@superjackfruitlabs/salaam 0.0.4 → 0.0.5

package/dist/src/approval-rules.js

@@ -0,0 +1,287 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { object, ServiceError } from './protocol.js';
+const SHELL_SPECIAL = /[;&|<>`$(){}\\\n\r*?[\]~!#]/;
+const PRIVATE_PART = /^(\.|credentials$|secrets$)/;
+/** The command's words, or null when a shell would read it as more than plain words. */
+export function commandArgv(command) {
+    const words = [];
+    let word = '', inWord = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (ch === "'") {
+            const end = command.indexOf("'", i + 1);
+            if (end < 0)
+                return null;
+            word += command.slice(i + 1, end);
+            inWord = true;
+            i = end;
+        }
+        else if (ch === '"') {
+            const end = command.indexOf('"', i + 1);
+            if (end < 0)
+                return null;
+            const inner = command.slice(i + 1, end);
+            if (/[$`\\]/.test(inner))
+                return null;
+            word += inner;
+            inWord = true;
+            i = end;
+        }
+        else if (ch === ' ' || ch === '\t') {
+            if (inWord)
+                words.push(word);
+            word = '';
+            inWord = false;
+        }
+        else if (SHELL_SPECIAL.test(ch))
+            return null;
+        else {
+            word += ch;
+            inWord = true;
+        }
+    }
+    if (inWord)
+        words.push(word);
+    // A leading NAME=value is an environment assignment, not a command word.
+    if (!words.length || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))
+        return null;
+    return words;
+}
+function patternWords(pattern) {
+    const words = pattern.trim().split(/\s+/);
+    if (!pattern.trim() || words.some((w) => /[;&|<>`$(){}\\'"!#~?[\]]/.test(w)))
+        throw new ServiceError('invalid_rule', 'A command rule is plain words; a word may use *, and a final * takes any further words');
+    return words;
+}
+const wordRe = (w) => new RegExp('^' +
+    w
+        .split('*')
+        .map((p) => p.replace(/[.+^${}()|[\]\\]/g, '\\$&'))
+        .join('.*') +
+    '$');
+function commandMatches(pattern, argv) {
+    const words = patternWords(pattern);
+    const rest = words[words.length - 1] === '*';
+    const fixed = rest ? words.slice(0, -1) : words;
+    if (rest ? argv.length < fixed.length : argv.length !== fixed.length)
+        return false;
+    return fixed.every((w, i) => wordRe(w).test(argv[i]));
+}
+/** A project-relative glob as a regex: `**` spans segments, `*` stays within one. */
+function globRe(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i++) {
+        if (glob.startsWith('**/', i)) {
+            re += '(?:.*/)?';
+            i += 2;
+        }
+        else if (glob.startsWith('/**', i) && i + 3 === glob.length) {
+            re += '(?:/.*)?';
+            i += 2;
+        }
+        else if (glob.startsWith('**', i)) {
+            re += '.*';
+            i += 1;
+        }
+        else if (glob[i] === '*')
+            re += '[^/]*';
+        else
+            re += glob[i].replace(/[.+^${}()|[\]\\?]/g, '\\$&');
+    }
+    return new RegExp('^' + re + '$');
+}
+const pathMatches = (globs, path) => globs.some((g) => globRe(g).test(path));
+export function validateRule(value) {
+    const input = object(value);
+    if (Object.keys(input).some((k) => !['effect', 'tool', 'command', 'paths'].includes(k)))
+        throw new ServiceError('invalid_rule', 'A rule has effect, tool, and command or paths only');
+    if (!['allow', 'ask', 'deny'].includes(String(input.effect)))
+        throw new ServiceError('invalid_rule', 'A rule effect is allow, ask or deny');
+    if (!['command', 'edit', 'any'].includes(String(input.tool)))
+        throw new ServiceError('invalid_rule', 'A rule tool is command, edit or any');
+    const rule = { effect: input.effect, tool: input.tool };
+    if (input.command !== undefined) {
+        if (typeof input.command !== 'string' || input.command.length > 512 || input.tool === 'edit')
+            throw new ServiceError('invalid_rule', 'Only command rules take a command pattern');
+        patternWords(input.command);
+        rule.command = input.command.trim().split(/\s+/).join(' ');
+    }
+    if (input.paths !== undefined) {
+        const paths = input.paths;
+        if (input.tool === 'command' ||
+            !Array.isArray(paths) ||
+            !paths.length ||
+            paths.length > 32 ||
+            paths.some((p) => typeof p !== 'string' ||
+                p.length > 512 ||
+                p.startsWith('/') ||
+                /[\x00-\x1f\x7f\\]/.test(p) ||
+                p.split('/').some((part) => !part || part === '..' || PRIVATE_PART.test(part))))
+            throw new ServiceError('invalid_rule', 'Edit rules take up to 32 project-relative globs; no absolute paths, traversal or private paths');
+        rule.paths = [...paths];
+    }
+    if (rule.tool === 'edit' && !rule.paths)
+        throw new ServiceError('invalid_rule', 'An edit rule names the paths it covers');
+    return rule;
+}
+/** The deciding rule for a request: deny beats ask beats allow; no match asks. */
+export function evaluateRules(rules, request) {
+    const matching = rules.filter((r) => {
+        if (r.tool !== 'any' && r.tool !== request.tool)
+            return false;
+        if (request.tool === 'command') {
+            if (r.paths)
+                return false;
+            if (!r.command)
+                return r.effect === 'deny' || request.argv !== null;
+            return request.argv !== null && commandMatches(r.command, request.argv);
+        }
+        if (!r.paths)
+            return r.tool === 'any' && !r.command;
+        return r.effect === 'allow'
+            ? request.paths.length > 0 && request.paths.every((p) => pathMatches(r.paths, p))
+            : request.paths.some((p) => pathMatches(r.paths, p));
+    });
+    for (const effect of ['deny', 'ask', 'allow']) {
+        const rule = matching.find((r) => r.effect === effect);
+        if (rule)
+            return { effect, rule };
+    }
+    return { effect: 'ask' };
