@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/dist/src/service.js

@@ -1,13 +1,20 @@
+import { readFileSync } from 'node:fs';
+import { DangerClassifier, loadDangerClassifierOptions } from './danger-classifier.js';
+import { WebSearch, loadWebSearchConfig } from './web-search.js';
 import { createServer } from 'node:http';
-import { mkdirSync, chmodSync, existsSync, unlinkSync, realpathSync, statSync } from 'node:fs';
+import { loadPersona } from './persona.js';
+import { mkdirSync, chmodSync, chownSync, existsSync, unlinkSync, realpathSync, statSync, } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { providerRoute } from './provider-config.js';
 import { TaskContext } from './task-context.js';
 import { ContextAdmission } from './context-admission.js';
+import { ProjectInstructions, userInstructionsPath } from './project-instructions.js';
 import { SLASH_COMMANDS } from './tui-commands.js';
 import { TaskWork } from './task-work.js';
 import { TaskBudget } from './task-budget.js';
 import { AgentPodWorkDecisions } from './agentpod-work-decisions.js';
+import { RunGrants } from './run-grants.js';
+import { TaskCritic } from './task-critic.js';
 import { AgentPodWork } from './agentpod-work.js';
 import { agentpodWorkAdmission } from './agentpod-work-protocol.js';
 import { TaskVerification } from './task-verification.js';
@@ -17,6 +24,7 @@ import { OperatorInbox } from './operator-inbox.js';
 import { RecurringWork } from './recurring-work.js';
 import { JobWork } from './job-work.js';
 import { Store } from './store.js';
+import { pickerSummary } from './session-pick.js';
 import { acquireStateLock } from './state-lock.js';
 import { Artifacts } from './artifacts.js';
 import { Supervisor } from './supervisor.js';
@@ -39,6 +47,7 @@ import { DockerHarnessBackend } from './harness-backend.js';
 import { A2AInbound } from './a2a-inbound.js';
 import { AgentPodAuthority, readAgentPodPins } from './agentpod-authority.js';
 import { ToolkitResources } from './toolkit-resources.js';
+import { OperatorMcp } from './operator-mcp.js';
 import { cancelToolkitCalls, recoverToolkitCalls } from './toolkit-calls.js';
 import { ToolkitOwners } from './toolkit-owners.js';
 import { ToolkitResolutions, resolvedToolkitCallSql } from './toolkit-resolutions.js';
@@ -49,13 +58,20 @@ import { McpAdmission } from './mcp-admission.js';
 import { McpWork } from './mcp-work.js';
 import { ToolkitWork } from './toolkit-work.js';
 import { permissionPolicy, configurePermissions } from './autonomy.js';
+import { expandPrompt, storeImages } from './mentions.js';
+import { ApprovalRules } from './approval-rules.js';
+import { chooseLocalSandbox, resolveReadPaths } from './command-sandbox.js';
 import { LocalCoding } from './local-coding.js';
+import { Hooks } from './hooks.js';
 import { localDiff } from './local-diff.js';
 import { reviewUndo, applyUndo, reconcileUndo } from './local-undo.js';
 import { forkPiSession } from './pi-sessions.js';
+import { TurnCheckpoints } from './turn-rewind.js';
 import { StationWork } from './station-work.js';
 import { readToolkitConfig } from './toolkit-config.js';
+import { probeToolsUser, serviceToolIdentity } from './tool-identity.js';
 export class SalaamService {
+    operatorMcpPath;
     agentpod;
     agentpodWork;
     toolkitResources;
@@ -92,6 +108,7 @@ export class SalaamService {
     workspaces;
     coding;
     localCoding;
+    toolIdentity;
     codingSocket;
     closed;
     resolveClosed;
@@ -104,12 +121,36 @@ export class SalaamService {
     revocationStops = new Set();
     authorityTimer;
     hostManifestDigest;
+    hostReceipt;
+    operatorAccess;
     agentpodWorkProgression;
+    /** Phase 2b: whether interactive sessions here may choose full access (no OS sandbox). */
+    allowFullAccessSessions;
+    allowYoloSessions;
+    reviewers = new Map();
+    reviewerDefault = 'off';
+    reviewerPin;
+    /** The reviewer a session uses: the host's pin, else its own choice, else the config default. */
+    reviewerChoice(session) {
+        if (this.reviewerPin)
+            return this.reviewerPin;
+        const row = this.store.db
+            .prepare('SELECT choice FROM danger_classifier_choice WHERE session_id=?')
