@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/dist/src/cli-help.js

@@ -53,12 +53,22 @@ salaam agents revoke GRANT_ID --session SESSION_ID
 Profiles are data in .salaam/agents/*.md with JSON front matter and a prompt body.
 Inspect the effective tools and digest before admission. Project definitions cannot
 grant themselves authority. Mutations accept --request-id and --takeover.`,
+    code: `salaam code [--continue | --new | --resume] [--cwd DIR] [--takeover]
+salaam here   (the same)
+salaam -c     (short for salaam code --continue)
+
+Work in this folder with one command: start the service if it is not running, then continue
+the folder's latest session (the default), start a new local coding session (--new), or pick
+any session from a list (--resume), this folder's sessions first. No session id needed.
+SALAAM_TERMINAL_STATUS=off stops the window-title and Herdr status reports.`,
     tui: `salaam tui [--session SESSION_ID] [--observe|--takeover] [--theme night|paper]
            [--cwd DIR] [--coding-root PRIVATE_DIR] [--coding-socket DOCKER_SOCKET]
 
 Bare sal opens the same Salaam terminal interface in a TTY.
-Ctrl+K actions · Ctrl+P sessions · Ctrl+N new · Ctrl+O approvals
-Ctrl+G changes · Ctrl+T commands · Ctrl+E external editor · Ctrl+C detach.
+Ctrl+K (empty composer) or F2 actions · Ctrl+P sessions · Ctrl+N new · Ctrl+O approvals
+Alt+G changes · Ctrl+T commands · Ctrl+G external editor · Ctrl+R history search
+F5 refresh · !command shell · Ctrl+C stops/clears, twice to detach.
+? on an empty composer (or F1) shows the keys for where you are.
 Work continues in the service when the terminal closes.`,
     remote: `salaam remote SSH_HOST [--remote-bin ABSOLUTE_PATH] [--state REMOTE_DIR]
               [--session SESSION_ID] [--observe|--takeover] [--theme night|paper]
@@ -88,9 +98,11 @@ Run the M9.1 boundary proof on a pre-provisioned local Linux Docker engine.
 Only disposable fixtures are mounted. The pinned image must already be present.
 No coding tools are enabled. A failed/unavailable backend exits nonzero.
 Cleanup reconciles the saved proof run without replaying commands.`,
-    acp: `salaam acp [--state DIR] [--coding]
+    acp: `salaam acp [--state DIR] [--local | --coding]
 
 Run the ACP v1 stdio client adapter against an already running Salaam service.
+--local creates your desk session in the editor's project folder, the same as
+salaam in a terminal there: modes, approvals with diffs, rules and /rewind.
 --coding creates owned coding sessions; the service must have --coding-root.
 Loading an existing session preserves its original tool authority.`,
     artifacts: `salaam artifacts put SESSION_ID --text TEXT [--request-id ID] [--takeover]
@@ -103,6 +115,10 @@ salaam host inspect --manifest host-manifest.json
 salaam host unit --manifest host-manifest.json --platform systemd|launchd
 salaam host run --manifest host-manifest.json
 salaam host start --manifest host-manifest.json
+salaam host unit-start --unit salaam-host@STATION.service --state DIR
+salaam host bind --organization ORG --node NODE --station-key KEY --workspace DIR \
+  --tools-user USER --files HELPER --runtime-root DIR --runtime-image-digest sha256:… \
+  [--operator-group GROUP] [--provider P --model M] [--mcp-config FILE] [--persona FILE] [--managed-mcp-config FILE] [--dir DIR] [--state DIR]
 
 Config requires absolute state, coding_root and coding_socket paths; optional
 provider, model, max_output_tokens and workspace_id. Planning probes the existing
@@ -116,7 +132,18 @@ For a bound AgentPod host, use mode="agentpod", state and agentpod_config instea
 of coding_root/coding_socket. This profile enables no station tools. The private
 manifest pins Node, CLI, source/build, Pi, provider and authority pins. Invoke the
 canonical Node executable explicitly. host start waits for matching live health
-and safely coalesces concurrent callers; it never installs or upgrades packages.`,
+and safely coalesces concurrent callers; it never installs or upgrades packages.
+
+Launcher profile (Linux): root plans a strict work host with operator_group set.
+A root-owned unit runs host run from that root-held manifest. The daemon lets that
+one group traverse its state and use operator.sock. An unprivileged member then
+runs host unit-start, which asks systemd to start the named salaam-host@ unit and
+prints the receipt the running daemon reports. It cannot choose what root runs.
