@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/src/service.ts

@@ -1,13 +1,28 @@
+import { readFileSync } from 'node:fs';
+import { DangerClassifier, loadDangerClassifierOptions } from './danger-classifier.js';
+import { WebSearch, loadWebSearchConfig } from './web-search.js';
 import { createServer, type Server, type ServerResponse, type IncomingMessage } from 'node:http';
-import { mkdirSync, chmodSync, existsSync, unlinkSync, realpathSync, statSync } from 'node:fs';
+import { loadPersona } from './persona.js';
+import {
+  mkdirSync,
+  chmodSync,
+  chownSync,
+  existsSync,
+  unlinkSync,
+  realpathSync,
+  statSync,
+} from 'node:fs';
 import { join, resolve } from 'node:path';
 import { providerRoute } from './provider-config.js';
 import { TaskContext } from './task-context.js';
 import { ContextAdmission } from './context-admission.js';
+import { ProjectInstructions, userInstructionsPath } from './project-instructions.js';
 import { SLASH_COMMANDS } from './tui-commands.js';
 import { TaskWork } from './task-work.js';
 import { TaskBudget } from './task-budget.js';
 import { AgentPodWorkDecisions } from './agentpod-work-decisions.js';
+import { RunGrants } from './run-grants.js';
+import { TaskCritic } from './task-critic.js';
 import { AgentPodWork } from './agentpod-work.js';
 import { agentpodWorkAdmission } from './agentpod-work-protocol.js';
 import { TaskVerification } from './task-verification.js';
@@ -17,6 +32,7 @@ import { OperatorInbox } from './operator-inbox.js';
 import { RecurringWork } from './recurring-work.js';
 import { JobWork } from './job-work.js';
 import { Store } from './store.js';
+import { pickerSummary } from './session-pick.js';
 import { acquireStateLock } from './state-lock.js';
 import { Artifacts } from './artifacts.js';
 import { Supervisor, type SupervisorOptions } from './supervisor.js';
@@ -41,6 +57,7 @@ import { DockerHarnessBackend } from './harness-backend.js';
 import { A2AInbound } from './a2a-inbound.js';
 import { AgentPodAuthority, readAgentPodPins } from './agentpod-authority.js';
 import { ToolkitResources } from './toolkit-resources.js';
+import { OperatorMcp } from './operator-mcp.js';
 import { cancelToolkitCalls, recoverToolkitCalls } from './toolkit-calls.js';
 import { ToolkitOwners } from './toolkit-owners.js';
 import { ToolkitResolutions, resolvedToolkitCallSql } from './toolkit-resolutions.js';
@@ -51,16 +68,35 @@ import { McpAdmission } from './mcp-admission.js';
 import { McpWork } from './mcp-work.js';
 import { ToolkitWork, type ToolkitWorkConfig } from './toolkit-work.js';
 import { permissionPolicy, configurePermissions } from './autonomy.js';
-import { LocalCoding } from './local-coding.js';
+import { expandPrompt, storeImages, type PromptImage } from './mentions.js';
+import { ApprovalRules } from './approval-rules.js';
+import { chooseLocalSandbox, type SandboxLevel, resolveReadPaths } from './command-sandbox.js';
+import { LocalCoding, type LocalSandbox } from './local-coding.js';
+import { Hooks } from './hooks.js';
 import { localDiff } from './local-diff.js';
 import { reviewUndo, applyUndo, reconcileUndo } from './local-undo.js';
 import { forkPiSession } from './pi-sessions.js';
+import { TurnCheckpoints, type RewindMode } from './turn-rewind.js';
 import { StationWork } from './station-work.js';
 import { readToolkitConfig } from './toolkit-config.js';
+import { probeToolsUser, serviceToolIdentity, type ToolIdentity } from './tool-identity.js';
 
 export interface ServiceOptions extends Omit<SupervisorOptions, 'stateDir' | 'bridgeSocket'> {
+  /** The user-level AGENTS.md for interactive sessions; null turns it off. Default:
+   * /salaam/AGENTS.md or ~/.config/salaam/AGENTS.md. */
+  userInstructions?: string | null;
   hostManifestDigest?: string;
+  /** Receipt fields for the launcher profile; reported only by a manifest-served host. */
+  hostReceipt?: Record<string, unknown>;
+  /** Launcher profile: one group may traverse state and use the operator socket. */
+  operatorAccess?: { group: string; gid: number };
   agentpodConfig?: string;
+  /** Operator-declared MCP file (never a workspace path); absent means none declared. */
+  operatorMcpConfig?: string;
+  /** Item 9: the host's pinned persona file and the digest host plan reviewed. */
+  personaConfig?: { config: string; digest: string };
+  /** Environment that ${VAR} references resolve from; defaults to process.env. */
+  operatorMcpEnvironment?: NodeJS.ProcessEnv;
   managedMcp?: { config: string; profile_digest: string };
   /** Internal trusted host seam; never accepted from ACP or a worker. */
   managedToolkit?: ToolkitWorkConfig;
@@ -83,11 +119,45 @@ export interface ServiceOptions extends Omit<SupervisorOptions, 'stateDir' | 'br
   effectConnector?: EffectConnector;
   approvalTtlMs?: number;
   codingRoot?: string;
+  /** Unprivileged OS user for agent-initiated local commands and edits (Linux, sudo -n -u). */
+  toolsUser?: string;
+  /** Item 10: the sandbox level for agent-initiated local commands (default workspace-write).
