@superjackfruitlabs/salaam 0.0.4 → 0.0.5

package/src/command-sandbox.ts

@@ -1,7 +1,8 @@
 import { COMMAND_NETWORK_PORT, inSandboxRelaySource } from './command-network.js';
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { isAbsolute } from 'node:path';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, sep } from 'node:path';
 import { ServiceError } from './protocol.js';
 
 /**
@@ -25,9 +26,87 @@ export interface Bwrap {
 }
 export interface Seatbelt {
   path: string;
+  /** The active Apple developer dir (`xcode-select -p`) when it holds a real git. /usr/bin/git is
+   * a shim that needs Xcode's licence preferences, which the profile does not open; commands get
+   * the real tools first on PATH instead (step 0, 2026-10-31). */
+  developerDir?: string;
 }
 export type SandboxKind = 'bwrap' | 'seatbelt' | 'none';
 
+/**
+ * Phase 1 (2026-10-31): read-only paths outside the workspace an operator lets local commands use
+ * (a toolchain, a package cache, `~/.gitconfig`). Never the root, home itself or an ancestor of
+ * it, and never a credential directory or file, or an ancestor of one. `toolchain` expands to the
+ * ones that exist here: the prefix of the node running Salaam, and home's package caches and
+ * toolchains. Writes stay inside the workspace whatever is listed.
+ */
+export const READ_PATHS_TOOLCHAIN = 'toolchain';
+const CREDENTIALS = [
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.config/gcloud',
+  '.config/gh',
+  '.docker',
+  '.kube',
+  '.netrc',
+  '.npmrc',
+  '.pypirc',
+  '.git-credentials',
+  '.claude',
+  '.codex',
+  '.config/salaam',
+  'Library/Keychains',
+];
+const TOOLCHAIN = ['.npm', '.nvm', '.cargo', '.rustup', 'go', '.gitconfig', '.config/git'];
+function within(path: string, base: string): boolean {
+  return path === base || path.startsWith(base.endsWith(sep) ? base : base + sep);
+}
+export function resolveReadPaths(entries: readonly string[], home = homedir()): string[] {
+  const refuse = (path: string, why: string): never => {
+    throw new ServiceError('invalid_field', `local_sandbox_read_paths: ${path} ${why}`);
+  };
+  const out: string[] = [];
+  const add = (path: string) => {
+    if (!isAbsolute(path)) refuse(path, 'must be an absolute path');
+    if (/["\\\x00-\x1f\x7f]/.test(path)) refuse(path, 'has a character Seatbelt cannot quote');
+    const p = path.length > 1 ? path.replace(/\/+$/, '') : path;
+    if (p === '/') refuse(p, 'is the whole filesystem');
+    if (within(home, p)) refuse(p, 'would expose the whole home directory');
+    for (const c of CREDENTIALS) {
+      const secret = join(home, c);
+      if (within(p, secret) || within(secret, p)) refuse(p, `covers credentials (${c})`);
+    }
+    if (!out.includes(p)) out.push(p);
+  };
+  for (const entry of entries) {
+    if (typeof entry !== 'string') refuse(String(entry), 'must be a string');
+    if (entry !== READ_PATHS_TOOLCHAIN) {
+      add(entry);
+      continue;
+    }
+    // The node running Salaam, so `node`/`npx`/`npm` resolve inside the sandbox.
+    const nodePrefix = dirname(dirname(realpathSync(process.execPath)));
+    if (!within(home, nodePrefix)) add(nodePrefix);
+    for (const t of TOOLCHAIN) if (existsSync(join(home, t))) add(join(home, t));
+  }
+  return out;
+}
+
+/** The active developer dir when it has a real git, else undefined. */
+function developerDir(): string | undefined {
+  try {
+    const dir = execFileSync('/usr/bin/xcode-select', ['-p'], {
+      timeout: 5000,
+      encoding: 'utf8',
+    }).trim();
+    return isAbsolute(dir) && existsSync(join(dir, 'usr/bin/git')) ? dir : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /** The pinned bubblewrap: its absolute path and the version it reports, or null when unusable. */
 export function findBwrap(candidates = ['/usr/bin/bwrap', '/bin/bwrap']): Bwrap | null {
   for (const path of candidates) {
@@ -61,6 +140,8 @@ export function sandboxArgv(
     /** Broker network: the host relay's private directory and the node that runs the in-sandbox
      * relay. The network stays unshared; only the relay socket and node are bound in. */
     broker?: { dir: string; node: string };
+    /** Operator-allowed read-only paths outside the workspace (resolveReadPaths). */
+    readPaths?: readonly string[];
   },
 ): string[] {
   if (level === 'full-access') return argv;
@@ -100,6 +181,8 @@ export function sandboxArgv(
     '/dev',
     '--tmpfs',
     '/tmp',
+    // Operator-allowed toolchains, read-only, at their own paths (a symlink into one resolves).