+}
+export function defaultUserRulesFile(env = process.env) {
+    return (env.SALAAM_PERMISSIONS_FILE ||
+        join(env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'salaam', 'permissions.json'));
+}
+export class ApprovalRules {
+    store;
+    userFile;
+    constructor(store, userFile = defaultUserRulesFile()) {
+        this.store = store;
+        this.userFile = userFile;
+        store.db.exec(`CREATE TABLE IF NOT EXISTS approval_rules(
+      id TEXT PRIMARY KEY NOT NULL,
+      scope TEXT NOT NULL CHECK(scope IN ('session','repo')),
+      session_id TEXT,
+      root TEXT NOT NULL,
+      rule TEXT NOT NULL,
+      created_at INTEGER NOT NULL)`);
+    }
+    /** Whether rules apply: only desk sessions, never host-managed (AgentPod) or child work. */
+    applies(session) {
+        if (!this.store.localCoding(session))
+            return false;
+        const has = (sql) => {
+            try {
+                return !!this.store.db.prepare(sql).get(session);
+            }
+            catch {
+                return false;
+            }
+        };
+        return (!has('SELECT 1 FROM agentpod_admissions WHERE session_id=?') &&
+            !has('SELECT 1 FROM child_tasks WHERE child_session=?'));
+    }
+    userRules() {
+        let text;
+        try {
+            text = readFileSync(this.userFile, 'utf8');
+        }
+        catch {
+            return { rules: [] };
+        }
+        try {
+            const doc = object(JSON.parse(text));
+            if (doc.version !== 1 || !Array.isArray(doc.rules))
+                throw new Error('expected {"version": 1, "rules": [...]}');
+            return {
+                rules: doc.rules.map((r, i) => ({
+                    ...validateRule(r),
+                    id: 'user:' + i,
+                    source: 'user',
+                })),
+            };
+        }
+        catch (error) {
+            return {
+                rules: [],
+                problem: `${this.userFile} is ignored: ${error instanceof Error ? error.message : 'unreadable'}`,
+            };
+        }
+    }
+    list(session) {
+        const root = this.store.session(session).cwd;
+        const stored = this.store.db
+            .prepare("SELECT id,scope,rule FROM approval_rules WHERE (scope='session' AND session_id=?) OR (scope='repo' AND root=?) ORDER BY created_at,rowid")
+            .all(session, root);
+        return [
+            ...stored.map((r) => ({
+                ...JSON.parse(r.rule),
+                id: r.id,
+                source: r.scope,
+            })),
+            ...this.userRules().rules,
+        ];
+    }
+    problems(session) {
+        void session;
+        const problem = this.userRules().problem;
+        return problem ? [problem] : [];
+    }
+    add(session, scope, value, request) {
+        const rule = validateRule(value);
+        if (!this.applies(session))
+            throw new ServiceError('rules_unavailable', 'Approval rules apply only to desk coding sessions');
+        return this.store.request('local-operator', request, { kind: 'approval-rule', session, scope, rule }, () => {
+            const id = randomUUID();
+            this.store.db
+                .prepare('INSERT INTO approval_rules(id,scope,session_id,root,rule,created_at) VALUES(?,?,?,?,?,?)')
+                .run(id, scope, scope === 'session' ? session : null, this.store.session(session).cwd, JSON.stringify(rule), Date.now());
+            this.store.event(session, 'approval_rule.added', { id, scope, rule });
+            return { ...rule, id, source: scope };
+        });
+    }
+    remove(session, id) {
+        const root = this.store.session(session).cwd;
+        const done = this.store.db
+            .prepare("DELETE FROM approval_rules WHERE id=? AND ((scope='session' AND session_id=?) OR (scope='repo' AND root=?))")
+            .run(id, session, root);
+        if (!done.changes)
+            throw new ServiceError('rule_not_found', 'No such rule for this session or repository');
+        this.store.event(session, 'approval_rule.removed', { id });
+    }
+    /** The rule an approved operation stands for: the exact command words, or the exact edited paths. */
+    ruleFor(args) {
+        if (args.action === 'command') {
+            const argv = commandArgv(args.command ?? '');
+            if (!argv)
+                throw new ServiceError('invalid_rule', 'This command uses shell features a rule cannot match safely; approve it once instead');
+            const quote = (w) => /^[A-Za-z0-9_@%+=:,./-]+$/.test(w) && !w.includes('*') ? w : null;
+            if (argv.some((w) => quote(w) === null))
+                throw new ServiceError('invalid_rule', 'This command has words a rule cannot spell exactly; approve it once instead');
+            return validateRule({ effect: 'allow', tool: 'command', command: argv.join(' ') });
+        }
+        if (args.action === 'edit' && args.edits?.length)
+            return validateRule({ effect: 'allow', tool: 'edit', paths: args.edits.map((e) => e.path) });
+        throw new ServiceError('invalid_rule', 'Only local commands and edits can become rules');
+    }
+    addFromOperation(session, operation, scope, request) {
+        const row = this.store.db
+            .prepare('SELECT args,session_id FROM local_calls WHERE operation_id=?')
+            .get(operation);
+        if (!row || row.session_id !== session)
+            throw new ServiceError('rule_not_found', 'That request is not a local command or edit in this session');
+        return this.add(session, scope, this.ruleFor(JSON.parse(row.args)), request);
+    }
+}
+/** Why a reviewed request can only be approved once: a command with shell features (pipes,
+ * redirects, substitutions) can never become an approval rule. Undefined when a rule is possible. */
+export function onceOnlyReason(value) {
+    const command = /\nCommand:\n([\s\S]*)$/.exec(value)?.[1];
+    return command !== undefined && commandArgv(command) === null
+        ? 'This command uses shell features (pipes, redirects, substitutions), so it cannot become a rule. Approve it once or deny it.'
+        : undefined;
+}