+   * full-access is unsandboxed and must be chosen explicitly. */
+  localSandbox?: SandboxLevel;
+  /** Host config `unsandboxed_commands: "allow"`: run local commands unsandboxed on a host with no
+   * usable sandbox. Absent, they are refused (operator ruling 2026-10-30, option A). */
+  unsandboxedCommands?: 'allow';
+  /** Read-only paths outside the workspace local commands may read (resolved, `toolchain` expanded). */
+  localSandboxReadPaths?: string[];
+  /** Web search config file: optional providers (searxng, brave, tavily, exa) and their key
+   * references. Keyless official APIs answer without one (operator ruling 2026-10-31). */
+  webSearchConfig?: string;
+  /** Phase 4c: the optional small-model command reviewer (a JSON file); absent means off. */
+  dangerClassifierConfig?: string;
+  /** A host's reviewed pin: one option's name (sessions cannot switch or turn it off), or "off"
+   * (the reviewer is forbidden). Absent: sessions choose from the config's options. */
+  dangerClassifierPin?: string;
+  /** The user's approval rules file (default ~/.config/salaam/permissions.json). */
+  permissionsFile?: string;
+  /** Your hooks file (Phase 4b); defaults to ~/.config/salaam/hooks.json or $SALAAM_HOOKS_FILE. */
+  hooksFile?: string;
+  /** Host config `command_network: "broker"`: sandboxed local commands reach the network only
+   * through this stk local-commands socket (operator rulings 2026-10-30). */
+  commandNetwork?: { socket: string };
+  /** Phase 2b: may an interactive session choose full access? Default true for local desk use;
+   * a host started from a manifest passes its reviewed `full_access_sessions` setting. */
+  allowFullAccessSessions?: boolean;
+  /** Whether an interactive session may choose YOLO (no sandbox, no approvals). Desk default allows
+   * it; a host started from a manifest passes its reviewed `yolo_sessions` setting. */
+  allowYoloSessions?: boolean;
+  /** Internal test seam: argv prefix replacing `sudo -n -u <toolsUser> --`. */
+  toolsLauncher?: string[];
   codingSocket?: string;
   codingBackend?: ExecutionBackend;
   expectedExecution?: { profile_digest: string; engine_id: string };
 }
 export class SalaamService {
+  operatorMcpPath?: string;
   readonly agentpod?: AgentPodAuthority;
   readonly agentpodWork?: AgentPodWork;
   readonly toolkitResources: ToolkitResources;
@@ -124,6 +194,7 @@ export class SalaamService {
   readonly workspaces: Workspaces;
   readonly coding: CodingWork;
   readonly localCoding: LocalCoding;
+  readonly toolIdentity: ToolIdentity;
   readonly codingSocket: string | null;
   readonly closed: Promise<void>;
   private resolveClosed!: () => void;
@@ -136,12 +207,35 @@ export class SalaamService {
   private revocationStops = new Set<Promise<void>>();
   private authorityTimer?: NodeJS.Timeout;
   private readonly hostManifestDigest: string | null;
+  private readonly hostReceipt: Record<string, unknown> | null;
+  private readonly operatorAccess: { group: string; gid: number } | null;
   private readonly agentpodWorkProgression: boolean;
+  /** Phase 2b: whether interactive sessions here may choose full access (no OS sandbox). */
+  private readonly allowFullAccessSessions: boolean;
+  private readonly allowYoloSessions: boolean;
+  private readonly reviewers = new Map<string, DangerClassifier>();
+  private reviewerDefault = 'off';
+  private reviewerPin?: string;
+  /** The reviewer a session uses: the host's pin, else its own choice, else the config default. */
+  private reviewerChoice(session: string): string {
+    if (this.reviewerPin) return this.reviewerPin;
+    const row = this.store.db
+      .prepare('SELECT choice FROM danger_classifier_choice WHERE session_id=?')
+      .get(session) as { choice: string } | undefined;
+    const choice = row?.choice ?? this.reviewerDefault;
+    return choice === 'off' || this.reviewers.has(choice) ? choice : 'off';
+  }
   private constructor(options: ServiceOptions) {
+    this.allowFullAccessSessions = options.allowFullAccessSessions !== false;
+    this.allowYoloSessions = options.allowYoloSessions !== false;
     this.agentpodWorkProgression = options.agentpodWorkProgression === true;
     if (this.agentpodWorkProgression && (!options.stationConfig || !options.agentpodConfig))
       throw Error('Strict work requires reviewed AgentPod protected station configuration');
     this.hostManifestDigest = options.hostManifestDigest ?? null;
+    this.hostReceipt = options.hostManifestDigest ? (options.hostReceipt ?? null) : null;
+    if (options.operatorAccess && !this.agentpodWorkProgression)
+      throw Error('Operator group access is only for the strict work launcher profile');
+    this.operatorAccess = options.operatorAccess ?? null;
     if (process.platform === 'win32') throw new Error('Windows transport is not implemented');
     this.stateDir = resolve(options.stateDir);
     if (options.managedMcp && !options.agentpodConfig)
@@ -169,6 +263,9 @@ export class SalaamService {
     this.codingSocket = options.codingSocket ? resolve(options.codingSocket) : null;
     mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
     this.stateDir = realpathSync(this.stateDir);
+    this.toolIdentity = options.toolsUser
+      ? probeToolsUser(options.toolsUser, this.stateDir, options.toolsLauncher)
+      : serviceToolIdentity();
     const mcpAdmission = options.managedMcp
       ? new McpAdmission(
           options.managedMcp.config,
@@ -179,14 +276,34 @@ export class SalaamService {
     this.socket = join(this.stateDir, 'operator.sock');
     this.bridgeSocket = join(this.stateDir, 'bridge.sock');
     if (Buffer.byteLength(this.bridgeSocket) > 100)
-      throw new Error('State path is too long for a Unix socket; choose a shorter --state path');
+      throw new Error(
+        `State path is too long for a Unix socket (${Buffer.byteLength(this.bridgeSocket)} bytes; the limit is 100): ` +
+          'use the default (salaam code, no --state), or a shorter --state or SALAAM_STATE_DIR such as /tmp/salaam-state.',
+      );
     this.release = acquireStateLock(this.stateDir);
     try {
       this.store = new Store(join(this.stateDir, 'journal.sqlite'));
+      this.store.toolExecution = {
+        mode: this.toolIdentity.mode,
+        user: this.toolIdentity.user,
+        uid: this.toolIdentity.uid,
+      };
       try {
