox !== undefined && !SANDBOX_LEVELS.includes(localSandbox))
+            throw Error('--local-sandbox is read-only, workspace-write or full-access');
+        if (unsandboxedCommands !== undefined && unsandboxedCommands !== 'allow')
+            throw Error('--unsandboxed-commands is allow or absent');
         if (foreground) {
             const service = await SalaamService.open({
                 stateDir: state,
                 providerRoute: route,
+                agentpodConfig: agentpodConfig ? resolve(agentpodConfig) : undefined,
+                operatorMcpConfig: mcpConfig,
                 codingRoot: codingRoot ? resolve(codingRoot) : undefined,
                 codingSocket: codingSocket ? resolve(codingSocket) : undefined,
                 harnessConfig: harnessConfig ? resolve(harnessConfig) : undefined,
                 a2aConfig: a2aConfig ? resolve(a2aConfig) : undefined,
                 a2aListenConfig: a2aListenConfig ? resolve(a2aListenConfig) : undefined,
+                toolsUser,
+                ...(localSandbox ? { localSandbox: localSandbox } : {}),
+                ...(unsandboxedCommands ? { unsandboxedCommands: 'allow' } : {}),
                 effectConnector: effectSocket
                     ? new SocketEffectConnector(resolve(effectSocket), { opaque })
                     : undefined,
@@ -1180,6 +1334,9 @@ async function main() {
             const warning = service.supervisor.providerCapabilities().warning;
             if (warning)
                 console.error(warning);
+            // Only a live provider has a credential to share; the offline proof route stays quiet.
+            if (service.toolIdentity.warning && route.provider !== 'salaam-proof')
+                console.error('warning: ' + service.toolIdentity.warning);
             process.stdout.write(JSON.stringify({ socket, service: 'started' }) + '\n');
             for (const signal of ['SIGINT', 'SIGTERM'])
                 process.once(signal, () => {
@@ -1197,11 +1354,21 @@ async function main() {
         }
         catch { }
         if (health) {
+            if ((health.agentpod_config ?? null) !== (agentpodConfig ? resolve(agentpodConfig) : null) ||
+                (agentpodConfig &&
+                    health.agentpod_pins_digest !==
+                        digest(JSON.parse(readFileSync(resolve(agentpodConfig), 'utf8')))))
+                throw new Error('Service is already running with different AgentPod authority pins; stop it first');
             if (canonical(health.provider_route ?? providerRoute()) !== canonical(route))
                 throw new Error('Service is already running with another provider route; stop it first');
             if ((health.coding_root ?? null) !== (codingRoot ? resolve(codingRoot) : null) ||
                 (health.coding_socket ?? null) !== (codingSocket ? resolve(codingSocket) : null))
                 throw new Error('Service is already running with another coding configuration; stop it first');
+            if ((health.operator_mcp?.config ?? null) !== mcpConfig)
+                throw new Error('Service is already running with another MCP config; stop it first');
+            if (health.operator_mcp &&
+                health.operator_mcp.digest !== digest(readOperatorMcpFile(mcpConfig)))
+                console.error('Declared MCP servers changed since the service started; run salaam service stop, then start, to apply them');
             console.log('Salaam service already running');
             return;
         }
@@ -1225,7 +1392,13 @@ async function main() {
             ...(codingSocket ? ['--coding-socket', resolve(codingSocket)] : []),
             ...(harnessConfig ? ['--harness-config', resolve(harnessConfig)] : []),
             ...(a2aConfig ? ['--a2a-config', resolve(a2aConfig)] : []),
+            ...(agentpodConfig ? ['--agentpod-config', resolve(agentpodConfig)] : []),
             ...(a2aListenConfig ? ['--a2a-listen-config', resolve(a2aListenConfig)] : []),
+            '--mcp-config',
+            mcpConfig,
+            ...(toolsUser ? ['--tools-user', toolsUser] : []),
+            ...(localSandbox ? ['--local-sandbox', localSandbox] : []),
+            ...(unsandboxedCommands ? ['--unsandboxed-commands', 'allow'] : []),
         ], { detached: true, stdio: ['ignore', fd, fd] });
         closeSync(fd);
         child.unref();
@@ -1263,6 +1436,23 @@ async function main() {
             cwd,
             request_id: requestId,
             ...(args.includes('--coding') ? { coding: true } : {}),
+            ...(args.includes('--local') || args.includes('--local-coding')
+                ? {
+                    local_workspace: true,
+                    ...(args.includes('--local-coding') ? { local_coding: true } : {}),
+                    ...(option('--provider')
+                        ? {
+                            route: {
+                                provider: option('--provider'),
+                                model: option('--model'),
+                                max_tokens: option('--max-output-tokens')
+                                    ? Number(option('--max-output-tokens'))
+                                    : undefined,
+                            },
+                        }
+                        : {}),
+                }
+                : {}),
         }), null, 2));
