@superjackfruitlabs/salaam 0.0.4 → 0.0.5

package/CHANGELOG.md

@@ -6,6 +6,47 @@ are forward-only: keep a stopped-daemon backup before upgrading.
 
 ## [Unreleased]
 
+## [0.0.5] - 2026-11-01
+
+Salaam as a desk-side coding driver: an interactive terminal session in your own checkout, the same
+session in Zed, and the approvals, sandbox and recovery to work in it daily.
+
+### Added
+
+- Modes: Shift+Tab cycles review → accept edits → auto. `/full-access` runs commands without the
+  OS sandbox and asks only for dangerous ones; `/yolo` (typed confirmation, host setting
+  `allow_yolo_sessions`) asks for nothing and records everything.
+- Approvals: Enter approves once, approve for the session or always in this repo, deny with a
+  reason that reaches the agent, and rules in `/permissions`. Each prompt says why it asks.
+- Danger check: a parser-based check of commands (it unwraps `sudo`, `env`, `xargs`, `sh -c` and
+  more; anything unreadable is dangerous), plus an optional small-model classifier that can only
+  make a command ask (`/classifier`, off by default, hosts can pin or forbid it).
+- Run one command outside the sandbox: a command may ask, saying why. It always asks except in
+  YOLO; auto mode and repo rules never approve it.
+- Listening: a command you approve to listen may serve a dev server; macOS cannot limit it to
+  localhost, and the approval says so. Refused on Linux.
+- Pushes and pull requests always ask, except in YOLO or your own rule.
+- Rewind to any turn (files, conversation or both) and a per-file review of changes.
+- `@` mentions attach files and images; background commands (`/jobs`) and desk notifications.
+- Git helpers `/commit`, `/branch`, `/pr`, `/diff`; your own slash commands; hooks (a repo's hooks
+  run only after you trust them).
+- Terminal: compact tool lines with Ctrl+X for the full transcript, a progress line with Esc to
+  stop, Ctrl+C to clear, Ctrl+R history, Ctrl+G editor, readline keys, `!command`, `salaam -c`,
+  a session picker, the `?` key sheet and the window title.
+- Zed and other ACP editors: `salaam acp --local` opens your desk session in the project folder,
+  with the mode picker, approvals that show diffs and offer Allow for this session, finished edits
+  as diffs, and `/rewind` for files.
+
+### Fixed
+
+- Salaam starts in Zed when you have MCP servers configured: the desk session ignores the editor's
+  own MCP servers instead of refusing them.
+- Tool calls show in the turn they belong to, and the full transcript shows command output as text.
+- Usage counts cached input and the whole cost.
+- Choosing a model that needs a new session opens one with that model instead of the old one.
+- A failed session shows its error; leftover background commands are stopped after a restart on
+  macOS.
+
 ## [0.0.4] - 2026-10-30
 
 Board work on a protected AgentPod station, made to match the Hermes workflow, plus a sandbox

package/dist/src/acp-desk.js

@@ -0,0 +1,140 @@
+import { isAbsolute, join } from 'node:path';
+import { relativeTime } from './session-pick.js';
+const MODES = [
+    { id: 'review', name: 'Review', description: 'Asks before every edit and command' },
+    {
+        id: 'accept-edits',
+        name: 'Accept edits',
+        description: 'Edits in the project apply at once; commands ask',
+    },
+    {
+        id: 'auto',
+        name: 'Auto',
+        description: 'Project edits and sandboxed commands run at once; the rest asks',
+    },
+    {
+        id: 'full-access',
+        name: 'Full access',
+        description: 'No OS sandbox; only dangerous commands ask',
+    },
+];
+const YOLO = {
+    id: 'yolo',
+    name: 'YOLO',
+    description: 'No approvals at all and no sandbox. Turn it off in the terminal with /yolo',
+};
+export function deskMode(policy) {
+    if (policy.access === 'yolo')
+        return 'yolo';
+    if (policy.access === 'full')
+        return 'full-access';
+    return policy.mode;
+}
+/** `modes` and the matching `configOptions`, kept in step (ACP asks agents to send both). */
+export function modeState(p) {
+    const current = deskMode(p.policy);
+    const list = MODES.filter((m) => m.id !== 'full-access' || p.full_access_allowed !== false);
+    if (current === 'yolo')
+        list.push(YOLO);