         this.artifacts = new Artifacts(join(this.stateDir, 'artifacts'), this.store);
         this.tasks = new TaskContext(this.store, this.artifacts);
         this.tasks.admitted = new ContextAdmission(this.store);
+        this.tasks.instructions = new ProjectInstructions(
+          this.store,
+          this.artifacts,
+          options.userInstructions === undefined
+            ? userInstructionsPath()
+            : options.userInstructions,
+        );
+        this.tasks.checkpoints = new TurnCheckpoints(
+          this.store,
+          this.stateDir,
+          this.toolIdentity.mode !== 'tools-user',
+        );
         this.taskWork = new TaskWork(this.store, this.tasks);
         this.taskBudget = new TaskBudget(this.store, this.taskWork);
         if (options.admitModelRequest) {
@@ -248,6 +365,26 @@ export class SalaamService {
           this.coding,
           this.artifacts,
         );
+        // Item 8: the completion critic. Its reviewer grant is the narrow built-in one, admitted
+        // only while the task's admitted plan still declares a critic.
+        this.taskVerification.critic = new TaskCritic(this.store, this.artifacts, {
+          admit: (task, request) =>
+            this.agents.admitCritic(task.session_id, request, () => {
+              if (!this.taskWork.get(task.id).completion_gate?.critic)
+                throw new ServiceError('authority_denied', 'The admitted plan declares no critic');
+            }),
+          spawn: (task, parentAttempt, step, prompt, budget, grant, snapshot) =>
+            this.children.spawnCritic(
+              task.session_id,
+              parentAttempt,
+              step,
+              prompt,
+              budget,
+              grant,
+              snapshot,
+            ),
+          workerId: (childId) => this.store.workerBoundary.view(childId).binding.worker_id,
+        });
         this.taskCheckpoints = new TaskCheckpoints(
           this.store,
           this.taskWork,
@@ -262,6 +399,19 @@ export class SalaamService {
           effectsEnabled: !!options.effectConnector,
         });
         this.supervisor.tasks = this.tasks;
+        if (options.personaConfig) {
+          const persona = loadPersona(options.personaConfig.config);
+          if (persona.digest !== options.personaConfig.digest)
+            throw Error('Host persona changed; run host plan again');
+          this.supervisor.persona = persona;
+        }
+        if (options.operatorMcpConfig) {
+          this.operatorMcpPath = options.operatorMcpConfig;
+          this.supervisor.operatorMcp = OperatorMcp.load(
+            options.operatorMcpConfig,
+            options.operatorMcpEnvironment ?? process.env,
+          );
+        }
         this.taskWork.providerCheck = (limits, session) =>
           this.supervisor.assertTaskProviderSupported(
             limits,
@@ -283,10 +433,65 @@ export class SalaamService {
               : this.supervisor.failControl(id, error),
         });
         this.supervisor.managed = this.managed;
-        this.localCoding = new LocalCoding(this.store, this.managed, (id, epoch, attempt) =>
-          this.supervisor.assertActive(id, epoch, attempt),
+        // Item 10: Linux runs local commands under bubblewrap and macOS under Seatbelt when
+        // usable; a host with neither refuses them unless the operator allowed them unsandboxed.
+        const localSandbox: LocalSandbox = {
+          ...chooseLocalSandbox(options.localSandbox ?? 'workspace-write'),
+          allowUnsandboxed: options.unsandboxedCommands === 'allow',
+          ...(options.localSandboxReadPaths?.length
+            ? { readPaths: resolveReadPaths(options.localSandboxReadPaths) }
+            : {}),
+          ...(options.commandNetwork ? { network: { socket: options.commandNetwork.socket } } : {}),
+        };
+        this.localCoding = new LocalCoding(
+          this.store,
+          this.managed,
+          (id, epoch, attempt) => this.supervisor.assertActive(id, epoch, attempt),
+          this.toolIdentity,
+          localSandbox,
         );
+        this.localCoding.rules = new ApprovalRules(this.store, options.permissionsFile);
+        this.localCoding.interactive = (id) => this.supervisor.isInteractiveCoding(id);
+        this.localCoding.allowOutsideSandbox = this.allowFullAccessSessions;
         this.supervisor.localCoding = this.localCoding;
+        if (options.dangerClassifierConfig) {
+          const loaded = loadDangerClassifierOptions(
+            JSON.parse(readFileSync(options.dangerClassifierConfig, 'utf8')),
+          );
+          for (const o of loaded.options) this.reviewers.set(o.name, new DangerClassifier(o));
+          this.reviewerDefault = loaded.default;
+        }
+        if (options.dangerClassifierPin !== undefined) {
+          if (
+            options.dangerClassifierPin !== 'off' &&
+            !this.reviewers.has(options.dangerClassifierPin)
+          )
+            throw Error(
+              `The pinned command reviewer ${options.dangerClassifierPin} is not configured`,
+            );
+          this.reviewerPin = options.dangerClassifierPin;
+        }
+        if (this.reviewers.size) {
+          this.store.db.exec(
+            'CREATE TABLE IF NOT EXISTS danger_classifier_choice(session_id TEXT PRIMARY KEY, choice TEXT NOT NULL)',
+          );
+          this.localCoding.classifier = {
+            review: (s, command, cwd) => {
+              const reviewer = this.reviewers.get(this.reviewerChoice(s));
+              return reviewer ? reviewer.review(s, command, cwd) : Promise.resolve(null);
+            },
+          };
+        }
+        const local = this.localCoding;
+        this.supervisor.hooks = new Hooks(
+          this.store,
+          (session, command, input, timeout) => local.runHook(session, command, input, timeout),
+          options.hooksFile,
+        );
+        const webConfig = options.webSearchConfig
+          ? loadWebSearchConfig(options.webSearchConfig)
+          : { providers: [] };
+        this.supervisor.web = new WebSearch(webConfig);
         this.agents = new AgentProfiles(
           this.store,
           this.supervisor.route,
@@ -459,6 +664,16 @@ export class SalaamService {
             },
           );
           this.supervisor.station = this.station;
+          // "Approve for this run": one grant store for decisions and the station.