+
+host bind (root, Linux) writes everything a launcher-profile station needs into
+--dir (default /etc/salaam/stations/<key>): agentpod-pins.json, station-config.json
+(with tools_user), host-config.json, and host.json from host plan. It is
+idempotent: the same inputs leave the files and the manifest digest unchanged.`,
     schedules: `salaam schedules create TASK_ID --name NAME --revision N --max-steps N [--schedule FILE] [--compact]
 salaam schedules list [--offset N]
 salaam schedules inspect JOB_ID
@@ -208,10 +235,32 @@ Status prints metadata only. Existing Anthropic keys remain compatible.`,
                      [--coding-root PRIVATE_DIR] [--coding-socket DOCKER_SOCKET]
                      [--harness-config OWNER_ONLY_FILE] [--a2a-config OWNER_ONLY_FILE]
                      [--a2a-listen-config OWNER_ONLY_FILE]
-                     [--agentpod-config OWNER_ONLY_FILE]
+                     [--agentpod-config OWNER_ONLY_FILE] [--mcp-config FILE]
+                     [--tools-user USER]
+                     [--local-sandbox read-only|workspace-write|full-access]
+                     [--local-sandbox-read PATH,…|toolchain] [--unsandboxed-commands allow]
 salaam service status
 salaam service stop
 
+--tools-user USER (or SALAAM_TOOLS_USER) runs local agent commands and edits as
+USER through sudo -n -u USER on Linux. Without it, tools share the provider
+credential's OS user and start prints a warning.
+
+Local commands (session create --local-coding) run under the host OS sandbox:
+bubblewrap on Linux, Seatbelt on macOS. --local-sandbox (or SALAAM_LOCAL_SANDBOX)
+picks the level: workspace-write (default) writes only inside the workspace,
+read-only writes nothing, full-access runs commands unsandboxed with network. A
+sandboxed command has no network and cannot read outside the workspace and the
+system; --local-sandbox-read (or SALAAM_LOCAL_SANDBOX_READ) lists read-only paths
+it may also read, comma-separated, and "toolchain" adds this host's node prefix,
+~/.npm, ~/.nvm, ~/.cargo, ~/.rustup, ~/go and ~/.gitconfig where present. Home
+itself and credential directories (~/.ssh, ~/.aws, keychains …) are refused. On
+macOS commands get the real git from the active developer dir. A host with no
+usable sandbox refuses commands unless --unsandboxed-commands allow.
+
+Without --agentpod-config, start binds to ~/.config/salaam/agentpod-pins.json
+($XDG_CONFIG_HOME/salaam) when that file exists.
+
 The default provider is offline. Anthropic defaults to claude-sonnet-5-5.
 Other providers require --model; use salaam providers list and salaam models list PROVIDER.
 Start with --foreground for process-supervisor use; otherwise the service detaches.
@@ -219,7 +268,8 @@ An AgentPod daemon requires node-bound admissions and a fresh authority lease.
 Keep its private state outside the pinned workspace. Coding, external runtimes,
 effect connectors and managed MCP are unavailable in this profile.`,
     session: `salaam session create [--cwd DIR] [--request-id ID] [--coding | --local | --local-coding]
-  --local-coding allows reviewed edits and native commands (no OS sandbox)
+  --local-coding allows reviewed edits and native commands, each under the host OS sandbox
+                 (see salaam help service for levels and read paths)
   --local allows bounded local file inspection; optionally select --provider ID --model ID
 salaam session list
 salaam session inspect SESSION_ID
@@ -272,6 +322,8 @@ const globalOptions = `Global options:
   -h, --help     Show help without starting a service or model request.