package/dist/src/attach.js

@@ -41,7 +41,7 @@ export class Outbox {
         renameSync(temporary, path);
         syncDirectory(this.dir);
     }
-    enqueue(text, revision, continues) {
+    enqueue(text, revision, continues, confirmSensitive = false) {
         if (!text.trim() || text.length > 256 * 1024 || text.trimStart().startsWith('/'))
             throw new Error('Enter a plain instruction of at most 256 Ki characters');
         const created = this.records().reduce((latest, record) => Math.max(latest, record.created_at + 1), Date.now());
@@ -51,6 +51,7 @@ export class Outbox {
             expected_revision: revision,
             text,
             ...(continues ? { continues_attempt_id: continues } : {}),
+            ...(confirmSensitive ? { confirm_sensitive: true } : {}),
         };
         this.save(record);
         return record;
@@ -174,6 +175,7 @@ export class Outbox {
                             'approval_mismatch',
                             'binding_changed',
                             'attempt_settled',
+                            'sensitive_attachment',
                         ].includes(error.code) ||
                             (record.command && error.code === 'not_found') ||
                             (['task', 'job'].includes(record.command?.kind ?? '') &&

package/dist/src/autonomy.js

@@ -1,5 +1,20 @@
 import { realpathSync } from 'node:fs';
 import { canonical, digest, object, ServiceError } from './protocol.js';
+const MODES = [
+    'inspect',
+    'review',
+    'scoped-edit',
+    'accept-edits',
+    'auto',
+];
+/** Modes in which the service performs no local mutation, however it was approved. */
+const READ_ONLY_MODES = ['inspect'];
+/** Shift+Tab: review → accept edits → auto → review. Full access and YOLO are never in the cycle. */
+const CYCLE = ['review', 'accept-edits', 'auto'];
+export function nextMode(mode) {
+    const at = CYCLE.indexOf(mode);
+    return at < 0 ? 'review' : CYCLE[(at + 1) % CYCLE.length];
+}
 export function permissionPolicy(store, session) {
     const root = store.session(session).cwd;
     const row = store.db
@@ -17,9 +32,14 @@ export function permissionPolicy(store, session) {
         if (!Number.isSafeInteger(saved.revision) ||
             Number(saved.revision) < 1 ||
             saved.root !== root ||
-            Object.keys(saved).some((key) => !['revision', 'root', 'mode', 'paths'].includes(key)))
+            Object.keys(saved).some((key) => !['revision', 'root', 'mode', 'paths', 'access'].includes(key)))
             throw new Error('Invalid saved policy');
-        const policy = validatePermissions({ mode: saved.mode, paths: saved.paths });
+        const policy = validatePermissions({
+            // Plan mode was removed (operator ruling 2026-10-31): a session saved in it reads as review.
+            mode: saved.mode === 'plan' ? 'review' : saved.mode,
+            paths: saved.paths,
+            ...(saved.access === undefined ? {} : { access: saved.access }),
+        });
         return { ...policy, revision: Number(saved.revision), root };
     }
     catch {
@@ -28,9 +48,10 @@ export function permissionPolicy(store, session) {
 }
 export function validatePermissions(value) {
     const input = object(value);
-    if (Object.keys(input).some((k) => !['mode', 'paths'].includes(k)) ||
-        !['inspect', 'review', 'scoped-edit'].includes(String(input.mode)))
-        throw new ServiceError('invalid_permissions', 'Choose inspect, review or scoped-edit; unknown policy fields are rejected');
+    if (Object.keys(input).some((k) => !['mode', 'paths', 'access'].includes(k)) ||
+        !MODES.includes(String(input.mode)) ||
+        (input.access !== undefined && input.access !== 'full' && input.access !== 'yolo'))
+        throw new ServiceError('invalid_permissions', 'Choose inspect, review, scoped-edit, accept-edits or auto, and access "full", "yolo" or none; unknown policy fields are rejected');
     const paths = input.paths ?? [];
     if (!Array.isArray(paths) ||
         paths.length > 32 ||
@@ -48,16 +69,31 @@ export function validatePermissions(value) {
         throw new ServiceError('invalid_permissions', 'Use up to 32 distinct project-relative files or directories ending in /; no wildcards, traversal or private paths');
     if ((input.mode === 'scoped-edit') !== paths.length > 0)
         throw new ServiceError('invalid_permissions', 'Only scoped-edit takes paths, and requires at least one');
-    return { mode: input.mode, paths: [...paths].sort() };
+    return {
+        mode: input.mode,