+          this.station.grants = this.runGrants();
+          this.station.grantScope = (session) => {
+            const row = this.store.db
+              .prepare('SELECT task_id FROM agentpod_work WHERE session_id=?')
+              .get(session) as { task_id?: string } | undefined;
+            if (!row?.task_id) return null;
+            const task = this.taskWork.get(row.task_id);
+            return { task_id: task.id, plan_revision: task.plan_revision, task_state: task.state };
+          };
           this.taskVerification.installStation(this.station);
           this.agentpodWork = new AgentPodWork(
             this.store,
@@ -613,6 +828,7 @@ export class SalaamService {
       }
       await service.listen(service.bridgeServer, service.bridgeSocket);
       await service.listen(service.operator, service.socket);
+      service.shareOperatorSocket();
       service.taskDriver.start();
       service.jobs.start();
       service.recurring.start();
@@ -685,6 +901,16 @@ export class SalaamService {
     }
     await Promise.allSettled(jobs);
   }
+  /** The launcher profile's only widening: group traverse on state and rw on operator.sock.
+   * The bridge socket, journal, keys and every file below state stay owner-only. */
+  private shareOperatorSocket(): void {
+    if (!this.operatorAccess) return;
+    const { gid } = this.operatorAccess;
+    chownSync(this.socket, process.getuid!(), gid);
+    chmodSync(this.socket, 0o660);
+    chownSync(this.stateDir, process.getuid!(), gid);
+    chmodSync(this.stateDir, 0o710);
+  }
   private async listen(server: Server, path: string): Promise<void> {
     // The exclusive state lock is held before removing a stale socket.
     if (existsSync(path)) unlinkSync(path);
@@ -697,6 +923,11 @@ export class SalaamService {
       });
     });
   }
+  private grantStore?: RunGrants;
+  /** One "Approve for this run" grant store, shared by decisions and the station. */
+  private runGrants(): RunGrants {
+    return (this.grantStore ??= new RunGrants(this.store));
+  }
   private send(res: ServerResponse, status: number, value: unknown): void {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify(value));
@@ -816,6 +1047,50 @@ export class SalaamService {
           });
           return;
         }
+        // Item 11b: restore a checkpoint's files, exactly as approved, for an ended run.
+        if (parts[2] === 'work-restore') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          if (
+            Object.keys(body).sort().join(',') !==
+            'approved_by,binding,checkpoint_id,request_id,restore_digest'
+          )
+            throw new ServiceError('invalid_work_payload', 'Closed restore request required');
+          const restoreDigest = string(body.restore_digest, 'restore_digest', 64);
+          if (!/^[a-f0-9]{64}$/.test(restoreDigest))
+            throw new ServiceError('invalid_work_payload', 'A restore names its exact digest');
+          this.send(
+            res,
+            200,
+            await this.agentpodWork.restore(
+              body.binding,
+              string(body.request_id, 'request_id', 128),
+              string(body.checkpoint_id, 'checkpoint_id', 128),
+              restoreDigest,
+              string(body.approved_by, 'approved_by', 128),
+            ),
+          );
+          return;
+        }
+        // Item 11: read-only checkpoints of the bound run and one checkpoint's diff.