+    ...(options.readPaths ?? []).flatMap((p) => ['--ro-bind-try', p, p]),
     level === 'read-only' ? '--ro-bind' : '--bind',
     root,
     root,
@@ -153,7 +236,8 @@ export function findSeatbelt(path = '/usr/bin/sandbox-exec'): Seatbelt | null {
       ],
       { timeout: 5000, stdio: 'ignore' },
     );
-    return { path };
+    const dev = developerDir();
+    return dev ? { path, developerDir: dev } : { path };
   } catch {
     return null;
   }
@@ -176,11 +260,27 @@ export function seatbeltProfile(
   level: 'read-only' | 'workspace-write',
   root: string,
   tmp: string,
-  /** brokerPort: the host relay's loopback port, the only place a broker-network command may connect. */
-  options: { network: boolean; brokerPort?: number },
+  /** brokerPort: the host relay's loopback port, the only place a broker-network command may connect.
+   * readPaths: operator-allowed read-only paths outside the workspace. developerDir: the active
+   * developer dir, when it lies outside the system paths below. */
+  options: {
+    network: boolean;
+    brokerPort?: number;
+    readPaths?: readonly string[];
+    developerDir?: string;
+    /** A command the person approved to listen (operator ruling 2026-11-01, option C). Seatbelt
+     * cannot limit this to loopback: "localhost" in its filters matches every local address. */
+    listen?: boolean;
+  },
 ): string {
   const w = sbplPath(root, 'workspace path'),
     t = sbplPath(tmp, 'tmp path');
+  const extra = [
+    ...(options.readPaths ?? []),
+    ...(options.developerDir ? [options.developerDir] : []),
+  ]
+    .map((p) => `(subpath ${sbplPath(p, 'read path')})`)
+    .join(' ');
   const system = [
     '/usr',
     '/bin',
@@ -208,12 +308,18 @@ export function seatbeltProfile(
     '(allow signal (target same-sandbox))',
     '(allow sysctl-read)',
     '(allow file-read-metadata)',
-    `(allow file-read* (literal "/") ${system} (subpath ${w}) (subpath ${t}))`,
+    `(allow file-read* (literal "/") ${system} (subpath ${w}) (subpath ${t})${extra ? ' ' + extra : ''})`,
     level === 'workspace-write'
       ? `(allow file-write* (subpath ${w}) (subpath ${t}) ${devices} (regex #"^/dev/fd/"))`
       : `(allow file-write* (subpath ${t}) ${devices} (regex #"^/dev/fd/"))`,
     `(allow file-ioctl ${devices} (regex #"^/dev/fd/"))`,
     ...(options.network ? ['(allow network*)'] : []),
+    ...(options.listen && level === 'workspace-write' && !options.network
+      ? [
+          '(allow network-bind (local ip "localhost:*"))',
+          '(allow network-inbound (local ip "localhost:*"))',
+        ]
+      : []),
     ...(options.brokerPort !== undefined && !options.network
       ? [`(allow network-outbound (remote tcp "localhost:${brokerPort(options.brokerPort)}"))`]
       : []),
@@ -226,7 +332,12 @@ export function seatbeltArgv(
   tmp: string,
   argv: string[],
   seatbelt: Seatbelt | null,
-  options: { network: boolean; brokerPort?: number },
+  options: {
+    network: boolean;
+    brokerPort?: number;
+    readPaths?: readonly string[];
+    listen?: boolean;
+  },
 ): string[] {
   if (level === 'full-access') return argv;
   if (!seatbelt)
@@ -234,12 +345,21 @@ export function seatbeltArgv(
       'sandbox_unavailable',
       'This host has no usable Seatbelt, so it cannot run a sandboxed command; an operator can choose full access explicitly',
     );
+  const dev = seatbelt.developerDir;
+  // git reads ~/.gitconfig and fails hard when it may not; without the operator allowing it, the
+  // command runs with no global git config rather than an error.