+            .get(session);
+        const choice = row?.choice ?? this.reviewerDefault;
+        return choice === 'off' || this.reviewers.has(choice) ? choice : 'off';
+    }
     constructor(options) {
+        this.allowFullAccessSessions = options.allowFullAccessSessions !== false;
+        this.allowYoloSessions = options.allowYoloSessions !== false;
         this.agentpodWorkProgression = options.agentpodWorkProgression === true;
         if (this.agentpodWorkProgression && (!options.stationConfig || !options.agentpodConfig))
             throw Error('Strict work requires reviewed AgentPod protected station configuration');
         this.hostManifestDigest = options.hostManifestDigest ?? null;
+        this.hostReceipt = options.hostManifestDigest ? (options.hostReceipt ?? null) : null;
+        if (options.operatorAccess && !this.agentpodWorkProgression)
+            throw Error('Operator group access is only for the strict work launcher profile');
+        this.operatorAccess = options.operatorAccess ?? null;
         if (process.platform === 'win32')
             throw new Error('Windows transport is not implemented');
         this.stateDir = resolve(options.stateDir);
@@ -134,20 +175,33 @@ export class SalaamService {
         this.codingSocket = options.codingSocket ? resolve(options.codingSocket) : null;
         mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
         this.stateDir = realpathSync(this.stateDir);
+        this.toolIdentity = options.toolsUser
+            ? probeToolsUser(options.toolsUser, this.stateDir, options.toolsLauncher)
+            : serviceToolIdentity();
         const mcpAdmission = options.managedMcp
             ? new McpAdmission(options.managedMcp.config, readAgentPodPins(resolve(options.agentpodConfig), this.stateDir), options.managedMcp.profile_digest)
             : undefined;
         this.socket = join(this.stateDir, 'operator.sock');
         this.bridgeSocket = join(this.stateDir, 'bridge.sock');
         if (Buffer.byteLength(this.bridgeSocket) > 100)
-            throw new Error('State path is too long for a Unix socket; choose a shorter --state path');
+            throw new Error(`State path is too long for a Unix socket (${Buffer.byteLength(this.bridgeSocket)} bytes; the limit is 100): ` +
+                'use the default (salaam code, no --state), or a shorter --state or SALAAM_STATE_DIR such as /tmp/salaam-state.');
         this.release = acquireStateLock(this.stateDir);
         try {
             this.store = new Store(join(this.stateDir, 'journal.sqlite'));
+            this.store.toolExecution = {
+                mode: this.toolIdentity.mode,
+                user: this.toolIdentity.user,
+                uid: this.toolIdentity.uid,
+            };
             try {
                 this.artifacts = new Artifacts(join(this.stateDir, 'artifacts'), this.store);
                 this.tasks = new TaskContext(this.store, this.artifacts);
                 this.tasks.admitted = new ContextAdmission(this.store);
+                this.tasks.instructions = new ProjectInstructions(this.store, this.artifacts, options.userInstructions === undefined
+                    ? userInstructionsPath()
+                    : options.userInstructions);
+                this.tasks.checkpoints = new TurnCheckpoints(this.store, this.stateDir, this.toolIdentity.mode !== 'tools-user');
                 this.taskWork = new TaskWork(this.store, this.tasks);
                 this.taskBudget = new TaskBudget(this.store, this.taskWork);
                 if (options.admitModelRequest) {
@@ -183,6 +237,16 @@ export class SalaamService {
                     ]);
                 this.coding = new CodingWork(this.store, this.workspaces, this.artifacts, executor, (id, error) => this.supervisor.failControl(id, error));
                 this.taskVerification = new TaskVerification(this.store, this.taskWork, this.taskBudget, this.workspaces, this.coding, this.artifacts);
+                // Item 8: the completion critic. Its reviewer grant is the narrow built-in one, admitted
+                // only while the task's admitted plan still declares a critic.
+                this.taskVerification.critic = new TaskCritic(this.store, this.artifacts, {
+                    admit: (task, request) => this.agents.admitCritic(task.session_id, request, () => {
+                        if (!this.taskWork.get(task.id).completion_gate?.critic)
+                            throw new ServiceError('authority_denied', 'The admitted plan declares no critic');
+                    }),
+                    spawn: (task, parentAttempt, step, prompt, budget, grant, snapshot) => this.children.spawnCritic(task.session_id, parentAttempt, step, prompt, budget, grant, snapshot),
+                    workerId: (childId) => this.store.workerBoundary.view(childId).binding.worker_id,
+                });
                 this.taskCheckpoints = new TaskCheckpoints(this.store, this.taskWork, this.taskVerification, this.workspaces, this.artifacts);
                 this.supervisor = new Supervisor(this.store, {
                     ...options,
@@ -191,6 +255,16 @@ export class SalaamService {
                     effectsEnabled: !!options.effectConnector,
                 });
                 this.supervisor.tasks = this.tasks;
+                if (options.personaConfig) {
+                    const persona = loadPersona(options.personaConfig.config);
+                    if (persona.digest !== options.personaConfig.digest)
+                        throw Error('Host persona changed; run host plan again');
+                    this.supervisor.persona = persona;
+                }
+                if (options.operatorMcpConfig) {
+                    this.operatorMcpPath = options.operatorMcpConfig;
+                    this.supervisor.operatorMcp = OperatorMcp.load(options.operatorMcpConfig, options.operatorMcpEnvironment ?? process.env);
+                }
                 this.taskWork.providerCheck = (limits, session) => this.supervisor.assertTaskProviderSupported(limits, session ? this.store.localOutputCap(session) : undefined);
                 this.supervisor.coding = this.coding;
                 this.managed = new ManagedWork(this.store, {
@@ -205,8 +279,48 @@ export class SalaamService {
                         : this.supervisor.failControl(id, error),
                 });
                 this.supervisor.managed = this.managed;
-                this.localCoding = new LocalCoding(this.store, this.managed, (id, epoch, attempt) => this.supervisor.assertActive(id, epoch, attempt));
+                // Item 10: Linux runs local commands under bubblewrap and macOS under Seatbelt when
+                // usable; a host with neither refuses them unless the operator allowed them unsandboxed.