+        if (parts[2] === 'work-checkpoints' || parts[2] === 'work-checkpoint-diff') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict work is not enabled');
+          const keys = parts[2] === 'work-checkpoints' ? 'binding' : 'binding,checkpoint_id';
+          if (Object.keys(body).sort().join(',') !== keys)
+            throw new ServiceError('invalid_work_payload', 'Closed checkpoint request required');
+          this.send(
+            res,
+            200,
+            parts[2] === 'work-checkpoints'
+              ? this.agentpodWork.checkpoints(body.binding)
+              : await this.agentpodWork.checkpointDiff(
+                  body.binding,
+                  string(body.checkpoint_id, 'checkpoint_id', 128),
+                ),
+          );
+          return;
+        }
         if (parts[2] === 'work-status' || parts[2] === 'work-progress') {
           if (!this.agentpodWork || !this.agentpodWorkProgression)
             throw new ServiceError('work_disabled', 'Strict progression is not enabled');
@@ -1002,6 +1277,14 @@ export class SalaamService {
           this.send(res, 200, await this.agentpodWork.completion(body.binding));
           return;
         }
+        if (parts[2] === 'work-read') {
+          if (!this.agentpodWork)
+            throw new ServiceError('work_disabled', 'Strict progression is not enabled');
+          if (Object.keys(body).sort().join(',') !== 'answer,binding')
+            throw new ServiceError('invalid_board_read', 'Closed board read answer required');
+          this.send(res, 200, this.agentpodWork.answerBoardRead(body.binding, body.answer));
+          return;
+        }
         if (parts[2] === 'work-decisions' || parts[2] === 'work-decision') {
           if (!this.agentpodWork)
             throw new ServiceError(
@@ -1011,7 +1294,11 @@ export class SalaamService {
           const answering = parts[2] === 'work-decision';
           if (Object.keys(body).sort().join(',') !== (answering ? 'answer,binding' : 'binding'))
             throw new ServiceError('invalid_work_decision', 'Closed decision payload required');
-          const decisions = new AgentPodWorkDecisions(this.agentpodWork, this.managed);
+          const decisions = new AgentPodWorkDecisions(
+            this.agentpodWork,
+            this.managed,
+            this.runGrants(),
+          );
           this.send(
             res,
             200,
@@ -1090,7 +1377,18 @@ export class SalaamService {
         }
         const request = string(body.request_id, 'request_id', 128);
         if (parts[2] === 'admit') {
-          this.send(res, 200, this.agentpod.admit(body.binding, request));
+          this.send(
+            res,
+            200,
+            this.agentpod.admit(
+              body.binding,
+              request,
+              body.continue_from === undefined
+                ? undefined
+                : string(body.continue_from, 'continue_from', 128),
+              body.approval_rules,
+            ),
+          );
           return;
         }
         if (parts[2] === 'renew') {
@@ -1101,6 +1399,7 @@ export class SalaamService {
               body.binding,
               request,
               integer(body.lease_sequence, 'lease_sequence'),
+              body.approval_rules,
             ),
           );
           return;
@@ -1664,11 +1963,22 @@ export class SalaamService {
           pid: process.pid,
           host_manifest_digest: this.hostManifestDigest,
           host_supervisor_connected: this.hostManifestDigest ? process.connected === true : null,
+          host_receipt: this.hostReceipt,
           runtime_node: realpathSync(process.execPath),
           service_version: VERSION,
           context_admission: { version: 1, automatic_discovery: false, child_inheritance: false },
           agentpod_config: this.agentpod?.configPath ?? null,
           agentpod_pins_digest: this.agentpod ? digest(this.agentpod.pins) : null,
+          persona: this.supervisor.persona
+            ? { digest: this.supervisor.persona.digest, text: this.supervisor.persona.text }
+            : null,
+          operator_mcp: this.operatorMcpPath
+            ? {
+                config: this.operatorMcpPath,
+                digest: this.supervisor.operatorMcp!.digest,
+                servers: this.supervisor.operatorMcp!.provenance(),
+              }
+            : null,
           managed_mcp: this.mcp
             ? { profile_digest: this.mcp.options.admission.profileDigest }
             : null,
@@ -1680,6 +1990,12 @@ export class SalaamService {
             ? { configuration_digest: this.station.configurationDigest }
             : null,
           service: 'healthy',
+          tool_execution: {
+            mode: this.toolIdentity.mode,
+            user: this.toolIdentity.user,
+            uid: this.toolIdentity.uid,
+            warning: this.toolIdentity.warning,
+          },
           a2a: {
             inbound_enabled: !!this.a2aInbound,
             listener: this.a2aInbound?.server.address() ?? null,
@@ -1741,9 +2057,11 @@ export class SalaamService {
                 backend: this.coding.executor?.evidence ?? null,
               }
             : EXECUTION_STATUS,
+          last_activity_at: new Date(this.store.lastActivityAny()).toISOString(),
           sessions: sessions.map((x) => ({
             id: x.id,
             state: x.state,
+            last_activity_at: iso(this.store.lastActivity(x.id)),
             error: x.error,
             capabilities: x.capabilities,
             pending_approvals: this.store
@@ -1768,7 +2086,10 @@ export class SalaamService {
         this.send(
           res,
           200,
-          this.store.sessions().map((x) => this.supervisor.inspect(x.id)),
+          this.store.sessions().map((x) => {
+            const session = this.supervisor.inspect(x.id);
+            return { ...session, ...pickerSummary(session, this.store) };
+          }),
         );
         return;
       }
@@ -1911,13 +2232,61 @@ export class SalaamService {
       }
       if (parts[0] === 'v1' && parts[1] === 'sessions' && parts[2]) {
         const id = parts[2];
+        // Desk-session approval rules (phase 2a): list, add (from a reviewed operation or written out),
+        // and remove. Adding or removing needs the session's control lease, like the permission policy.