+  const gitConfig = join(homedir(), '.gitconfig');
+  const gitConfigAllowed = (options.readPaths ?? []).some((p) => within(gitConfig, p));
   return [
     seatbelt.path,
     '-p',
-    seatbeltProfile(level, root, tmp, options),
+    seatbeltProfile(level, root, tmp, { ...options, ...(dev ? { developerDir: dev } : {}) }),
     '/usr/bin/env',
     `TMPDIR=${tmp}/`,
+    ...(dev
+      ? [`PATH=${join(dev, 'usr/bin')}:${process.env.PATH ?? '/usr/bin:/bin:/usr/sbin:/sbin'}`]
+      : []),
+    ...(gitConfigAllowed ? [] : ['GIT_CONFIG_GLOBAL=/dev/null']),
     ...argv,
   ];
 }

package/src/custom-commands.ts

@@ -0,0 +1,175 @@
+import { lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, relative, sep } from 'node:path';
+import { SLASH_COMMANDS } from './tui-commands.js';
+
+/** A saved prompt the person types as `/name args` (Phase 4b). It only ever produces a prompt:
+ * it never runs a command, grants a tool or changes a mode or rule, so a repository's own commands
+ * are safe to load without trusting the repository. */
+export interface CustomCommand {
+  name: string;
+  scope: 'repo' | 'user';
+  path: string;
+  description: string;
+  argumentHint?: string;
+  /** Read for display; a command does not switch the session's model. */
+  model?: string;
+  body: string;
+}
+
+const MAX_FILE = 32 * 1024;
+const MAX_FILES = 200;
+const NAME = /^[a-z0-9][a-z0-9_-]*$/i;
+const builtIn = new Set(SLASH_COMMANDS.flatMap((c) => [c.name, ...c.aliases]));
+
+export function defaultUserCommandsDir(env = process.env): string {
+  return join(env.XDG_CONFIG_HOME || join(env.HOME || homedir(), '.config'), 'salaam', 'commands');
+}
+
+/** Repository commands live in `<repo>/.salaam/commands`, yours in `~/.config/salaam/commands`.
+ * A subdirectory becomes a namespace (`frontend/component.md` is `/frontend:component`), and your
+ * command wins over a repository's of the same name. Built-in commands always win. */
+export function loadCustomCommands(
+  repo: string,
+  userDir = defaultUserCommandsDir(),
+): { commands: CustomCommand[]; problems: string[] } {
+  const problems: string[] = [];
+  const found = new Map<string, CustomCommand>();
+  for (const [scope, dir] of [
+    ['repo', join(repo, '.salaam', 'commands')],
+    ['user', userDir],
+  ] as const) {
+    let root: string;
+    try {
+      root = realpathSync(dir);
+    } catch {
+      continue;
+    }
+    // A repository's command folder must itself stay inside the repository.