   -V, --version  Show the installed version.`;
 export function cliHelp(group) {
+    if (group === 'here')
+        group = 'code';
     if (group)
         return commands[group] ? `${commands[group]}\n\n${globalOptions}` : undefined;
     return `Salaam — persistent coding sessions
@@ -280,6 +332,7 @@ Usage: salaam <command> [options]
        sal <command> [options]
 
 Commands:
+  code          Work in this folder: continue its session or start one (also: here, -c)
   tui           Open the Salaam terminal interface (also bare sal)
   remote        Open the same session over SSH
   providers     List pinned Pi providers and capabilities
@@ -287,6 +340,7 @@ Commands:
   auth          Configure provider credentials or OAuth
   service       Start, inspect or stop the session service
   session       Create, inspect, submit, resume or cancel work
+  mcp           Declare operator MCP servers (add, list, rm)
   attach        Open an interactive terminal on a session
   acp           Connect an editor over ACP v1 stdio
   approvals     Inspect, approve or deny managed operations
@@ -357,6 +411,7 @@ const valueOptions = new Set([
     '--a2a-config',
     '--agentpod-config',
     '--a2a-listen-config',
+    '--tools-user',
     '--assignment',
     '--peer',
     '--peer-client',

package/dist/src/cli.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import { loadDangerClassifierOptions } from './danger-classifier.js';
+import { loadWebSearchConfig } from './web-search.js';
+import { SANDBOX_LEVELS } from './command-sandbox.js';
 import { acp } from './acp.js';
 import { homedir } from 'node:os';
 import { join, resolve, dirname } from 'node:path';
@@ -6,9 +9,12 @@ import { spawn } from 'node:child_process';
 import { randomUUID, randomBytes } from 'node:crypto';
 import { digest, object } from './protocol.js';
 import { fileURLToPath } from 'node:url';
-import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync, fsyncSync, } from 'node:fs';
+import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync, fsyncSync, existsSync, } from 'node:fs';
 import { VERSION } from './config.js';
 import { cliHelp, hasHelpFlag } from './cli-help.js';
+import { mcpCli, MCP_HELP } from './operator-mcp-cli.js';
+import { operatorMcpPath, readOperatorMcpFile } from './operator-mcp.js';
+import { defaultAgentPodConfig } from './agentpod-default-config.js';
 import { SalaamService } from './service.js';
 import { call } from './transport.js';
 import { attach, acquireControl, Outbox } from './attach.js';
@@ -29,6 +35,21 @@ async function main() {
         console.log('salaam ' + VERSION);
         return;
     }
+    if (args[0] === '-c' || args[0] === '--continue') {
+        const { continueArgs } = await import('./session-pick.js');
+        args.splice(0, args.length, ...continueArgs(args));
+    }
+    if (args[0] === 'mcp') {
+        // Parsed before global help: a declared command's own flags follow "--".
+        const rest = args.slice(1);
+        const dash = rest.indexOf('--');
+        const flags = dash < 0 ? rest : rest.slice(0, dash);
+        if (!rest.length || flags.includes('--help') || flags.includes('-h'))
+            console.log(MCP_HELP);
+        else
+            console.log(mcpCli(rest));
+        return;
+    }
     if ((!args.length && !(process.stdin.isTTY && process.stdout.isTTY)) ||
         args[0] === 'help' ||
         hasHelpFlag(args)) {
@@ -388,7 +409,7 @@ async function main() {
         return;
     }
     if (group === 'host') {
-        const { planHost, readHost, hostUnit, runHost } = await import('./host.js');
+        const { planHost, readHost, hostUnit, runHost, hostReceipt, hostToolsUser, hostApprovalTtlMs, hostAllowsUnsandboxed, hostAllowsFullAccessSessions, hostAllowsYoloSessions, hostDangerClassifier, hostCommandNetwork, hostReadPaths, } = await import('./host.js');
         if (verb?.startsWith('config-')) {
             const file = option('--manifest');
             if (!file)
@@ -413,6 +434,42 @@ async function main() {
             console.log(JSON.stringify(await planHost(JSON.parse(readFileSync(resolve(file), 'utf8'))), null, 2));
             return;
         }
+        if (verb === 'bind') {
+            const { bindHost } = await import('./host-bind.js');
+            const required = (name) => {
+                const v = option(name);
+                if (!v)
+                    throw new Error('Supply ' + name);
+                return v;
+            };
+            console.log(JSON.stringify(await bindHost({
+                organization_id: required('--organization'),
+                node_id: required('--node'),
+                station_key: required('--station-key'),
+                workspace: required('--workspace'),
+                tools_user: required('--tools-user'),
+                files: required('--files'),
+                runtime_root: required('--runtime-root'),
+                runtime_image_digest: required('--runtime-image-digest'),
+                operator_group: option('--operator-group'),
+                dir: option('--dir'),
+                state: explicitState ? state : undefined,
+                provider: option('--provider'),
+                model: option('--model'),
+                mcp_config: option('--mcp-config'),
+                persona: option('--persona'),
+                managed_mcp_config: option('--managed-mcp-config'),
+            })));
+            return;
+        }
+        if (verb === 'unit-start') {
+            const { startHostUnit } = await import('./host-start.js');
+            const unit = option('--unit');
+            if (!unit || !explicitState)
+                throw new Error('Supply --unit UNIT and --state DIR');
+            console.log(JSON.stringify(await startHostUnit(unit, state)));
+            return;
+        }
         const file = option('--manifest');
         if (!file)
             throw new Error('Supply --manifest FILE');
@@ -462,9 +519,32 @@ async function main() {
                             : {}),
                         ...(m.schema === 5 || m.schema === 6 ? { stationConfig: m.station_execution } : {}),
                         ...(m.schema === 6 ? { agentpodWorkProgression: true } : {}),
+                        ...(m.schema === 6 && m.operator_access
+                            ? { operatorAccess: m.operator_access }
+                            : {}),
+                        ...(m.schema === 6 && m.operator_mcp
+                            ? { operatorMcpConfig: m.operator_mcp.config }
+                            : {}),
+                        ...(m.schema === 6 && m.persona ? { personaConfig: m.persona } : {}),
                     }),
                 hostManifestDigest: digest(m),
+                hostReceipt: hostReceipt(m),
+                toolsUser: hostToolsUser(m),
                 providerRoute: m.provider,
+                approvalTtlMs: hostApprovalTtlMs(m),
+                ...(hostAllowsUnsandboxed(m) ? { unsandboxedCommands: 'allow' } : {}),
+                // A host session may choose full access only when the reviewed manifest says so.