+        if (parts[3] === 'approval-rules' && (parts.length === 4 || parts.length === 6)) {
+          const rules = this.localCoding.rules!;
+          if (parts.length === 4 && req.method === 'GET') {
+            this.send(res, 200, {
+              applies: rules.applies(id),
+              rules: rules.list(id),
+              problems: rules.problems(id),
+            });
+            return;
+          }
+          const body = object(await readJson(req));
+          this.store.authorizeControl(id, {
+            client_id: string(body.client_id, 'client_id', 128),
+            token: string(body.token, 'token', 128),
+          });
+          if (parts.length === 4 && req.method === 'POST') {
+            const scope = string(body.scope, 'scope');
+            if (scope !== 'session' && scope !== 'repo')
+              throw new ServiceError('invalid_field', 'A rule scope is session or repo', 400);
+            const request = string(body.request_id, 'request_id', 128);
+            this.send(
+              res,
+              200,
+              body.operation_id !== undefined
+                ? rules.addFromOperation(
+                    id,
+                    string(body.operation_id, 'operation_id', 128),
+                    scope,
+                    request,
+                  )
+                : rules.add(id, scope, body.rule, request),
+            );
+            return;
+          }
+          if (parts.length === 6 && parts[5] === 'remove' && req.method === 'POST') {
+            rules.remove(id, string(parts[4], 'rule', 128));
+            this.send(res, 200, { removed: parts[4] });
+            return;
+          }
+        }
         if (parts.length === 4 && parts[3] === 'permissions') {
           if (req.method === 'GET') {
             this.send(res, 200, {
               policy: permissionPolicy(this.store, id),
               configurable: this.store.localWorkspace(id),
               coding: this.store.localCoding(id),
-              command_auto_approval: false,
+              // Desk coding sessions: approval rules and auto mode can approve commands (Phase 2a/2b).
+              command_auto_approval: this.store.localCoding(id),
+              full_access_allowed: this.allowFullAccessSessions,
+              yolo_allowed: this.allowYoloSessions && !!this.localCoding.rules?.applies(id),
+              ...(this.store.localCoding(id)
+                ? { command_sandbox: this.localCoding.commandSandbox(id) }
+                : {}),
             });
             return;
           }
@@ -1936,17 +2305,152 @@ export class SalaamService {
                   client_id: string(body.client_id, 'client_id', 128),
                   token: string(body.token, 'token', 128),
                 },
+                {
+                  allowFullAccess: this.allowFullAccessSessions,
+                  allowYolo: this.allowYoloSessions,
+                  deskSession: !!this.localCoding.rules?.applies(id),
+                },
               ),
             );
             return;
           }
         }
+        if (parts.length === 4 && parts[3] === 'danger-classifier') {
+          const view = () => {
+            const choice = this.reviewers.size ? this.reviewerChoice(id) : 'off',
+              chosen = this.reviewers.get(choice)?.config;
+            return {
+              configured: this.reviewers.size > 0,
+              enabled: !!chosen,
+              ...(chosen
+                ? {
+                    provider: chosen.provider,
+                    model: chosen.model,
+                    on_unavailable: chosen.on_unavailable,
+                  }
+                : {}),
+              choice,
+              pinned: this.reviewerPin !== undefined,
+              options: [...this.reviewers.values()].map(({ config: o }) => ({
+                name: o.name,
+                provider: o.provider,
+                model: o.model,
+              })),
+            };
+          };
+          if (req.method === 'GET') {
+            this.send(res, 200, view());
+            return;
+          }
+          if (req.method === 'POST') {
+            const body = object(await readJson(req));
+            this.store.authorizeControl(id, {
+              client_id: string(body.client_id, 'client_id', 128),
+              token: string(body.token, 'token', 128),
+            });
+            // `enabled` is the earlier on/off form: on means the config's default.
+            const choice =
+              typeof body.enabled === 'boolean'
+                ? body.enabled
+                  ? this.reviewerDefault === 'off'
+                    ? [...this.reviewers.keys()][0]
+                    : this.reviewerDefault
+                  : 'off'
+                : string(body.choice, 'choice', 64);
+            if (!this.reviewers.size && choice !== 'off')
+              throw new ServiceError(
+                'classifier_unavailable',
+                'No command reviewer is configured on this host (--danger-classifier-config)',
+              );
+            if (this.reviewerPin !== undefined)
+              throw new ServiceError(
+                'classifier_pinned',
+                `This host pinned the command reviewer (${this.reviewerPin}); sessions cannot change it`,
+                403,
+              );
+            if (choice !== 'off' && !this.reviewers.has(choice ?? ''))
+              throw new ServiceError('invalid_field', `Unknown reviewer ${choice}`);
+            if (this.reviewers.size)
+              this.store.transaction(() => {
+                this.store.db
+                  .prepare(
+                    'INSERT INTO danger_classifier_choice(session_id,choice) VALUES(?,?) ON CONFLICT(session_id) DO UPDATE SET choice=excluded.choice',
+                  )
+                  .run(id, choice!);
+                this.store.event(id, 'permission.classifier-set', { choice });
+              });
+            this.send(res, 200, view());
+            return;
+          }
+        }
+        // Desk-session hooks (Phase 4b): list, trust the reviewed repository file, or revoke it.