+    else if (!list.some((m) => m.id === current))
+        list.unshift({ id: current, name: current, description: 'Set in the terminal' });
+    return {
+        modes: { currentModeId: current, availableModes: list },
+        configOptions: [
+            {
+                id: 'mode',
+                name: 'Mode',
+                category: 'mode',
+                type: 'select',
+                currentValue: current,
+                options: list.map((m) => ({ value: m.id, name: m.name, description: m.description })),
+            },
+        ],
+    };
+}
+/** The policy a chosen mode asks for. Picking a mode turns full access off; full access runs in
+ * auto, so edits and commands go ahead and only dangerous commands ask. */
+export function policyFor(mode, allowed = {}) {
+    if (mode === 'review' || mode === 'accept-edits' || mode === 'auto')
+        return { mode, paths: [] };
+    if (mode === 'full-access') {
+        if (allowed.full === false)
+            throw new Error('The operator does not allow full access on this host. Commands stay in the OS sandbox.');
+        return { mode: 'auto', paths: [], access: 'full' };
+    }
+    if (mode === 'yolo')
+        throw new Error('YOLO is turned on only in the terminal: run /yolo there and type yolo.');
+    throw new Error('Unknown mode ' + JSON.stringify(mode));
+}
+export const FULL_ACCESS_WARNING = 'Later commands in this session run WITHOUT the OS sandbox: they can read and change any file your user can, and reach the network directly. They run without asking, except commands the danger check calls dangerous (force pushes, deletes, publishing, credentials, anything it cannot read), which still ask and say why. Pick another mode to turn it off.';
+/** ACP diff content for an edit request: absolute paths, null old text for a new file. */
+export function editDiffs(root, edits) {
+    return edits.map((e) => ({
+        type: 'diff',
+        path: isAbsolute(e.path) ? e.path : join(root, e.path),
+        oldText: e.before,
+        newText: e.after,
+    }));
+}
+/** Why an approval asks, from the reviewed text and the mode, in one line. */
+export function askReason(value, mode) {
+    const danger = /^Dangerous \(([^)]+)\): (.*)$/m.exec(value);
+    if (danger)
+        return `Asks because this command is dangerous (${danger[1]}): ${danger[2]}`;
+    const outside = /^Outside the sandbox: (.*?)\. This one command/m.exec(value);
+    if (outside)
+        return `Asks because it wants to run outside the sandbox: ${outside[1]}`;
+    if (/^Publishes: /m.test(value))
+        return 'Asks because pushing and opening pull requests always ask.';
+    if (/^May listen: /m.test(value))
+        return 'Asks because this command may accept network connections; macOS cannot limit it to localhost.';
+    const edit = /^(---|\+\+\+) /m.test(value) && !/\nCommand:\n/.test(value);
+    if (mode === 'review')
+        return 'Asks because review mode asks before every edit and command.';
+    if (mode === 'accept-edits' && !edit)
+        return 'Asks because accept edits still asks before commands.';
+    if (mode === 'auto')
+        return edit
+            ? 'Asks because this edit is outside what auto mode approves on its own.'
+            : 'Asks because auto mode approves only sandboxed commands it can read.';
+    return 'Asks because nothing approves this request on its own.';
+}
+export const DESK_COMMANDS = [
+    {
+        name: 'rewind',
+        description: 'Put the files back as they were before an earlier turn',
+        input: { hint: 'turn number (leave empty to list turns)' },
+    },
+];
+/** `/rewind`, `/rewind 3`. Anything else is not a desk command and goes to the model. */
+export function parseDeskCommand(text) {
+    const match = /^\/rewind(?:\s+(\S+))?\s*$/.exec(text.trim());
+    if (!match)
+        return null;
+    if (match[1] === undefined)
+        return { command: 'rewind' };
+    const turn = Number(match[1]);
+    if (!Number.isSafeInteger(turn) || turn < 1)
+        throw new Error('Use /rewind with a turn number from the list, e.g. /rewind 3.');
+    return { command: 'rewind', turn };
+}
+export function checkpointList(points, now = Date.now()) {
+    if (!points.length)
+        return 'No turns to go back to yet.';