+        paths: [...paths].sort(),
+        ...(input.access === 'full' || input.access === 'yolo'
+            ? { access: input.access }
+            : {}),
+    };
 }
-export function configurePermissions(store, session, request, expected, value, actor) {
+export function configurePermissions(store, session, request, expected, value, actor, 
+/** The operator's settings: may an interactive session choose full access or YOLO, and is this a
+ * desk session (YOLO is never for host-managed, board or child work)? */
+opts = {}) {
     const policy = validatePermissions(value);
+    if (policy.access === 'full' && opts.allowFullAccess === false)
+        throw new ServiceError('full_access_denied', 'The operator does not allow full access on this host; commands stay in the OS sandbox');
+    if (policy.access === 'yolo' && (opts.allowYolo === false || opts.deskSession !== true))
+        throw new ServiceError('yolo_denied', opts.deskSession !== true
+            ? 'YOLO is only for your own desk sessions, never host-managed, board or child work'
+            : 'The operator does not allow YOLO on this host; commands keep their approvals');
     return store.request('local-operator', request, { kind: 'configure-permissions', session, expected, policy }, () => {
         store.authorizeControl(session, actor);
         store.execution.assert(session);
         if (!store.localWorkspace(session))
             throw new ServiceError('permissions_unavailable', 'This policy applies only to local workspace sessions, not managed stations or child workers');
-        if (policy.mode !== 'inspect' && !store.localCoding(session))
+        if (!READ_ONLY_MODES.includes(policy.mode) && !store.localCoding(session))
             throw new ServiceError('local_denied', 'Create a coding session first; policy cannot grant missing coding capability');
         const current = permissionPolicy(store, session);
         if (current.revision !== expected)
@@ -80,7 +116,7 @@ export function matchesEditScope(policy, paths) {
 }
 export function assertPermissionBinding(store, session, operation, root) {
     const policy = permissionPolicy(store, session);
-    if (policy.root !== root || policy.mode === 'inspect')
+    if (policy.root !== root || READ_ONLY_MODES.includes(policy.mode))
         throw new ServiceError('permission_denied', 'Current policy does not permit local mutations');
     const binding = store.db
         .prepare("SELECT payload FROM events WHERE session_id=? AND kind='permission.auto-approved' AND json_extract(payload,'$.operation_id')=? ORDER BY seq DESC LIMIT 1")
@@ -88,4 +124,39 @@ export function assertPermissionBinding(store, session, operation, root) {
     if (binding && JSON.parse(binding.payload).policy_digest !== digest(policy))
         throw new ServiceError('permission_changed', 'Auto-approval belongs to an older policy; prepare and review a fresh operation');
 }
+/** A project-relative path the session's modes may edit without review: not private or hidden. */
+function ordinaryProjectPath(path) {
+    return (path.length > 0 &&
+        !path.startsWith('/') &&
+        path
+            .split('/')
+            .every((part) => part !== '' &&
+            part !== '..' &&
+            !part.startsWith('.') &&
+            !['credentials', 'secrets', 'node_modules', 'vendor'].includes(part)));
+}
+/** Whether this policy approves these edits by itself: scoped edits, accept-edits, auto and full
+ * access approve ordinary project edits; YOLO approves every edit. */
+export function autoApprovesEdits(policy, paths) {
+    if (policy.access === 'yolo')
+        return paths.length > 0;
+    if (policy.mode === 'scoped-edit' && !policy.access)
+        return matchesEditScope(policy, paths);
+    return ((policy.mode === 'accept-edits' || policy.mode === 'auto' || policy.access === 'full') &&
+        paths.length > 0 &&
+        paths.every(ordinaryProjectPath));
+}
+/** Whether this policy approves a command by itself: auto inside the OS sandbox; full access unless
+ * the danger check calls the command dangerous; YOLO always. */
+export function autoApprovesCommands(policy, sandboxed, dangerous, 
+/** Pushes or opens a pull request: asks in every mode but YOLO (operator ruling 2026-10-31). */
+publishes = false) {
+    if (policy.access === 'yolo')
+        return true;
+    if (publishes)
+        return false;
+    if (policy.access === 'full')
+        return !dangerous;
+    return policy.mode === 'auto' && sandboxed;
+}
 export const permissionDigest = (policy) => digest(JSON.parse(canonical(policy)));