+                allowFullAccessSessions: hostAllowsFullAccessSessions(m),
+                allowYoloSessions: hostAllowsYoloSessions(m),
+                // The command reviewer only as the reviewed manifest names it (forbidden when absent).
+                ...(hostDangerClassifier(m).config
+                    ? { dangerClassifierConfig: hostDangerClassifier(m).config }
+                    : {}),
+                ...(hostDangerClassifier(m).pin
+                    ? { dangerClassifierPin: hostDangerClassifier(m).pin }
+                    : {}),
+                ...(hostCommandNetwork(m) ? { commandNetwork: hostCommandNetwork(m) } : {}),
+                ...(hostReadPaths(m).length ? { localSandboxReadPaths: hostReadPaths(m) } : {}),
             });
             if (process.connected)
                 process.once('disconnect', () => void service.close());
@@ -493,6 +573,20 @@ async function main() {
         });
         return;
     }
+    if (group === 'code' || group === 'here') {
+        const { parseCodeStart } = await import('./session-pick.js');
+        const start = parseCodeStart(args.slice(1));
+        const { tui } = await import('./tui.js');
+        await tui({
+            state,
+            start,
+            cwd: option('--cwd'),
+            takeover: args.includes('--takeover'),
+            codingRoot: option('--coding-root'),
+            codingSocket: option('--coding-socket'),
+        });
+        return;
+    }
     if (!group ||
         group === 'tui' ||
         [
@@ -626,7 +720,7 @@ async function main() {
         return;
     }
     if (group === 'acp') {
-        await acp(state, { coding: args.includes('--coding') });
+        await acp(state, { coding: args.includes('--coding'), local: args.includes('--local') });
         return;
     }
     if (group === 'providers' && verb === 'list') {
@@ -1245,17 +1339,41 @@ async function main() {
         }
         const effectSocket = option('--effect-socket');
         const opaque = args.includes('--effect-opaque');
-        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), agentpodConfig = option('--agentpod-config'), a2aListenConfig = option('--a2a-listen-config');
+        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), agentpodConfig = option('--agentpod-config') ?? defaultAgentPodConfig(process.env, existsSync), a2aListenConfig = option('--a2a-listen-config'), mcpConfig = resolve(option('--mcp-config') ?? operatorMcpPath(process.env)), toolsUser = option('--tools-user') ?? (process.env.SALAAM_TOOLS_USER || undefined), localSandbox = option('--local-sandbox') ?? (process.env.SALAAM_LOCAL_SANDBOX || undefined), unsandboxedCommands = option('--unsandboxed-commands') ?? (process.env.SALAAM_UNSANDBOXED_COMMANDS || undefined), localSandboxRead = (option('--local-sandbox-read') ??
+            (process.env.SALAAM_LOCAL_SANDBOX_READ || ''))
+            .split(',')
+            .map((p) => p.trim())
+            .filter(Boolean), webSearchConfig = option('--web-search-config') ?? (process.env.SALAAM_WEB_SEARCH_CONFIG || undefined), dangerClassifierConfig = option('--danger-classifier-config') ??
+            (process.env.SALAAM_DANGER_CLASSIFIER_CONFIG || undefined);
+        // Fail early on a bad command-reviewer config; its key is read from the named variable, never printed.