+    return [
+        'Turns you can go back to (the files as they were before each turn ran):',
+        '',
+        ...points
+            .slice()
+            .reverse()
+            .map((p) => `- Turn ${p.turn} · ${relativeTime(p.at, now)} · ${p.text.split('\n')[0].slice(0, 80)}`),
+        '',
+        'Run /rewind followed by a turn number to review and restore its files.',
+    ].join('\n');
+}
+/** Zed cannot follow a rewind into a new session, so from the editor only files are restored. */
+export const REWIND_CHOICES = [
+    { optionId: 'files', name: 'Restore files', kind: 'allow_once' },
+    { optionId: 'cancel', name: 'Cancel', kind: 'reject_once' },
+];
+export const CONVERSATION_REWIND_NOTE = 'To go back in the conversation too, run /rewind in the terminal (salaam -c opens this session): it continues in a new session.';

package/dist/src/acp-outcome.js

@@ -387,27 +387,31 @@ export function toolMetadata(name, input, root) {
     const action = String(args.action ?? '');
     const kind = name === 'salaam_board'
         ? 'read'
-        : name === 'salaam_command' || (name === 'salaam_station' && action === 'check')
-            ? ['start', 'cancel', 'check'].includes(action)
-                ? 'execute'
-                : ['status', 'logs'].includes(action)
-                    ? 'read'
-                    : 'other'
-            : ['salaam_files', 'salaam_station'].includes(name) && action === 'patch'
-                ? args.content === null
-                    ? 'delete'
-                    : 'edit'
-                : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
-                    ['search', 'list'].includes(action)
-                    ? 'search'
-                    : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
-                        ['read', 'inspect', ...(name === 'salaam_repository' ? ['diff'] : [])].includes(action)
+        : name === 'salaam_local' && ['edit', 'command'].includes(action)
+            ? action === 'edit'
+                ? 'edit'
+                : 'execute'
+            : name === 'salaam_command' || (name === 'salaam_station' && action === 'check')
+                ? ['start', 'cancel', 'check'].includes(action)
+                    ? 'execute'
+                    : ['status', 'logs'].includes(action)
                         ? 'read'
-                        : ['salaam_history', 'inspect_child', 'consume_child_result'].includes(name)
+                        : 'other'
+                : ['salaam_files', 'salaam_station'].includes(name) && action === 'patch'
+                    ? args.content === null
+                        ? 'delete'
+                        : 'edit'
+                    : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
+                        ['search', 'list'].includes(action)
+                        ? 'search'
+                        : ['salaam_files', 'salaam_repository', 'salaam_station'].includes(name) &&
+                            ['read', 'inspect', ...(name === 'salaam_repository' ? ['diff'] : [])].includes(action)
                             ? 'read'
-                            : name === 'salaam_operator_mcp'
-                                ? operatorMcpKind(action, args.tool)
-                                : 'other';
+                            : ['salaam_history', 'inspect_child', 'consume_child_result'].includes(name)
+                                ? 'read'
+                                : name === 'salaam_operator_mcp'
+                                    ? operatorMcpKind(action, args.tool)
+                                    : 'other';
     const locations = [];
     if (['salaam_files', 'salaam_station'].includes(name) &&
         root &&

package/dist/src/acp.js

@@ -8,6 +8,9 @@ import { AcpJournal } from './acp-journal.js';
 import { VERSION } from './config.js';
 import { acpFailure, AcpFailureError, permissionKind, toolMetadata, toolTitle, planUpdate, } from './acp-outcome.js';
 import { validateManagedMcpDeclarations } from './mcp-acp.js';
+import { askReason, checkpointList, CONVERSATION_REWIND_NOTE, DESK_COMMANDS, editDiffs, FULL_ACCESS_WARNING, modeState, parseDeskCommand, policyFor, REWIND_CHOICES, } from './acp-desk.js';