package/dist/src/cli-help.js

@@ -53,12 +53,22 @@ salaam agents revoke GRANT_ID --session SESSION_ID
 Profiles are data in .salaam/agents/*.md with JSON front matter and a prompt body.
 Inspect the effective tools and digest before admission. Project definitions cannot
 grant themselves authority. Mutations accept --request-id and --takeover.`,
+    code: `salaam code [--continue | --new | --resume] [--cwd DIR] [--takeover]
+salaam here   (the same)
+salaam -c     (short for salaam code --continue)
+
+Work in this folder with one command: start the service if it is not running, then continue
+the folder's latest session (the default), start a new local coding session (--new), or pick
+any session from a list (--resume), this folder's sessions first. No session id needed.
+SALAAM_TERMINAL_STATUS=off stops the window-title and Herdr status reports.`,
     tui: `salaam tui [--session SESSION_ID] [--observe|--takeover] [--theme night|paper]
            [--cwd DIR] [--coding-root PRIVATE_DIR] [--coding-socket DOCKER_SOCKET]
 
 Bare sal opens the same Salaam terminal interface in a TTY.
-Ctrl+K actions · Ctrl+P sessions · Ctrl+N new · Ctrl+O approvals
-Ctrl+G changes · Ctrl+T commands · Ctrl+E external editor · Ctrl+C detach.
+Ctrl+K (empty composer) or F2 actions · Ctrl+P sessions · Ctrl+N new · Ctrl+O approvals
+Alt+G changes · Ctrl+T commands · Ctrl+G external editor · Ctrl+R history search
+F5 refresh · !command shell · Ctrl+C stops/clears, twice to detach.
+? on an empty composer (or F1) shows the keys for where you are.
 Work continues in the service when the terminal closes.`,
     remote: `salaam remote SSH_HOST [--remote-bin ABSOLUTE_PATH] [--state REMOTE_DIR]
               [--session SESSION_ID] [--observe|--takeover] [--theme night|paper]
@@ -88,9 +98,11 @@ Run the M9.1 boundary proof on a pre-provisioned local Linux Docker engine.
 Only disposable fixtures are mounted. The pinned image must already be present.
 No coding tools are enabled. A failed/unavailable backend exits nonzero.
 Cleanup reconciles the saved proof run without replaying commands.`,
-    acp: `salaam acp [--state DIR] [--coding]
+    acp: `salaam acp [--state DIR] [--local | --coding]
 
 Run the ACP v1 stdio client adapter against an already running Salaam service.
+--local creates your desk session in the editor's project folder, the same as
+salaam in a terminal there: modes, approvals with diffs, rules and /rewind.
 --coding creates owned coding sessions; the service must have --coding-root.
 Loading an existing session preserves its original tool authority.`,
     artifacts: `salaam artifacts put SESSION_ID --text TEXT [--request-id ID] [--takeover]
@@ -225,6 +237,8 @@ Status prints metadata only. Existing Anthropic keys remain compatible.`,
                      [--a2a-listen-config OWNER_ONLY_FILE]
                      [--agentpod-config OWNER_ONLY_FILE] [--mcp-config FILE]
                      [--tools-user USER]
+                     [--local-sandbox read-only|workspace-write|full-access]
+                     [--local-sandbox-read PATH,…|toolchain] [--unsandboxed-commands allow]
 salaam service status
 salaam service stop
 
@@ -232,6 +246,18 @@ salaam service stop
 USER through sudo -n -u USER on Linux. Without it, tools share the provider
 credential's OS user and start prints a warning.
 
+Local commands (session create --local-coding) run under the host OS sandbox:
+bubblewrap on Linux, Seatbelt on macOS. --local-sandbox (or SALAAM_LOCAL_SANDBOX)
+picks the level: workspace-write (default) writes only inside the workspace,
+read-only writes nothing, full-access runs commands unsandboxed with network. A
+sandboxed command has no network and cannot read outside the workspace and the
+system; --local-sandbox-read (or SALAAM_LOCAL_SANDBOX_READ) lists read-only paths
+it may also read, comma-separated, and "toolchain" adds this host's node prefix,
+~/.npm, ~/.nvm, ~/.cargo, ~/.rustup, ~/go and ~/.gitconfig where present. Home
+itself and credential directories (~/.ssh, ~/.aws, keychains …) are refused. On
+macOS commands get the real git from the active developer dir. A host with no
+usable sandbox refuses commands unless --unsandboxed-commands allow.
+
 Without --agentpod-config, start binds to ~/.config/salaam/agentpod-pins.json
 ($XDG_CONFIG_HOME/salaam) when that file exists.
 