+                const localSandbox = {
+                    ...chooseLocalSandbox(options.localSandbox ?? 'workspace-write'),
+                    allowUnsandboxed: options.unsandboxedCommands === 'allow',
+                    ...(options.localSandboxReadPaths?.length
+                        ? { readPaths: resolveReadPaths(options.localSandboxReadPaths) }
+                        : {}),
+                    ...(options.commandNetwork ? { network: { socket: options.commandNetwork.socket } } : {}),
+                };
+                this.localCoding = new LocalCoding(this.store, this.managed, (id, epoch, attempt) => this.supervisor.assertActive(id, epoch, attempt), this.toolIdentity, localSandbox);
+                this.localCoding.rules = new ApprovalRules(this.store, options.permissionsFile);
+                this.localCoding.interactive = (id) => this.supervisor.isInteractiveCoding(id);
+                this.localCoding.allowOutsideSandbox = this.allowFullAccessSessions;
                 this.supervisor.localCoding = this.localCoding;
+                if (options.dangerClassifierConfig) {
+                    const loaded = loadDangerClassifierOptions(JSON.parse(readFileSync(options.dangerClassifierConfig, 'utf8')));
+                    for (const o of loaded.options)
+                        this.reviewers.set(o.name, new DangerClassifier(o));
+                    this.reviewerDefault = loaded.default;
+                }
+                if (options.dangerClassifierPin !== undefined) {
+                    if (options.dangerClassifierPin !== 'off' &&
+                        !this.reviewers.has(options.dangerClassifierPin))
+                        throw Error(`The pinned command reviewer ${options.dangerClassifierPin} is not configured`);
+                    this.reviewerPin = options.dangerClassifierPin;
+                }
+                if (this.reviewers.size) {
+                    this.store.db.exec('CREATE TABLE IF NOT EXISTS danger_classifier_choice(session_id TEXT PRIMARY KEY, choice TEXT NOT NULL)');
+                    this.localCoding.classifier = {
+                        review: (s, command, cwd) => {
+                            const reviewer = this.reviewers.get(this.reviewerChoice(s));
+                            return reviewer ? reviewer.review(s, command, cwd) : Promise.resolve(null);
+                        },
+                    };
+                }
+                const local = this.localCoding;
+                this.supervisor.hooks = new Hooks(this.store, (session, command, input, timeout) => local.runHook(session, command, input, timeout), options.hooksFile);
+                const webConfig = options.webSearchConfig
+                    ? loadWebSearchConfig(options.webSearchConfig)
+                    : { providers: [] };
+                this.supervisor.web = new WebSearch(webConfig);
                 this.agents = new AgentProfiles(this.store, this.supervisor.route, async (route, session) => {
                     const prepared = await this.supervisor.prepareProviderRoute(route);
                     const task = this.taskWork.forSession(session);
@@ -293,6 +407,17 @@ export class SalaamService {
                         failed: (session, error) => this.supervisor.failControl(session, error),
                     });
                     this.supervisor.station = this.station;
+                    // "Approve for this run": one grant store for decisions and the station.
+                    this.station.grants = this.runGrants();
+                    this.station.grantScope = (session) => {
+                        const row = this.store.db
+                            .prepare('SELECT task_id FROM agentpod_work WHERE session_id=?')
+                            .get(session);
+                        if (!row?.task_id)
+                            return null;
+                        const task = this.taskWork.get(row.task_id);
+                        return { task_id: task.id, plan_revision: task.plan_revision, task_state: task.state };
+                    };
                     this.taskVerification.installStation(this.station);
                     this.agentpodWork = new AgentPodWork(this.store, this.agentpod, this.taskWork, this.taskVerification);
                     const cancelOwned = this.store.cancelChildren;
@@ -429,6 +554,7 @@ export class SalaamService {
             }
             await service.listen(service.bridgeServer, service.bridgeSocket);
             await service.listen(service.operator, service.socket);
+            service.shareOperatorSocket();
             service.taskDriver.start();
             service.jobs.start();
             service.recurring.start();
@@ -490,6 +616,17 @@ export class SalaamService {
         }
         await Promise.allSettled(jobs);
     }
+    /** The launcher profile's only widening: group traverse on state and rw on operator.sock.