+    if (scope === 'repo' && !inside(realpathSync(repo), root)) {
+      problems.push(`${dir}: resolves outside the repository; ignored`);
+      continue;
+    }
+    for (const file of walk(root, root, problems)) {
+      const parts = relative(root, file).replace(/\.md$/, '').split(sep);
+      if (!parts.every((p) => NAME.test(p))) {
+        problems.push(`${file}: a name may use only letters, digits, - and _; ignored`);
+        continue;
+      }
+      const name = parts.join(':').toLowerCase();
+      if (builtIn.has(name)) {
+        problems.push(`${file}: /${name} is a built-in command; ignored`);
+        continue;
+      }
+      let text: string;
+      try {
+        const real = realpathSync(file);
+        if (!inside(root, real)) {
+          problems.push(`${file}: resolves outside its commands folder; ignored`);
+          continue;
+        }
+        if (lstatSync(real).size > MAX_FILE) {
+          problems.push(`${file}: larger than 32 KiB; ignored`);
+          continue;
+        }
+        text = readFileSync(real, 'utf8');
+      } catch (error) {
+        problems.push(`${file}: ${(error as Error).message}`);
+        continue;
+      }
+      const { fields, body } = frontmatter(text);
+      for (const key of ['allowed-tools', 'disallowed-tools', 'hooks', 'permission-mode'])
+        if (key in fields)
+          problems.push(`${file}: ${key} is ignored; a command only writes a prompt`);
+      found.set(name, {
+        name,
+        scope,
+        path: file,
+        description: fields.description || `Custom ${scope} command`,
+        ...(fields['argument-hint'] ? { argumentHint: fields['argument-hint'] } : {}),
+        ...(fields.model ? { model: fields.model } : {}),
+        body: body.trim(),
+      });
+    }
+  }
+  return { commands: [...found.values()].sort((a, b) => a.name.localeCompare(b.name)), problems };
+}
+
+function inside(root: string, path: string): boolean {
+  const r = relative(root, path);
+  return !r.startsWith('..') && !r.startsWith(sep);
+}
+
+function walk(root: string, dir: string, problems: string[], depth = 0): string[] {
+  const out: string[] = [];
+  if (depth > 3) return out;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (out.length >= MAX_FILES) break;
+    const path = join(dir, e.name);
+    if (e.isSymbolicLink()) {
+      let real: string;
+      try {
+        real = realpathSync(path);
+      } catch {
+        continue;
+      }
+      // Followed only to a file; whether it stays inside is checked when the file is read.
+      if (e.name.endsWith('.md') && lstatSync(real).isFile()) out.push(path);
+    } else if (e.isDirectory()) out.push(...walk(root, path, problems, depth + 1));
+    else if (e.isFile() && e.name.endsWith('.md')) out.push(path);
+  }
+  return out.slice(0, MAX_FILES);
+}
+
+function frontmatter(text: string): { fields: Record<string, string>; body: string } {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+  if (!m) return { fields: {}, body: text };
+  const fields: Record<string, string> = {};
+  for (const line of m[1]!.split(/\r?\n/)) {
+    const kv = /^([A-Za-z][\w-]*)\s*:\s*(.*)$/.exec(line);
+    if (kv) fields[kv[1]!.toLowerCase()] = kv[2]!.trim().replace(/^(["'])(.*)\1$/, '$2');
+  }
+  return { fields, body: text.slice(m[0].length) };
+}
+
+/** Shell-like splitting: whitespace separates, double or single quotes group. */
+export function splitArguments(args: string): string[] {
+  const out: string[] = [];
+  const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+  for (let m = re.exec(args); m; m = re.exec(args)) out.push(m[1] ?? m[2] ?? m[3]!);
+  return out;
+}
+
+/** Placeholders as in Claude Code: `$ARGUMENTS`, `$ARGUMENTS[N]` and `$N` (0-based); `\$` is a
+ * literal dollar. With no placeholder the arguments are appended, so they are never dropped. */
+export function expandCustomCommand(command: CustomCommand, args: string): string {
+  const list = splitArguments(args);
+  let used = false;
+  const body = command.body.replace(
+    /\\\$|\$ARGUMENTS\[(\d+)\]|\$ARGUMENTS|\$(\d+)/g,
+    (all: string, index?: string, short?: string) => {
+      if (all === '\\$') return '$';
+      used = true;
+      if (all === '$ARGUMENTS') return args.trim();
+      return list[Number(index ?? short)] ?? '';
+    },
+  );
+  return !used && args.trim() ? `${body}\n\nARGUMENTS: ${args.trim()}` : body;
+}
+
+/** A typed `/name args` line that names a custom command, or null. */
+export function matchCustomCommand(
+  text: string,
+  commands: readonly CustomCommand[],
+): { command: CustomCommand; args: string } | null {
+  const m = /^\/([a-z0-9][a-z0-9_:-]*)(?:[ \t]+([\s\S]*))?$/i.exec(text.trim());
+  if (!m) return null;
+  const command = commands.find((c) => c.name === m[1]!.toLowerCase());
+  return command ? { command, args: (m[2] ?? '').trim() } : null;
+}