+import { onceOnlyReason } from './approval-rules.js';
+import { rewindSummary } from './tui-review.js';
 import { object, string, ServiceError, } from './protocol.js';
 /** ACP v1 newline-delimited stdio adapter. The daemon remains the only worker owner. */
 export async function acp(state, options = {}) {
@@ -28,9 +31,11 @@ export async function acp(state, options = {}) {
             JSON.stringify({ version: 1, owner: 'superpipeline' }) ||
             bound?.binding.run.source !== 'superpipeline'))
         throw new Error('Unsupported authenticated work control handoff');
-    let closed = false, initialized = false, wantsReceipts = false, wantsCancellations = false, wantsTypedStops = false;
+    let closed = false, ignoredMcp = false, initialized = false, wantsReceipts = false, wantsCancellations = false, wantsTypedStops = false;
     const sessions = new Map();
     const permissionReplies = new Map();
+    /** Questions asked through the editor's permission prompt; an error or cancel counts as no. */
+    const confirmations = new Map();
     const activeRequests = new Set();
     let output = Promise.resolve();
     const send = (value) => {
@@ -114,6 +119,109 @@ export async function acp(state, options = {}) {
         content: { type: 'text', text: content },
     });
     const snapshot = (id) => call(socket, `/v1/sessions/${id}/snapshot`);
+    const permissions = (id) => call(socket, `/v1/sessions/${id}/permissions`);
+    const say = (id, text) => update(id, { sessionUpdate: 'agent_message_chunk', content: { type: 'text', text } });
+    /** Ask one question in the editor and wait for the chosen option id. */
+    const ask = async (c, title, body, options) => {
+        const id = 'confirm:' + randomUUID();
+        const toolCall = {
+            toolCallId: 'salaam-' + id,
+            title,
+            kind: 'other',
+            status: 'pending',
+            content: [{ type: 'content', content: { type: 'text', text: body } }],
+        };
+        await update(c.id, { sessionUpdate: 'tool_call', ...toolCall });
+        const chosen = new Promise((resolve) => confirmations.set(id, resolve));
+        await send({
+            jsonrpc: '2.0',
+            id,
+            method: 'session/request_permission',
+            params: { sessionId: c.id, toolCall, options },
+        });
+        const option = await chosen;
+        await update(c.id, {
+            sessionUpdate: 'tool_call_update',
+            toolCallId: toolCall.toolCallId,
+            status: option === 'cancel' || option === 'cancelled' ? 'failed' : 'completed',
+        });
+        return option;
+    };
+    /** The mode picker's state; sent again when the mode changes anywhere, e.g. Shift+Tab in the terminal. */
+    const deskState = async (c, announce = false) => {
+        if (!c.desk)
+            return {};
+        const current = await permissions(c.id);
+        const state = modeState(current);
+        const changed = c.desk.mode !== state.modes.currentModeId;
+        c.desk.mode = state.modes.currentModeId;
+        c.desk.policyMode = current.policy.mode;
+        if (announce && changed) {
+            await update(c.id, {
+                sessionUpdate: 'current_mode_update',
+                currentModeId: state.modes.currentModeId,
+            });
+            await update(c.id, {
+                sessionUpdate: 'config_option_update',
+                configOptions: state.configOptions,
+            });
+        }
+        return state;
+    };
+    const setMode = async (c, modeId) => {
+        if (!c.desk)
+            throw new ServiceError('modes_unavailable', 'Modes are for your own local coding sessions (salaam acp --local)');
+        const current = await permissions(c.id);
+        const next = policyFor(modeId, { full: current.full_access_allowed });
+        if (next.access === 'full' && current.policy.access !== 'full') {
+            const choice = await ask(c, 'Turn on full access?', FULL_ACCESS_WARNING, [
+                { optionId: 'on', name: 'Turn on full access', kind: 'allow_once' },
+                { optionId: 'cancel', name: 'Keep the current mode', kind: 'reject_once' },
+            ]);
+            if (choice !== 'on') {
+                // The picker already moved; put it back.