+     * The bridge socket, journal, keys and every file below state stay owner-only. */
+    shareOperatorSocket() {
+        if (!this.operatorAccess)
+            return;
+        const { gid } = this.operatorAccess;
+        chownSync(this.socket, process.getuid(), gid);
+        chmodSync(this.socket, 0o660);
+        chownSync(this.stateDir, process.getuid(), gid);
+        chmodSync(this.stateDir, 0o710);
+    }
     async listen(server, path) {
         // The exclusive state lock is held before removing a stale socket.
         if (existsSync(path))
@@ -503,6 +640,11 @@ export class SalaamService {
             });
         });
     }
+    grantStore;
+    /** One "Approve for this run" grant store, shared by decisions and the station. */
+    runGrants() {
+        return (this.grantStore ??= new RunGrants(this.store));
+    }
     send(res, status, value) {
         res.writeHead(status, { 'content-type': 'application/json' });
         res.end(JSON.stringify(value));
@@ -602,6 +744,31 @@ export class SalaamService {
                     });
                     return;
                 }
+                // Item 11b: restore a checkpoint's files, exactly as approved, for an ended run.
+                if (parts[2] === 'work-restore') {
+                    if (!this.agentpodWork)
+                        throw new ServiceError('work_disabled', 'Strict work is not enabled');
+                    if (Object.keys(body).sort().join(',') !==
+                        'approved_by,binding,checkpoint_id,request_id,restore_digest')
+                        throw new ServiceError('invalid_work_payload', 'Closed restore request required');
+                    const restoreDigest = string(body.restore_digest, 'restore_digest', 64);
+                    if (!/^[a-f0-9]{64}$/.test(restoreDigest))
+                        throw new ServiceError('invalid_work_payload', 'A restore names its exact digest');
+                    this.send(res, 200, await this.agentpodWork.restore(body.binding, string(body.request_id, 'request_id', 128), string(body.checkpoint_id, 'checkpoint_id', 128), restoreDigest, string(body.approved_by, 'approved_by', 128)));
+                    return;
+                }
+                // Item 11: read-only checkpoints of the bound run and one checkpoint's diff.
+                if (parts[2] === 'work-checkpoints' || parts[2] === 'work-checkpoint-diff') {
+                    if (!this.agentpodWork)
+                        throw new ServiceError('work_disabled', 'Strict work is not enabled');
+                    const keys = parts[2] === 'work-checkpoints' ? 'binding' : 'binding,checkpoint_id';
+                    if (Object.keys(body).sort().join(',') !== keys)
+                        throw new ServiceError('invalid_work_payload', 'Closed checkpoint request required');
+                    this.send(res, 200, parts[2] === 'work-checkpoints'
+                        ? this.agentpodWork.checkpoints(body.binding)
+                        : await this.agentpodWork.checkpointDiff(body.binding, string(body.checkpoint_id, 'checkpoint_id', 128)));
+                    return;
+                }
                 if (parts[2] === 'work-status' || parts[2] === 'work-progress') {
                     if (!this.agentpodWork || !this.agentpodWorkProgression)
                         throw new ServiceError('work_disabled', 'Strict progression is not enabled');
@@ -690,13 +857,21 @@ export class SalaamService {
                     this.send(res, 200, await this.agentpodWork.completion(body.binding));
                     return;
                 }
+                if (parts[2] === 'work-read') {
+                    if (!this.agentpodWork)
+                        throw new ServiceError('work_disabled', 'Strict progression is not enabled');
+                    if (Object.keys(body).sort().join(',') !== 'answer,binding')
+                        throw new ServiceError('invalid_board_read', 'Closed board read answer required');
+                    this.send(res, 200, this.agentpodWork.answerBoardRead(body.binding, body.answer));
+                    return;
+                }
                 if (parts[2] === 'work-decisions' || parts[2] === 'work-decision') {
                     if (!this.agentpodWork)
                         throw new ServiceError('verification_unavailable', 'Reviewed protected station backend required');
                     const answering = parts[2] === 'work-decision';
                     if (Object.keys(body).sort().join(',') !== (answering ? 'answer,binding' : 'binding'))
                         throw new ServiceError('invalid_work_decision', 'Closed decision payload required');
-                    const decisions = new AgentPodWorkDecisions(this.agentpodWork, this.managed);
+                    const decisions = new AgentPodWorkDecisions(this.agentpodWork, this.managed, this.runGrants());
                     this.send(res, 200, answering ? decisions.answer(body.binding, body.answer) : decisions.list(body.binding));
                     return;
                 }
@@ -747,11 +922,13 @@ export class SalaamService {
                 }
                 const request = string(body.request_id, 'request_id', 128);
                 if (parts[2] === 'admit') {
-                    this.send(res, 200, this.agentpod.admit(body.binding, request));
+                    this.send(res, 200, this.agentpod.admit(body.binding, request, body.continue_from === undefined
+                        ? undefined
+                        : string(body.continue_from, 'continue_from', 128), body.approval_rules));
                     return;
                 }
                 if (parts[2] === 'renew') {
-                    this.send(res, 200, this.agentpod.renew(body.binding, request, integer(body.lease_sequence, 'lease_sequence')));
+                    this.send(res, 200, this.agentpod.renew(body.binding, request, integer(body.lease_sequence, 'lease_sequence'), body.approval_rules));
                     return;
                 }
                 if (parts[2] === 'revoke') {
@@ -1070,11 +1247,22 @@ export class SalaamService {