@@ -242,7 +268,8 @@ An AgentPod daemon requires node-bound admissions and a fresh authority lease.
 Keep its private state outside the pinned workspace. Coding, external runtimes,
 effect connectors and managed MCP are unavailable in this profile.`,
     session: `salaam session create [--cwd DIR] [--request-id ID] [--coding | --local | --local-coding]
-  --local-coding allows reviewed edits and native commands (no OS sandbox)
+  --local-coding allows reviewed edits and native commands, each under the host OS sandbox
+                 (see salaam help service for levels and read paths)
   --local allows bounded local file inspection; optionally select --provider ID --model ID
 salaam session list
 salaam session inspect SESSION_ID
@@ -295,6 +322,8 @@ const globalOptions = `Global options:
   -h, --help     Show help without starting a service or model request.
   -V, --version  Show the installed version.`;
 export function cliHelp(group) {
+    if (group === 'here')
+        group = 'code';
     if (group)
         return commands[group] ? `${commands[group]}\n\n${globalOptions}` : undefined;
     return `Salaam — persistent coding sessions
@@ -303,6 +332,7 @@ Usage: salaam <command> [options]
        sal <command> [options]
 
 Commands:
+  code          Work in this folder: continue its session or start one (also: here, -c)
   tui           Open the Salaam terminal interface (also bare sal)
   remote        Open the same session over SSH
   providers     List pinned Pi providers and capabilities