         return;
     }

package/dist/src/coding.js

@@ -33,6 +33,7 @@ export class CodingWork {
         };
     }
     assertSafe(session) {
+        this.store.execution.assert(session);
         if (this.store.db
             .prepare("SELECT 1 FROM command_runs WHERE session_id=? AND state='outcome_unknown'")
             .get(session))
@@ -190,17 +191,39 @@ export class CodingWork {
         let run = this.get(session, id);
         if (run.profile_digest !== backend.profileDigest || run.engine_id !== backend.engineId)
             throw new Error('Executor identity changed');
+        const cancelled = () => !!this.get(session, id).cancelled || !!this.store.execution.revocation(session);
+        const stopCancelled = () => this.finish(this.get(session, id), 'cancelled', null, 'Cancellation requested before further execution');
+        if (cancelled()) {
+            await stopCancelled();
+            return;
+        }
         if (run.state === 'accepted') {
             this.materialize(run);
             this.transition(run, 'creating');
             const container = await backend.create(this.source(run), id);
             this.transition(run, 'created', { container_id: container });
+            if (cancelled()) {
+                await stopCancelled();
+                return;
+            }
             run = this.get(session, id);
             await backend.start(container, this.source(run), id);
+            if (cancelled()) {
+                await stopCancelled();
+                return;
+            }
             await backend.ready(container, id);
+            if (cancelled()) {
+                await stopCancelled();
+                return;
+            }
             this.transition(run, 'exec_creating');
             const exec = await backend.exec(container, id, run.command, run.cwd);
             this.transition(run, 'launching', { exec_id: exec });
+            if (cancelled()) {
+                await stopCancelled();
+                return;
+            }
             await backend.launch(exec);
             this.transition(run, 'running');
             run = this.get(session, id);

package/dist/src/command-network.js

@@ -0,0 +1,200 @@
+import { createServer, connect } from 'node:net';
+import { chmodSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Network for local commands through the broker allowlist (operator rulings 2026-10-30). A command
+ * has no network of its own; its only route out is stk's `local-commands` socket, where every
+ * connection is the `local-commands` identity and only `servers.local-commands.egress.hosts`
+ * decides. Salaam puts a relay of its own in between, outside the sandbox, so what a command
+ * reached is counted where the command cannot touch it.
+ *
+ * Linux: the relay listens on a unix socket in a private directory bound into the bubblewrap
+ * sandbox; inside, `inSandboxRelaySource` bridges 127.0.0.1:COMMAND_NETWORK_PORT to it and then
+ * starts the command. macOS: the relay listens on 127.0.0.1:<ephemeral>, the only address the
+ * Seatbelt profile lets the command connect to.
+ */
+export const COMMAND_NETWORK_PORT = 3128;
+export const DEFAULT_COMMAND_NETWORK_SOCKET = '/run/stk/local-commands.sock';
+const MAX_TARGETS = 32;
+const MAX_REASON = 300;
+export class BrokerRelay {
+    server;
+    broker;
+    port;
+    path;
+    dir;
+    counts = new Map();
+    truncated = false;
+    unavailable = false;
+    sockets = new Set();
+    constructor(server, broker, port, path, dir) {
+        this.server = server;
+        this.broker = broker;
+        this.port = port;
+        this.path = path;
+        this.dir = dir;
+    }
+    /** `tcp`: 127.0.0.1:<ephemeral> (macOS). `unix`: a socket in a new private directory (Linux),
+     * readable by the command's user so a tools-user command can reach it. */
+    static async start(broker, mode) {
+        let relay;
+        const server = createServer((client) => relay.handle(client));
+        if (mode === 'tcp') {
+            await new Promise((resolve, reject) => {
+                server.once('error', reject);
+                server.listen(0, '127.0.0.1', () => resolve());
+            });
+            relay = new BrokerRelay(server, broker, server.address().port, null, null);
+        }
+        else {
+            const dir = mkdtempSync(join(tmpdir(), 'salaam-net-'));
+            chmodSync(dir, 0o755);
+            const path = join(dir, 'relay.sock');
+            await new Promise((resolve, reject) => {
+                server.once('error', reject);
+                server.listen(path, () => resolve());
+            });
+            chmodSync(path, 0o666);
+            relay = new BrokerRelay(server, broker, null, path, dir);
+        }
+        return relay;
+    }
+    /** A client connection to this relay, for tests. */
+    connect() {
+        return this.path ? connect(this.path) : connect(this.port, '127.0.0.1');
+    }
+    record(target, allowed, reason) {
+        let entry = this.counts.get(target);
+        if (!entry) {
+            if (this.counts.size >= MAX_TARGETS) {
+                this.truncated = true;
+                return;
+            }
+            entry = { allowed: 0, refused: 0 };
+            this.counts.set(target, entry);
+        }
+        if (allowed)
+            entry.allowed++;
+        else {
+            entry.refused++;