                     pid: process.pid,
                     host_manifest_digest: this.hostManifestDigest,
                     host_supervisor_connected: this.hostManifestDigest ? process.connected === true : null,
+                    host_receipt: this.hostReceipt,
                     runtime_node: realpathSync(process.execPath),
                     service_version: VERSION,
                     context_admission: { version: 1, automatic_discovery: false, child_inheritance: false },
                     agentpod_config: this.agentpod?.configPath ?? null,
                     agentpod_pins_digest: this.agentpod ? digest(this.agentpod.pins) : null,
+                    persona: this.supervisor.persona
+                        ? { digest: this.supervisor.persona.digest, text: this.supervisor.persona.text }
+                        : null,
+                    operator_mcp: this.operatorMcpPath
+                        ? {
+                            config: this.operatorMcpPath,
+                            digest: this.supervisor.operatorMcp.digest,
+                            servers: this.supervisor.operatorMcp.provenance(),
+                        }
+                        : null,
                     managed_mcp: this.mcp
                         ? { profile_digest: this.mcp.options.admission.profileDigest }
                         : null,
@@ -1086,6 +1274,12 @@ export class SalaamService {
                         ? { configuration_digest: this.station.configurationDigest }
                         : null,
                     service: 'healthy',
+                    tool_execution: {
+                        mode: this.toolIdentity.mode,
+                        user: this.toolIdentity.user,
+                        uid: this.toolIdentity.uid,
+                        warning: this.toolIdentity.warning,
+                    },
                     a2a: {
                         inbound_enabled: !!this.a2aInbound,
                         listener: this.a2aInbound?.server.address() ?? null,
@@ -1143,9 +1337,11 @@ export class SalaamService {
                             backend: this.coding.executor?.evidence ?? null,
                         }
                         : EXECUTION_STATUS,
+                    last_activity_at: new Date(this.store.lastActivityAny()).toISOString(),
                     sessions: sessions.map((x) => ({
                         id: x.id,
                         state: x.state,
+                        last_activity_at: iso(this.store.lastActivity(x.id)),
                         error: x.error,
                         capabilities: x.capabilities,
                         pending_approvals: this.store
@@ -1167,7 +1363,10 @@ export class SalaamService {
                 return;
             }
             if (url.pathname === '/v1/sessions' && req.method === 'GET') {
-                this.send(res, 200, this.store.sessions().map((x) => this.supervisor.inspect(x.id)));
+                this.send(res, 200, this.store.sessions().map((x) => {
+                    const session = this.supervisor.inspect(x.id);
+                    return { ...session, ...pickerSummary(session, this.store) };
+                }));
                 return;
             }
             if (url.pathname === '/v1/sessions' && req.method === 'POST') {
@@ -1258,13 +1457,52 @@ export class SalaamService {
             }
             if (parts[0] === 'v1' && parts[1] === 'sessions' && parts[2]) {
                 const id = parts[2];
+                // Desk-session approval rules (phase 2a): list, add (from a reviewed operation or written out),
+                // and remove. Adding or removing needs the session's control lease, like the permission policy.
+                if (parts[3] === 'approval-rules' && (parts.length === 4 || parts.length === 6)) {
+                    const rules = this.localCoding.rules;
+                    if (parts.length === 4 && req.method === 'GET') {
+                        this.send(res, 200, {
+                            applies: rules.applies(id),
+                            rules: rules.list(id),
+                            problems: rules.problems(id),
+                        });
+                        return;
+                    }
+                    const body = object(await readJson(req));
+                    this.store.authorizeControl(id, {
+                        client_id: string(body.client_id, 'client_id', 128),
+                        token: string(body.token, 'token', 128),
+                    });
+                    if (parts.length === 4 && req.method === 'POST') {
+                        const scope = string(body.scope, 'scope');
+                        if (scope !== 'session' && scope !== 'repo')
+                            throw new ServiceError('invalid_field', 'A rule scope is session or repo', 400);
+                        const request = string(body.request_id, 'request_id', 128);
+                        this.send(res, 200, body.operation_id !== undefined
+                            ? rules.addFromOperation(id, string(body.operation_id, 'operation_id', 128), scope, request)
+                            : rules.add(id, scope, body.rule, request));
+                        return;
+                    }
+                    if (parts.length === 6 && parts[5] === 'remove' && req.method === 'POST') {
+                        rules.remove(id, string(parts[4], 'rule', 128));
+                        this.send(res, 200, { removed: parts[4] });
+                        return;
+                    }
+                }
                 if (parts.length === 4 && parts[3] === 'permissions') {
                     if (req.method === 'GET') {
                         this.send(res, 200, {
                             policy: permissionPolicy(this.store, id),
                             configurable: this.store.localWorkspace(id),
                             coding: this.store.localCoding(id),
-                            command_auto_approval: false,
+                            // Desk coding sessions: approval rules and auto mode can approve commands (Phase 2a/2b).