package/dist/src/cli.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { loadDangerClassifierOptions } from './danger-classifier.js';
+import { loadWebSearchConfig } from './web-search.js';
 import { SANDBOX_LEVELS } from './command-sandbox.js';
 import { acp } from './acp.js';
 import { homedir } from 'node:os';
@@ -33,6 +35,10 @@ async function main() {
         console.log('salaam ' + VERSION);
         return;
     }
+    if (args[0] === '-c' || args[0] === '--continue') {
+        const { continueArgs } = await import('./session-pick.js');
+        args.splice(0, args.length, ...continueArgs(args));
+    }
     if (args[0] === 'mcp') {
         // Parsed before global help: a declared command's own flags follow "--".
         const rest = args.slice(1);
@@ -403,7 +409,7 @@ async function main() {
         return;
     }
     if (group === 'host') {
-        const { planHost, readHost, hostUnit, runHost, hostReceipt, hostToolsUser, hostApprovalTtlMs, hostAllowsUnsandboxed, hostCommandNetwork, } = await import('./host.js');
+        const { planHost, readHost, hostUnit, runHost, hostReceipt, hostToolsUser, hostApprovalTtlMs, hostAllowsUnsandboxed, hostAllowsFullAccessSessions, hostAllowsYoloSessions, hostDangerClassifier, hostCommandNetwork, hostReadPaths, } = await import('./host.js');
         if (verb?.startsWith('config-')) {
             const file = option('--manifest');
             if (!file)
@@ -527,7 +533,18 @@ async function main() {
                 providerRoute: m.provider,
                 approvalTtlMs: hostApprovalTtlMs(m),
                 ...(hostAllowsUnsandboxed(m) ? { unsandboxedCommands: 'allow' } : {}),
+                // A host session may choose full access only when the reviewed manifest says so.
+                allowFullAccessSessions: hostAllowsFullAccessSessions(m),
+                allowYoloSessions: hostAllowsYoloSessions(m),
+                // The command reviewer only as the reviewed manifest names it (forbidden when absent).
+                ...(hostDangerClassifier(m).config
+                    ? { dangerClassifierConfig: hostDangerClassifier(m).config }
+                    : {}),
+                ...(hostDangerClassifier(m).pin
+                    ? { dangerClassifierPin: hostDangerClassifier(m).pin }
+                    : {}),
                 ...(hostCommandNetwork(m) ? { commandNetwork: hostCommandNetwork(m) } : {}),
+                ...(hostReadPaths(m).length ? { localSandboxReadPaths: hostReadPaths(m) } : {}),
             });
             if (process.connected)
                 process.once('disconnect', () => void service.close());
@@ -556,6 +573,20 @@ async function main() {
         });
         return;
     }
+    if (group === 'code' || group === 'here') {
+        const { parseCodeStart } = await import('./session-pick.js');
+        const start = parseCodeStart(args.slice(1));
+        const { tui } = await import('./tui.js');
+        await tui({
+            state,
+            start,
+            cwd: option('--cwd'),
+            takeover: args.includes('--takeover'),
+            codingRoot: option('--coding-root'),
+            codingSocket: option('--coding-socket'),
+        });
+        return;
+    }
     if (!group ||
         group === 'tui' ||
         [
@@ -689,7 +720,7 @@ async function main() {
         return;
     }
     if (group === 'acp') {
-        await acp(state, { coding: args.includes('--coding') });
+        await acp(state, { coding: args.includes('--coding'), local: args.includes('--local') });
         return;
     }
     if (group === 'providers' && verb === 'list') {
@@ -1308,7 +1339,18 @@ async function main() {
         }
         const effectSocket = option('--effect-socket');
         const opaque = args.includes('--effect-opaque');