+        if (parts[3] === 'hooks' && this.supervisor.hooks) {
+          if (!this.supervisor.isInteractiveCoding(id))
+            throw new ServiceError('hooks_denied', 'Hooks run only in your own desk sessions', 403);
+          const hooks = this.supervisor.hooks;
+          if (parts.length === 4 && req.method === 'GET') {
+            this.send(res, 200, { sources: hooks.sources(id) });
+            return;
+          }
+          if (parts.length === 5 && req.method === 'POST') {
+            const body = object(await readJson(req));
+            this.store.authorizeControl(id, {
+              client_id: string(body.client_id, 'client_id', 128),
+              token: string(body.token, 'token', 128),
+            });
+            if (parts[4] === 'trust') {
+              this.send(res, 200, hooks.trust(id, string(body.digest, 'digest', 128)));
+              return;
+            }
+            if (parts[4] === 'revoke') {
+              hooks.revoke(id);
+              this.send(res, 200, { revoked: true });
+              return;
+            }
+          }
+        }
+        if (parts[3] === 'local-tasks' && this.localCoding) {
+          if (!this.supervisor.isInteractiveCoding(id))
+            throw new ServiceError(
+              'background_denied',
+              'Background commands are not admitted',
+              403,
+            );
+          if (parts.length === 4 && req.method === 'GET') {
+            this.send(res, 200, { tasks: this.localCoding.tasks(id) });
+            return;
+          }
+          if (parts.length === 5 && req.method === 'GET') {
+            this.send(res, 200, this.localCoding.taskOutput(id, parts[4]!));
+            return;
+          }
+          if (parts.length === 6 && parts[5] === 'stop' && req.method === 'POST') {
+            this.send(res, 200, this.localCoding.stopTask(id, parts[4]!));
+            return;
+          }
+        }
         if (parts.length === 4 && parts[3] === 'local-diff' && req.method === 'GET') {
           if (!this.store.localWorkspace(id))
             throw new ServiceError('local_denied', 'Local workspace required');
           this.send(res, 200, { text: await localDiff(this.store.session(id).cwd) });
           return;
         }
+        // An edit request's exact files, before and after, so an editor can show it as a diff.
+        if (parts.length === 4 && parts[3] === 'local-edits' && req.method === 'GET') {
+          if (!this.store.localCoding(id))
+            throw new ServiceError('local_denied', 'Local coding session required');
+          this.send(
+            res,
+            200,
+            this.localCoding.edits(
+              id,
+              url.searchParams.has('operation_id')
+                ? { operation: string(url.searchParams.get('operation_id'), 'operation_id', 128) }
+                : { toolCall: string(url.searchParams.get('tool_call'), 'tool_call', 512) },
+            ),
+          );
+          return;
+        }
         if (parts.length === 4 && parts[3] === 'steer' && req.method === 'POST') {
           const body = object(await readJson(req));
           this.send(
@@ -2011,11 +2515,138 @@ export class SalaamService {
                   )
                     throw new ServiceError('session_busy', 'Wait for queued work before undo');
                 },
+                this.toolIdentity,
               ),
             );
             return;
           }
         }
+        if (
+          (parts.length === 4 || parts.length === 5) &&
+          (parts[3] === 'checkpoints' || parts[3] === 'rewind' || parts[3] === 'review')
+        ) {
+          const checkpoints = this.tasks.checkpoints!;
+          // Operator ruling 2026-10-31: background commands may keep writing; say so, do not block.
+          const running = <T extends object | null>(value: T): T =>
+            value && this.localCoding
+              ? {
+                  ...value,
+                  background_running: this.localCoding
+                    .tasks(id)
+                    .filter((t) => t.state === 'running').length,
+                }
+              : value;
+          const controller = (body: Record<string, unknown>) => ({
+            client_id: string(body.client_id, 'client_id', 128),
+            token: string(body.token, 'token', 128),
+          });
+          const idle = () => {
+            this.supervisor.assertIdle(id);
+            if (
+              this.store.db
+                .prepare(
+                  "SELECT 1 FROM attempts WHERE session_id=? AND state IN ('accepted','dispatching','running')",
+                )
+                .get(id)
+            )
+              throw new ServiceError('session_busy', 'Wait for the current turn to finish');
+          };
+          if (parts[3] === 'checkpoints' && parts.length === 4 && req.method === 'GET') {
+            this.send(res, 200, { checkpoints: checkpoints.list(id) });
+            return;
+          }
+          if (parts[3] === 'rewind' && parts.length === 4 && req.method === 'GET') {
+            this.send(
+              res,
+              200,
+              running(
+                checkpoints.reviewRewind(
+                  id,
+                  string(url.searchParams.get('attempt'), 'attempt', 128),
+                  string(url.searchParams.get('mode'), 'mode', 16) as RewindMode,
+                ),
+              ),
+            );
+            return;
+          }
+          if (parts[3] === 'rewind' && parts.length === 4 && req.method === 'POST') {
+            if (this.agentpod)
+              throw new ServiceError(
+                'admission_required',
+                'Managed station sessions cannot rewind',
+              );
+            const body = object(await readJson(req));
+            const request = string(body.request_id, 'request_id', 128);
+            this.send(
+              res,
+              200,
+              checkpoints.rewind(
+                id,
+                request,
+                string(body.attempt_id, 'attempt_id', 128),
+                string(body.mode, 'mode', 16) as RewindMode,
+                string(body.review_digest, 'review_digest', 128),
+                controller(body),
+                idle,
+                (leaf, summary) =>
+                  this.store.forkLocal(
+                    id,
+                    request + ':fork',
+                    this.store.session(id).revision,
+                    controller(body),
+                    (source, target) => {
+                      const dir = join(this.stateDir, 'workers', target, 'sessions');
+                      mkdirSync(dir, { recursive: true, mode: 0o700 });
+                      return forkPiSession(source.pi_session_file!, source.cwd, dir, target, {
+                        leaf,
+                        summary,
+                      });
+                    },