+            if (reason && !entry.reason)
+                entry.reason = reason.slice(0, MAX_REASON);
+        }
+    }
+    handle(client) {
+        this.sockets.add(client);
+        client.on('close', () => this.sockets.delete(client));
+        client.on('error', () => { });
+        let head = Buffer.alloc(0);
+        const onHead = (chunk) => {
+            head = Buffer.concat([head, chunk]);
+            const end = head.indexOf('\r\n');
+            if (end < 0) {
+                if (head.length > 8192)
+                    client.destroy();
+                return;
+            }
+            client.off('data', onHead);
+            client.pause();
+            const line = head.subarray(0, end).toString('latin1');
+            const connectLine = /^CONNECT (\S+) HTTP\/1\.[01]$/.exec(line);
+            const absolute = /^[A-Z]+ http:\/\/([^/\s]+)/.exec(line);
+            const target = connectLine
+                ? connectLine[1].toLowerCase()
+                : absolute
+                    ? (absolute[1].includes(':') ? absolute[1] : absolute[1] + ':80').toLowerCase()
+                    : 'invalid-request';
+            const up = connect(this.broker);
+            this.sockets.add(up);
+            up.on('close', () => this.sockets.delete(up));
+            up.once('error', () => {
+                this.unavailable = true;
+                this.record(target, false, 'the broker socket is unavailable');
+                const body = 'salaam: the command network broker is unavailable\n';
+                client.end(`HTTP/1.1 502 Bad Gateway\r\nContent-Length: ${body.length}\r\nConnection: close\r\n\r\n${body}`);
+            });
+            up.once('connect', () => {
+                let reply = Buffer.alloc(0), decided = false;
+                const onReply = (chunk) => {
+                    client.write(chunk);
+                    if (decided)
+                        return;
+                    reply = Buffer.concat([reply, chunk]);
+                    const status = /^HTTP\/1\.[01] (\d{3})/.exec(reply.toString('latin1'));
+                    if (!status) {
+                        if (reply.length > 8192)
+                            decided = true;
+                        return;
+                    }
+                    const code = Number(status[1]);
+                    if (code >= 200 && code < 300) {
+                        decided = true;
+                        this.record(target, true);
+                        return;
+                    }
+                    // A refusal: wait for the body so the reason names the fix, as stk writes it.
+                    const text = reply.toString('utf8');
+                    const bodyAt = text.indexOf('\r\n\r\n');
+                    if (bodyAt >= 0 && text.length > bodyAt + 4) {
+                        decided = true;
+                        this.record(target, false, text
+                            .slice(bodyAt + 4)
+                            .trim()
+                            .split('\n')[0]);
+                    }
+                };
+                up.on('data', onReply);
+                up.on('end', () => {
+                    if (!decided) {
+                        decided = true;
+                        const status = /^HTTP\/1\.[01] (\d{3})[^\r\n]*/.exec(reply.toString('latin1'));
+                        const code = status ? Number(status[1]) : 0;
+                        this.record(target, code >= 200 && code < 300, status ? status[0] : 'no reply');
+                    }
+                    client.end();
+                });
+                up.write(head);
+                client.on('data', (d) => up.write(d));
+                client.on('end', () => up.end());
+                client.resume();
+            });
+        };
+        client.on('data', onHead);
+    }
+    summary() {
+        return {
+            broker: this.unavailable ? 'unavailable' : 'available',
+            connections: [...this.counts].map(([target, c]) => ({ target, ...c })),
+            ...(this.truncated ? { truncated: true } : {}),
+        };
+    }
+    async close() {
+        for (const s of this.sockets)
+            s.destroy();
+        await new Promise((resolve) => this.server.close(() => resolve()));
+        if (this.dir)
+            rmSync(this.dir, { recursive: true, force: true });
+    }
+}
+/**
+ * Runs inside the bubblewrap sandbox as `node -e <this> <unix socket> <port> <command...>`: listens
+ * on 127.0.0.1:<port> in the sandbox's own network namespace, pipes each connection to the bound
+ * relay socket, then starts the command with its stdio and exits with its status. It decides
+ * nothing; the host-side relay and stk do.
+ */
+export const inSandboxRelaySource = `
+const net = require('node:net'), { spawn } = require('node:child_process');
+const [sock, port, cmd, ...args] = process.argv.slice(1);
+const server = net.createServer((c) => {
+  const u = net.connect(sock);
+  c.on('error', () => u.destroy()); u.on('error', () => c.destroy());
+  c.pipe(u).pipe(c);
+});
+server.listen(Number(port), '127.0.0.1', () => {
+  const child = spawn(cmd, args, { stdio: 'inherit' });
+  child.on('exit', (code, signal) => process.exit(code ?? (signal ? 128 : 1)));
+  child.on('error', () => process.exit(127));
+});
+server.on('error', () => process.exit(126));
+`.trim();