+                            command_auto_approval: this.store.localCoding(id),
+                            full_access_allowed: this.allowFullAccessSessions,
+                            yolo_allowed: this.allowYoloSessions && !!this.localCoding.rules?.applies(id),
+                            ...(this.store.localCoding(id)
+                                ? { command_sandbox: this.localCoding.commandSandbox(id) }
+                                : {}),
                         });
                         return;
                     }
@@ -1273,16 +1511,128 @@ export class SalaamService {
                         this.send(res, 200, configurePermissions(this.store, id, string(body.request_id, 'request_id', 128), integer(body.expected_revision, 'expected_revision'), body.policy, {
                             client_id: string(body.client_id, 'client_id', 128),
                             token: string(body.token, 'token', 128),
+                        }, {
+                            allowFullAccess: this.allowFullAccessSessions,
+                            allowYolo: this.allowYoloSessions,
+                            deskSession: !!this.localCoding.rules?.applies(id),
                         }));
                         return;
                     }
                 }
+                if (parts.length === 4 && parts[3] === 'danger-classifier') {
+                    const view = () => {
+                        const choice = this.reviewers.size ? this.reviewerChoice(id) : 'off', chosen = this.reviewers.get(choice)?.config;
+                        return {
+                            configured: this.reviewers.size > 0,
+                            enabled: !!chosen,
+                            ...(chosen
+                                ? {
+                                    provider: chosen.provider,
+                                    model: chosen.model,
+                                    on_unavailable: chosen.on_unavailable,
+                                }
+                                : {}),
+                            choice,
+                            pinned: this.reviewerPin !== undefined,
+                            options: [...this.reviewers.values()].map(({ config: o }) => ({
+                                name: o.name,
+                                provider: o.provider,
+                                model: o.model,
+                            })),
+                        };
+                    };
+                    if (req.method === 'GET') {
+                        this.send(res, 200, view());
+                        return;
+                    }
+                    if (req.method === 'POST') {
+                        const body = object(await readJson(req));
+                        this.store.authorizeControl(id, {
+                            client_id: string(body.client_id, 'client_id', 128),
+                            token: string(body.token, 'token', 128),
+                        });
+                        // `enabled` is the earlier on/off form: on means the config's default.
+                        const choice = typeof body.enabled === 'boolean'
+                            ? body.enabled
+                                ? this.reviewerDefault === 'off'
+                                    ? [...this.reviewers.keys()][0]
+                                    : this.reviewerDefault
+                                : 'off'
+                            : string(body.choice, 'choice', 64);
+                        if (!this.reviewers.size && choice !== 'off')
+                            throw new ServiceError('classifier_unavailable', 'No command reviewer is configured on this host (--danger-classifier-config)');
+                        if (this.reviewerPin !== undefined)
+                            throw new ServiceError('classifier_pinned', `This host pinned the command reviewer (${this.reviewerPin}); sessions cannot change it`, 403);
+                        if (choice !== 'off' && !this.reviewers.has(choice ?? ''))
+                            throw new ServiceError('invalid_field', `Unknown reviewer ${choice}`);
+                        if (this.reviewers.size)
+                            this.store.transaction(() => {
+                                this.store.db
+                                    .prepare('INSERT INTO danger_classifier_choice(session_id,choice) VALUES(?,?) ON CONFLICT(session_id) DO UPDATE SET choice=excluded.choice')
+                                    .run(id, choice);
+                                this.store.event(id, 'permission.classifier-set', { choice });
+                            });
+                        this.send(res, 200, view());
+                        return;
+                    }
+                }
+                // Desk-session hooks (Phase 4b): list, trust the reviewed repository file, or revoke it.
+                if (parts[3] === 'hooks' && this.supervisor.hooks) {
+                    if (!this.supervisor.isInteractiveCoding(id))
+                        throw new ServiceError('hooks_denied', 'Hooks run only in your own desk sessions', 403);
+                    const hooks = this.supervisor.hooks;
+                    if (parts.length === 4 && req.method === 'GET') {
+                        this.send(res, 200, { sources: hooks.sources(id) });
+                        return;
+                    }
+                    if (parts.length === 5 && req.method === 'POST') {
+                        const body = object(await readJson(req));
+                        this.store.authorizeControl(id, {
+                            client_id: string(body.client_id, 'client_id', 128),
+                            token: string(body.token, 'token', 128),
+                        });
+                        if (parts[4] === 'trust') {
+                            this.send(res, 200, hooks.trust(id, string(body.digest, 'digest', 128)));
+                            return;
+                        }
+                        if (parts[4] === 'revoke') {
+                            hooks.revoke(id);
+                            this.send(res, 200, { revoked: true });
+                            return;
+                        }
+                    }
+                }
+                if (parts[3] === 'local-tasks' && this.localCoding) {
+                    if (!this.supervisor.isInteractiveCoding(id))
+                        throw new ServiceError('background_denied', 'Background commands are not admitted', 403);
+                    if (parts.length === 4 && req.method === 'GET') {
+                        this.send(res, 200, { tasks: this.localCoding.tasks(id) });
+                        return;
+                    }
+                    if (parts.length === 5 && req.method === 'GET') {
+                        this.send(res, 200, this.localCoding.taskOutput(id, parts[4]));
+                        return;
+                    }
+                    if (parts.length === 6 && parts[5] === 'stop' && req.method === 'POST') {
+                        this.send(res, 200, this.localCoding.stopTask(id, parts[4]));
+                        return;
+                    }
+                }
                 if (parts.length === 4 && parts[3] === 'local-diff' && req.method === 'GET') {
                     if (!this.store.localWorkspace(id))
                         throw new ServiceError('local_denied', 'Local workspace required');
                     this.send(res, 200, { text: await localDiff(this.store.session(id).cwd) });
                     return;
                 }
+                // An edit request's exact files, before and after, so an editor can show it as a diff.