-        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), agentpodConfig = option('--agentpod-config') ?? defaultAgentPodConfig(process.env, existsSync), a2aListenConfig = option('--a2a-listen-config'), mcpConfig = resolve(option('--mcp-config') ?? operatorMcpPath(process.env)), toolsUser = option('--tools-user') ?? (process.env.SALAAM_TOOLS_USER || undefined), localSandbox = option('--local-sandbox') ?? (process.env.SALAAM_LOCAL_SANDBOX || undefined), unsandboxedCommands = option('--unsandboxed-commands') ?? (process.env.SALAAM_UNSANDBOXED_COMMANDS || undefined);
+        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), agentpodConfig = option('--agentpod-config') ?? defaultAgentPodConfig(process.env, existsSync), a2aListenConfig = option('--a2a-listen-config'), mcpConfig = resolve(option('--mcp-config') ?? operatorMcpPath(process.env)), toolsUser = option('--tools-user') ?? (process.env.SALAAM_TOOLS_USER || undefined), localSandbox = option('--local-sandbox') ?? (process.env.SALAAM_LOCAL_SANDBOX || undefined), unsandboxedCommands = option('--unsandboxed-commands') ?? (process.env.SALAAM_UNSANDBOXED_COMMANDS || undefined), localSandboxRead = (option('--local-sandbox-read') ??
+            (process.env.SALAAM_LOCAL_SANDBOX_READ || ''))
+            .split(',')
+            .map((p) => p.trim())
+            .filter(Boolean), webSearchConfig = option('--web-search-config') ?? (process.env.SALAAM_WEB_SEARCH_CONFIG || undefined), dangerClassifierConfig = option('--danger-classifier-config') ??
+            (process.env.SALAAM_DANGER_CLASSIFIER_CONFIG || undefined);
+        // Fail early on a bad command-reviewer config; its key is read from the named variable, never printed.
+        if (dangerClassifierConfig)
+            loadDangerClassifierOptions(JSON.parse(readFileSync(resolve(dangerClassifierConfig), 'utf8')));
+        // Fail early on a bad web search config; its keys are read, never printed.
+        if (webSearchConfig)
+            loadWebSearchConfig(resolve(webSearchConfig));
         if (localSandbox !== undefined && !SANDBOX_LEVELS.includes(localSandbox))
             throw Error('--local-sandbox is read-only, workspace-write or full-access');
         if (unsandboxedCommands !== undefined && unsandboxedCommands !== 'allow')
@@ -1327,6 +1369,11 @@ async function main() {
                 toolsUser,
                 ...(localSandbox ? { localSandbox: localSandbox } : {}),
                 ...(unsandboxedCommands ? { unsandboxedCommands: 'allow' } : {}),
+                ...(localSandboxRead.length ? { localSandboxReadPaths: localSandboxRead } : {}),
+                ...(webSearchConfig ? { webSearchConfig: resolve(webSearchConfig) } : {}),
+                ...(dangerClassifierConfig
+                    ? { dangerClassifierConfig: resolve(dangerClassifierConfig) }
+                    : {}),
                 effectConnector: effectSocket
                     ? new SocketEffectConnector(resolve(effectSocket), { opaque })
                     : undefined,
@@ -1399,6 +1446,11 @@ async function main() {
             ...(toolsUser ? ['--tools-user', toolsUser] : []),
             ...(localSandbox ? ['--local-sandbox', localSandbox] : []),
             ...(unsandboxedCommands ? ['--unsandboxed-commands', 'allow'] : []),
+            ...(localSandboxRead.length ? ['--local-sandbox-read', localSandboxRead.join(',')] : []),
+            ...(webSearchConfig ? ['--web-search-config', resolve(webSearchConfig)] : []),
+            ...(dangerClassifierConfig
+                ? ['--danger-classifier-config', resolve(dangerClassifierConfig)]
+                : []),
         ], { detached: true, stdio: ['ignore', fd, fd] });
         closeSync(fd);
         child.unref();