+                    { leaf },
+                  ),
+              ),
+            );
+            return;
+          }
+          if (parts[3] === 'review' && parts.length === 4 && req.method === 'GET') {
+            this.send(res, 200, { review: running(checkpoints.review(id)) });
+            return;
+          }
+          if (parts[3] === 'review' && parts[4] === 'hunks' && req.method === 'GET') {
+            const q = (name: string) => string(url.searchParams.get(name), name, 1024);
+            this.send(res, 200, {
+              hunks: checkpoints.hunks(id, q('path'), q('base'), q('current')),
+            });
+            return;
+          }
+          if (parts[3] === 'review' && parts.length === 4 && req.method === 'POST') {
+            const body = object(await readJson(req));
+            const hunk =
+              body.hunk === undefined
+                ? undefined
+                : {
+                    text: string(object(body.hunk).text, 'hunk.text', 256 * 1024),
+                    patch: string(object(body.hunk).patch, 'hunk.patch', 256 * 1024),
+                  };
+            this.send(res, 200, {
+              review: running(
+                checkpoints.act(
+                  id,
+                  {
+                    action: string(body.action, 'action', 16) as 'accept' | 'revert',
+                    path: string(body.path, 'path', 1024),
+                    ...(hunk ? { hunk } : {}),
+                    base: string(body.base, 'base', 128),
+                    current: string(body.current, 'current', 128),
+                  },
+                  controller(body),
+                  idle,
+                ),
+              ),
+            });
+            return;
+          }
+        }
         if (parts.length === 4 && parts[3] === 'fork' && req.method === 'POST') {
           if (this.agentpod)
             throw new ServiceError(
@@ -2619,6 +3250,48 @@ export class SalaamService {
           );
           return;
         }
+        if (parts[3] === 'route' && req.method === 'POST') {
+          const body = object(await readJson(req));
+          this.store.authorizeControl(id, {
+            client_id: string(body.client_id, 'client_id', 128),
+            token: string(body.token, 'token', 128),
+          });
+          if (!this.tasks.instructions!.applies(id))
+            throw new ServiceError(
+              'route_switch_unavailable',
+              'Only interactive sessions can switch model mid-session',
+              409,
+            );
+          this.supervisor.assertIdle(id);
+          const input = object(body.route);
+          const requested = providerRoute(
+            string(input.provider, 'provider'),
+            input.model === undefined ? undefined : string(input.model, 'model'),
+            undefined,
+            undefined,
+            undefined,
+            input.reasoning as import('./provider-config.js').ReasoningLevel | undefined,
+          );
+          const prepared = await this.supervisor.prepareProviderRoute(requested).catch(() => {
+            throw new ServiceError(
+              'provider_auth_required',
+              `Configure ${requested.provider} with sal auth login ${requested.provider} or sal auth set ${requested.provider}, then retry.`,
+              400,
+            );
+          });
+          if (prepared.output_cap !== (this.store.localOutputCap(id) ?? true))
+            throw new ServiceError(
+              'provider_output_cap_changed',
+              'That route enforces output caps differently; start a new session for it',
+              409,
+            );
+          this.supervisor.assertIdle(id);
+          this.store.switchRoute(id, prepared.route);
+          await this.supervisor.stopSession(id);
+          void this.supervisor.start(id).catch(() => {});
+          this.send(res, 200, this.supervisor.inspect(id));
+          return;
+        }
         if (parts[3] === 'resume' && req.method === 'POST') {
           const body = object(await readJson(req));
           this.store.authorizeControl(id, {
@@ -2637,6 +3310,12 @@ export class SalaamService {
             );
           if (session.state !== 'ready' && session.state !== 'starting')
             void this.supervisor.start(id).catch(() => {});
+          // Show the project instructions an interactive session will use before its first turn.
+          try {
+            this.tasks.instructions?.refresh(id);
+          } catch {
+            /* reported on the next turn */
+          }
           this.send(res, 202, this.supervisor.inspect(id));
           return;
         }
@@ -2652,11 +3331,24 @@ export class SalaamService {
         }
         if (parts[3] === 'submissions' && req.method === 'POST') {
           const body = object(await readJson(req));
+          const local = this.store.localCoding(id);
+          let text = string(body.text, 'text', 256 * 1024);
+          let images: PromptImage[] = [];
+          // Desk prompts attach their @mentions (Phase 3b); board work never reads the tree here.
+          if (local) {
+            if (body.confirm_sensitive !== undefined && typeof body.confirm_sensitive !== 'boolean')
+              throw new ServiceError('invalid_field', 'Invalid confirm_sensitive flag', 400);
+            ({ text, images } = expandPrompt(
+              this.store.session(id).cwd,
+              text,
+              body.confirm_sensitive === true,
+            ));
+          }
           const submission = this.store.accept(
             id,
             string(body.request_id, 'request_id', 128),
             integer(body.expected_revision, 'expected_revision'),
-            string(body.text, 'text', 256 * 1024),
+            text,
             {
               client_id: string(body.client_id, 'client_id', 128),
               token: string(body.token, 'token', 128),
@@ -2665,6 +3357,8 @@ export class SalaamService {
               ? null
               : string(body.continues_attempt_id, 'continues_attempt_id', 128),
           );
+          // Same tick as the acceptance, so dispatch cannot claim the submission without them.
+          storeImages(this.store.db, submission.id, images);
           this.send(res, 202, submission);
           return;
         }
@@ -2795,6 +3489,7 @@ export class SalaamService {
     await attempt(() => this.toolkitResolutions.close());
     await attempt(() => this.children.close());
     await attempt(() => this.supervisor.close());
+    await attempt(() => this.supervisor.operatorMcp?.close());
     await attempt(() => this.dispatcher.drain());
     await attempt(() => this.managed.close());
     await attempt(() =>
@@ -2826,3 +3521,7 @@ export class SalaamService {
     if (this.shutdownFailure) throw this.shutdownFailure;
   }
 }
+
+function iso(ms: number | null): string | null {
+  return ms === null ? null : new Date(ms).toISOString();
+}