+                if (parts.length === 4 && parts[3] === 'local-edits' && req.method === 'GET') {
+                    if (!this.store.localCoding(id))
+                        throw new ServiceError('local_denied', 'Local coding session required');
+                    this.send(res, 200, this.localCoding.edits(id, url.searchParams.has('operation_id')
+                        ? { operation: string(url.searchParams.get('operation_id'), 'operation_id', 128) }
+                        : { toolCall: string(url.searchParams.get('tool_call'), 'tool_call', 512) }));
+                    return;
+                }
                 if (parts.length === 4 && parts[3] === 'steer' && req.method === 'POST') {
                     const body = object(await readJson(req));
                     this.send(res, 200, await this.supervisor.steer(id, string(body.request_id, 'request_id', 128), string(body.text, 'text', 65536), {
@@ -1315,7 +1665,84 @@ export class SalaamService {
                                 .prepare("SELECT 1 FROM attempts WHERE session_id=? AND state IN ('accepted','dispatching','running')")
                                 .get(id))
                                 throw new ServiceError('session_busy', 'Wait for queued work before undo');
-                        }));
+                        }, this.toolIdentity));
+                        return;
+                    }
+                }
+                if ((parts.length === 4 || parts.length === 5) &&
+                    (parts[3] === 'checkpoints' || parts[3] === 'rewind' || parts[3] === 'review')) {
+                    const checkpoints = this.tasks.checkpoints;
+                    // Operator ruling 2026-10-31: background commands may keep writing; say so, do not block.
+                    const running = (value) => value && this.localCoding
+                        ? {
+                            ...value,
+                            background_running: this.localCoding
+                                .tasks(id)
+                                .filter((t) => t.state === 'running').length,
+                        }
+                        : value;
+                    const controller = (body) => ({
+                        client_id: string(body.client_id, 'client_id', 128),
+                        token: string(body.token, 'token', 128),
+                    });
+                    const idle = () => {
+                        this.supervisor.assertIdle(id);
+                        if (this.store.db
+                            .prepare("SELECT 1 FROM attempts WHERE session_id=? AND state IN ('accepted','dispatching','running')")
+                            .get(id))
+                            throw new ServiceError('session_busy', 'Wait for the current turn to finish');
+                    };
+                    if (parts[3] === 'checkpoints' && parts.length === 4 && req.method === 'GET') {
+                        this.send(res, 200, { checkpoints: checkpoints.list(id) });
+                        return;
+                    }
+                    if (parts[3] === 'rewind' && parts.length === 4 && req.method === 'GET') {
+                        this.send(res, 200, running(checkpoints.reviewRewind(id, string(url.searchParams.get('attempt'), 'attempt', 128), string(url.searchParams.get('mode'), 'mode', 16))));
+                        return;
+                    }
+                    if (parts[3] === 'rewind' && parts.length === 4 && req.method === 'POST') {
+                        if (this.agentpod)
+                            throw new ServiceError('admission_required', 'Managed station sessions cannot rewind');
+                        const body = object(await readJson(req));
+                        const request = string(body.request_id, 'request_id', 128);
+                        this.send(res, 200, checkpoints.rewind(id, request, string(body.attempt_id, 'attempt_id', 128), string(body.mode, 'mode', 16), string(body.review_digest, 'review_digest', 128), controller(body), idle, (leaf, summary) => this.store.forkLocal(id, request + ':fork', this.store.session(id).revision, controller(body), (source, target) => {
+                            const dir = join(this.stateDir, 'workers', target, 'sessions');
+                            mkdirSync(dir, { recursive: true, mode: 0o700 });
+                            return forkPiSession(source.pi_session_file, source.cwd, dir, target, {
+                                leaf,
+                                summary,
+                            });
+                        }, { leaf })));
+                        return;
+                    }
+                    if (parts[3] === 'review' && parts.length === 4 && req.method === 'GET') {
+                        this.send(res, 200, { review: running(checkpoints.review(id)) });
+                        return;
+                    }
+                    if (parts[3] === 'review' && parts[4] === 'hunks' && req.method === 'GET') {
+                        const q = (name) => string(url.searchParams.get(name), name, 1024);
+                        this.send(res, 200, {
+                            hunks: checkpoints.hunks(id, q('path'), q('base'), q('current')),
+                        });
+                        return;
+                    }
+                    if (parts[3] === 'review' && parts.length === 4 && req.method === 'POST') {
+                        const body = object(await readJson(req));
+                        const hunk = body.hunk === undefined
+                            ? undefined
+                            : {
+                                text: string(object(body.hunk).text, 'hunk.text', 256 * 1024),
+                                patch: string(object(body.hunk).patch, 'hunk.patch', 256 * 1024),
+                            };
+                        this.send(res, 200, {
+                            review: running(checkpoints.act(id, {
+                                action: string(body.action, 'action', 16),
+                                path: string(body.path, 'path', 1024),
+                                ...(hunk ? { hunk } : {}),