+                c.desk.mode = undefined;
+                return deskState(c, true);
+            }
+        }
+        await call(socket, `/v1/sessions/${c.id}/permissions`, {
+            ...(await controller(c)),
+            request_id: randomUUID(),
+            expected_revision: current.policy.revision,
+            policy: next,
+        });
+        return deskState(c, true);
+    };
+    /** /rewind from the editor: list turns, or review one turn's files and restore them on a yes. */
+    const rewind = async (c, turn) => {
+        if (!c.desk)
+            throw new Error('/rewind is for your own local coding sessions.');
+        const { checkpoints } = await call(socket, `/v1/sessions/${c.id}/checkpoints`);
+        if (turn === undefined)
+            return say(c.id, checkpointList(checkpoints));
+        const point = checkpoints.find((p) => p.turn === turn);
+        if (!point)
+            return say(c.id, `No checkpoint for turn ${turn}. /rewind lists them.`);
+        const review = await call(socket, `/v1/sessions/${c.id}/rewind?attempt=${encodeURIComponent(point.attempt_id)}&mode=files`);
+        const body = rewindSummary(review) +
+            (review.background_running
+                ? `\n${review.background_running} background command(s) are still running and may write while you decide.`
+                : '') +
+            '\n\n' +
+            CONVERSATION_REWIND_NOTE;
+        if ((await ask(c, `Rewind files to before turn ${review.turn}`, body, REWIND_CHOICES)) !== 'files')
+            return say(c.id, 'Nothing was restored.');
+        const result = await call(socket, `/v1/sessions/${c.id}/rewind`, {
+            ...(await controller(c)),
+            request_id: randomUUID(),
+            attempt_id: review.attempt_id,
+            mode: review.mode,
+            review_digest: review.digest,
+        });
+        return say(c.id, result.state === 'completed'
+            ? `Files restored to before turn ${review.turn}. The conversation is kept as it is.`
+            : 'Rewind outcome is uncertain; inspect files before continuing.');
+    };
     const toolDetails = async (session, id, name, input) => (await call(socket, `/v1/sessions/${session}/tool-metadata?call_id=${encodeURIComponent(id)}`)) ?? toolMetadata(name, input);
     const readEntry = async (id, entry) => {
         let content = '', offset = 0;
@@ -213,11 +321,33 @@ export async function acp(state, options = {}) {
             const op = await call(socket, `/v1/operations/${approval.operation_id}`);
             c.permissions.add(approval.id);
             const id = 'permission:' + randomUUID();
+            const value = String(op.value);
+            // Your own session can approve for the rest of it, unless the command can never be a rule.
+            const sessionRule = !!c.desk?.rules && !onceOnlyReason(value);
+            const edits = c.desk
+                ? await call(socket, `/v1/sessions/${c.id}/local-edits?operation_id=${encodeURIComponent(op.id)}`).catch(() => null)
+                : null;
             const toolCall = {
                 toolCallId: 'salaam-operation:' + op.id,
                 title: op.kind + ': ' + op.target,
-                kind: permissionKind(op.kind),
+                kind: edits ? 'edit' : permissionKind(op.kind),
                 status: 'pending',
+                ...(c.desk
+                    ? {
+                        content: [
+                            {
+                                type: 'content',
+                                content: { type: 'text', text: askReason(value, c.desk.policyMode) },
+                            },
+                            ...(edits?.edits.length
+                                ? editDiffs(edits.root, edits.edits)
+                                : [{ type: 'content', content: { type: 'text', text: value } }]),
+                        ],
+                        ...(edits?.edits.length
+                            ? { locations: editDiffs(edits.root, edits.edits).map((d) => ({ path: d.path })) }
+                            : {}),
+                    }
+                    : {}),
                 rawInput: {
                     target: op.target,
                     value: op.value,
@@ -235,11 +365,29 @@ export async function acp(state, options = {}) {
                     return;
                 }
                 if (outcome.outcome !== 'selected' ||
-                    !['allow-once', 'reject-once'].includes(String(outcome.optionId)))
+                    !['allow-once', 'reject-once', ...(sessionRule ? ['allow-session'] : [])].includes(String(outcome.optionId)))
                     throw new Error('Invalid permission outcome');
+                if (outcome.optionId === 'allow-session') {
+                    // The rule is the exact request just reviewed. If it cannot become one, nothing is
+                    // approved and the request is asked again.
+                    try {
+                        await call(socket, `/v1/sessions/${c.id}/approval-rules`, {
+                            ...(await controller(c)),
+                            request_id: randomUUID(),
+                            scope: 'session',
+                            operation_id: op.id,
+                        });
+                    }
+                    catch (error) {
+                        await say(c.id, `Not saved as a rule: ${error.message} Nothing was approved; it will ask again.`);
+                        c.permissions.delete(approval.id);
+                        void refresh(c).catch(() => { });
+                        return;
+                    }
+                }
                 const decide = async () => {
                     const outbox = new Outbox(client, c.id);
-                    outbox.enqueueDecision(approval.id, approval.operation_digest, approval.revision, outcome.optionId === 'allow-once' ? 'approve' : 'deny');
+                    outbox.enqueueDecision(approval.id, approval.operation_digest, approval.revision, outcome.optionId === 'reject-once' ? 'deny' : 'approve');
                     await outbox.flush(socket, c.id);
                 };
                 c.decisions = c.decisions.catch(() => { }).then(decide);
@@ -254,6 +402,15 @@ export async function acp(state, options = {}) {
                     toolCall,
                     options: [
                         { optionId: 'allow-once', name: 'Allow once', kind: 'allow_once' },
+                        ...(sessionRule
+                            ? [
+                                {
+                                    optionId: 'allow-session',
+                                    name: 'Allow for this session',
+                                    kind: 'allow_always',
+                                },
+                            ]
+                            : []),
                         { optionId: 'reject-once', name: 'Reject', kind: 'reject_once' },
                     ],
                 },
@@ -321,7 +478,15 @@ export async function acp(state, options = {}) {
                     const started = event.kind === 'tool.started';
                     const fresh = !c.liveTools.has(p.tool_call_id);
                     c.liveTools.add(p.tool_call_id);
-                    void update(c.id, {
+                    const callId = p.tool_call_id;
+                    // A finished edit in your own session shows as a diff, whichever mode applied it.