+        if (dangerClassifierConfig)
+            loadDangerClassifierOptions(JSON.parse(readFileSync(resolve(dangerClassifierConfig), 'utf8')));
+        // Fail early on a bad web search config; its keys are read, never printed.
+        if (webSearchConfig)
+            loadWebSearchConfig(resolve(webSearchConfig));
+        if (localSandbox !== undefined && !SANDBOX_LEVELS.includes(localSandbox))
+            throw Error('--local-sandbox is read-only, workspace-write or full-access');
+        if (unsandboxedCommands !== undefined && unsandboxedCommands !== 'allow')
+            throw Error('--unsandboxed-commands is allow or absent');
         if (foreground) {
             const service = await SalaamService.open({
                 stateDir: state,
                 providerRoute: route,
                 agentpodConfig: agentpodConfig ? resolve(agentpodConfig) : undefined,
+                operatorMcpConfig: mcpConfig,
                 codingRoot: codingRoot ? resolve(codingRoot) : undefined,
                 codingSocket: codingSocket ? resolve(codingSocket) : undefined,
                 harnessConfig: harnessConfig ? resolve(harnessConfig) : undefined,
                 a2aConfig: a2aConfig ? resolve(a2aConfig) : undefined,
                 a2aListenConfig: a2aListenConfig ? resolve(a2aListenConfig) : undefined,
+                toolsUser,
+                ...(localSandbox ? { localSandbox: localSandbox } : {}),
+                ...(unsandboxedCommands ? { unsandboxedCommands: 'allow' } : {}),
+                ...(localSandboxRead.length ? { localSandboxReadPaths: localSandboxRead } : {}),
+                ...(webSearchConfig ? { webSearchConfig: resolve(webSearchConfig) } : {}),
+                ...(dangerClassifierConfig
+                    ? { dangerClassifierConfig: resolve(dangerClassifierConfig) }
+                    : {}),
                 effectConnector: effectSocket
                     ? new SocketEffectConnector(resolve(effectSocket), { opaque })
                     : undefined,
@@ -1263,6 +1381,9 @@ async function main() {
             const warning = service.supervisor.providerCapabilities().warning;
             if (warning)
                 console.error(warning);
+            // Only a live provider has a credential to share; the offline proof route stays quiet.
+            if (service.toolIdentity.warning && route.provider !== 'salaam-proof')
+                console.error('warning: ' + service.toolIdentity.warning);
             process.stdout.write(JSON.stringify({ socket, service: 'started' }) + '\n');
             for (const signal of ['SIGINT', 'SIGTERM'])
                 process.once(signal, () => {
@@ -1290,6 +1411,11 @@ async function main() {
             if ((health.coding_root ?? null) !== (codingRoot ? resolve(codingRoot) : null) ||
                 (health.coding_socket ?? null) !== (codingSocket ? resolve(codingSocket) : null))
                 throw new Error('Service is already running with another coding configuration; stop it first');
+            if ((health.operator_mcp?.config ?? null) !== mcpConfig)
+                throw new Error('Service is already running with another MCP config; stop it first');
+            if (health.operator_mcp &&
+                health.operator_mcp.digest !== digest(readOperatorMcpFile(mcpConfig)))
+                console.error('Declared MCP servers changed since the service started; run salaam service stop, then start, to apply them');
             console.log('Salaam service already running');
             return;
         }
@@ -1315,6 +1441,16 @@ async function main() {
             ...(a2aConfig ? ['--a2a-config', resolve(a2aConfig)] : []),
             ...(agentpodConfig ? ['--agentpod-config', resolve(agentpodConfig)] : []),
             ...(a2aListenConfig ? ['--a2a-listen-config', resolve(a2aListenConfig)] : []),
+            '--mcp-config',
+            mcpConfig,
+            ...(toolsUser ? ['--tools-user', toolsUser] : []),
+            ...(localSandbox ? ['--local-sandbox', localSandbox] : []),
+            ...(unsandboxedCommands ? ['--unsandboxed-commands', 'allow'] : []),
+            ...(localSandboxRead.length ? ['--local-sandbox-read', localSandboxRead.join(',')] : []),
+            ...(webSearchConfig ? ['--web-search-config', resolve(webSearchConfig)] : []),
+            ...(dangerClassifierConfig
+                ? ['--danger-classifier-config', resolve(dangerClassifierConfig)]
+                : []),
         ], { detached: true, stdio: ['ignore', fd, fd] });
         closeSync(fd);
         child.unref();