+                                base: string(body.base, 'base', 128),
+                                current: string(body.current, 'current', 128),
+                            }, controller(body), idle)),
+                        });
                         return;
                     }
                 }
@@ -1714,6 +2141,29 @@ export class SalaamService {
                     this.send(res, 200, this.store.control(id, string(body.request_id, 'request_id', 128), string(body.client_id, 'client_id', 128), action, integer(body.expected_epoch, 'expected_epoch'), body.token === undefined ? undefined : string(body.token, 'token', 128)));
                     return;
                 }
+                if (parts[3] === 'route' && req.method === 'POST') {
+                    const body = object(await readJson(req));
+                    this.store.authorizeControl(id, {
+                        client_id: string(body.client_id, 'client_id', 128),
+                        token: string(body.token, 'token', 128),
+                    });
+                    if (!this.tasks.instructions.applies(id))
+                        throw new ServiceError('route_switch_unavailable', 'Only interactive sessions can switch model mid-session', 409);
+                    this.supervisor.assertIdle(id);
+                    const input = object(body.route);
+                    const requested = providerRoute(string(input.provider, 'provider'), input.model === undefined ? undefined : string(input.model, 'model'), undefined, undefined, undefined, input.reasoning);
+                    const prepared = await this.supervisor.prepareProviderRoute(requested).catch(() => {
+                        throw new ServiceError('provider_auth_required', `Configure ${requested.provider} with sal auth login ${requested.provider} or sal auth set ${requested.provider}, then retry.`, 400);
+                    });
+                    if (prepared.output_cap !== (this.store.localOutputCap(id) ?? true))
+                        throw new ServiceError('provider_output_cap_changed', 'That route enforces output caps differently; start a new session for it', 409);
+                    this.supervisor.assertIdle(id);
+                    this.store.switchRoute(id, prepared.route);
+                    await this.supervisor.stopSession(id);
+                    void this.supervisor.start(id).catch(() => { });
+                    this.send(res, 200, this.supervisor.inspect(id));
+                    return;
+                }
                 if (parts[3] === 'resume' && req.method === 'POST') {
                     const body = object(await readJson(req));
                     this.store.authorizeControl(id, {
@@ -1727,6 +2177,13 @@ export class SalaamService {
                         throw new ServiceError('provider_route_changed', 'Restart the service with this session’s original provider route, or create a new session');
                     if (session.state !== 'ready' && session.state !== 'starting')
                         void this.supervisor.start(id).catch(() => { });
+                    // Show the project instructions an interactive session will use before its first turn.
+                    try {
+                        this.tasks.instructions?.refresh(id);
+                    }
+                    catch {
+                        /* reported on the next turn */
+                    }
                     this.send(res, 202, this.supervisor.inspect(id));
                     return;
                 }
@@ -1742,12 +2199,23 @@ export class SalaamService {
                 }
                 if (parts[3] === 'submissions' && req.method === 'POST') {
                     const body = object(await readJson(req));
-                    const submission = this.store.accept(id, string(body.request_id, 'request_id', 128), integer(body.expected_revision, 'expected_revision'), string(body.text, 'text', 256 * 1024), {
+                    const local = this.store.localCoding(id);
+                    let text = string(body.text, 'text', 256 * 1024);
+                    let images = [];
+                    // Desk prompts attach their @mentions (Phase 3b); board work never reads the tree here.
+                    if (local) {
+                        if (body.confirm_sensitive !== undefined && typeof body.confirm_sensitive !== 'boolean')
+                            throw new ServiceError('invalid_field', 'Invalid confirm_sensitive flag', 400);
+                        ({ text, images } = expandPrompt(this.store.session(id).cwd, text, body.confirm_sensitive === true));
+                    }
+                    const submission = this.store.accept(id, string(body.request_id, 'request_id', 128), integer(body.expected_revision, 'expected_revision'), text, {
                         client_id: string(body.client_id, 'client_id', 128),
                         token: string(body.token, 'token', 128),
                     }, body.continues_attempt_id === undefined
                         ? null
                         : string(body.continues_attempt_id, 'continues_attempt_id', 128));
+                    // Same tick as the acceptance, so dispatch cannot claim the submission without them.
+                    storeImages(this.store.db, submission.id, images);
                     this.send(res, 202, submission);
                     return;
                 }
@@ -1886,6 +2354,7 @@ export class SalaamService {
         await attempt(() => this.toolkitResolutions.close());
         await attempt(() => this.children.close());
         await attempt(() => this.supervisor.close());
+        await attempt(() => this.supervisor.operatorMcp?.close());
         await attempt(() => this.dispatcher.drain());
         await attempt(() => this.managed.close());
         await attempt(() => Promise.all([this.operator, this.bridgeServer].map((server) => new Promise((resolve, reject) => {
@@ -1909,3 +2378,6 @@ export class SalaamService {
             throw this.shutdownFailure;
     }
 }
+function iso(ms) {
+    return ms === null ? null : new Date(ms).toISOString();
+}