+                    const diffs = !started && !p.failed && c.desk && p.tool === 'salaam_local'
+                        ? call(socket, `/v1/sessions/${c.id}/local-edits?tool_call=${encodeURIComponent(callId)}`)
+                            .then((found) => (found ? editDiffs(found.root, found.edits) : []))
+                            .catch(() => [])
+                        : Promise.resolve([]);
+                    void diffs
+                        .then(async (diff) => update(c.id, {
                         sessionUpdate: started && fresh ? 'tool_call' : 'tool_call_update',
                         toolCallId: p.tool_call_id,
                         title: p.tool ? toolTitle(p.tool, p.input) : 'Tool',
@@ -333,17 +498,29 @@ export async function acp(state, options = {}) {
                             : {}),
                         status: started ? 'in_progress' : p.failed ? 'failed' : 'completed',
                         ...(started && p.input ? { rawInput: p.input } : {}),
-                        ...(!started && p.output
-                            ? { content: [{ type: 'content', content: { type: 'text', text: p.output } }] }
+                        ...(!started && (p.output || diff.length)
+                            ? {
+                                content: [
+                                    ...diff,
+                                    ...(p.output
+                                        ? [{ type: 'content', content: { type: 'text', text: p.output } }]
+                                        : []),
+                                ],
+                            }
                             : {}),
                         ...(p.parent_tool_call_id
                             ? { _meta: { 'salaam.dev/parentToolCallId': p.parent_tool_call_id } }
                             : {}),
-                    }).catch((error) => {
+                    }))
+                        .catch((error) => {
                         c.failed = error;
                     });
                 }
             }
+            if (event.kind === 'permissions.configured' && c.desk)
+                void deskState(c, true).catch((error) => {
+                    c.failed = error;
+                });
             if (event.kind.startsWith('work_task.'))
                 void sendPlan(c).catch((error) => {
                     c.failed = error;
@@ -409,6 +586,13 @@ export async function acp(state, options = {}) {
         };
         sessions.set(id, c);
         try {
+            if (!bound) {
+                const current = await permissions(id).catch(() => undefined);
+                if (current?.coding && current.configurable) {
+                    const rules = await call(socket, `/v1/sessions/${id}/approval-rules`).catch(() => ({ applies: false }));
+                    c.desk = { rules: rules.applies };
+                }
+            }
             if (view.state !== 'ready') {
                 const actor = await controller(c, object(params._meta ?? {})['salaam.dev/takeover'] === true, true);
                 await call(socket, `/v1/sessions/${id}/resume`, actor);
@@ -448,10 +632,18 @@ export async function acp(state, options = {}) {
                     await promptReceipt(id, record.request_id, record.receipt.attempt_id);
             if (wantsCancellations)
                 await cancellationReceipts(c);
+            if (c.desk)
+                await deskState(c);
             await approvals(c, view);
             // The plan is visible before any step runs.
             await sendPlan(c, view.work_task ?? null);
             watch(c);
+            if (c.desk)
+                // After the response, so the editor knows the session first.
+                setImmediate(() => void update(id, {
+                    sessionUpdate: 'available_commands_update',
+                    availableCommands: DESK_COMMANDS,
+                }).catch(() => { }));
         }
         catch (error) {
             sessions.delete(id);
@@ -531,7 +723,17 @@ export async function acp(state, options = {}) {
         }
         if (['session/new', 'session/load', 'session/resume'].includes(method)) {
             const cwd = string(params.cwd, 'cwd');
-            validateManagedMcpDeclarations(params.mcpServers, bound?.managed_mcp);
+            // An editor forwards its own MCP servers. A desk session never connects to them, so it
+            // ignores the list; station work keeps the exact node assignment check.
+            const desk = !bound && (object(params._meta ?? {})['salaam.dev/local'] ?? options.local) === true;
+            if (desk && Array.isArray(params.mcpServers)) {
+                if (params.mcpServers.length && !ignoredMcp) {
+                    ignoredMcp = true;
+                    console.error(`Salaam does not use the editor's MCP servers; ignored ${params.mcpServers.length}.`);
+                }
+            }
+            else
+                validateManagedMcpDeclarations(params.mcpServers, bound?.managed_mcp);
             if (!isAbsolute(cwd) ||
                 (Array.isArray(params.additionalDirectories) && params.additionalDirectories.length))
                 throw new Error('Use an absolute cwd and no extra directories');
@@ -549,6 +751,22 @@ export async function acp(state, options = {}) {
                 const coding = object(params._meta ?? {})['salaam.dev/coding'] ?? options.coding ?? false;
                 if (typeof coding !== 'boolean')
                     throw new Error('Coding selection must be a boolean.');
+                const local = object(params._meta ?? {})['salaam.dev/local'] ?? options.local ?? false;
+                if (typeof local !== 'boolean')
+                    throw new Error('Local selection must be a boolean.');
+                if (local && coding)
+                    throw new Error('Choose a local session in the project folder or a guarded coding copy.');
+                if (local) {
+                    // Your desk session in the project folder itself, the same as salaam in a terminal there.
+                    const created = await call(socket, '/v1/sessions', {
+                        request_id: randomUUID(),
+                        cwd,
+                        local_workspace: true,
+                        local_coding: true,
+                    });
+                    const c = await connect(created.id, false, params);
+                    return { sessionId: created.id, ...(await deskState(c)) };
+                }
                 if (coding) {
                     const health = await call(socket, '/v1/health');
                     if (!health.coding_root)
@@ -562,8 +780,21 @@ export async function acp(state, options = {}) {
                 await connect(created.id, false, params);
                 return { sessionId: created.id };
             }
-            await connect(string(params.sessionId, 'sessionId', 128), method === 'session/load', params);
-            return {};
+            const c = await connect(string(params.sessionId, 'sessionId', 128), method === 'session/load', params);
+            return await deskState(c);
+        }
+        if (method === 'session/set_mode' || method === 'session/set_config_option') {
+            const c = sessions.get(string(params.sessionId, 'sessionId', 128));
+            if (!c)
+                throw new Error('Load or resume this session first');
+            if (method === 'session/set_mode') {
+                await setMode(c, string(params.modeId, 'modeId', 64));
+                return {};
+            }
+            if (params.configId !== 'mode')
+                throw new Error('Unknown setting');
+            const state = await setMode(c, string(params.value, 'value', 64));
+            return { configOptions: 'configOptions' in state ? state.configOptions : [] };
         }
         if (!['session/cancel', 'session/prompt'].includes(method))
             throw new ServiceError('method_not_found', 'Unsupported ACP method', 404);
@@ -593,6 +824,12 @@ export async function acp(state, options = {}) {
             throw new Error('Only text and resource links are supported');
         })
             .join('\n');
+        const command = c.desk ? parseDeskCommand(input) : null;
+        if (command) {
+            // Handled here, never sent to the model.
+            await rewind(c, command.turn);
+            return { stopReason: 'end_turn' };
+        }
         const meta = object(params._meta ?? {});
         const logical = meta['salaam.dev/requestId'] === undefined
             ? randomUUID()
@@ -698,6 +935,13 @@ export async function acp(state, options = {}) {
             id = value.id;
             if (typeof value.method !== 'string') {
                 response = true;
+                if (typeof id === 'string' && confirmations.has(id)) {
+                    const resolve = confirmations.get(id);
+                    confirmations.delete(id);
+                    const outcome = object(object(value.result ?? {}).outcome ?? {});
+                    resolve(!value.error && outcome.outcome === 'selected' ? String(outcome.optionId) : 'cancelled');
+                    return;
+                }
                 if (typeof id === 'string' && permissionReplies.has(id)) {
                     const respond = permissionReplies.get(id);
                     permissionReplies.delete(id);
@@ -779,6 +1023,9 @@ export async function acp(state, options = {}) {
         clearInterval(renew);
         clearInterval(cancellationPoll);
         permissionReplies.clear();
+        for (const resolve of confirmations.values())
+            resolve('cancelled');
+        confirmations.clear();
         for (const c of sessions.values()) {
             c.feed?.close();
             if (c.lease)