@superjackfruitlabs/salaam 0.0.4 → 0.0.5

package/dist/src/git-helpers.js

@@ -0,0 +1,160 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// Phase 4a git helpers for desk sessions. /commit, /branch and /pr are instructions to the model:
+// every git command they lead to goes through the session's normal command approval and sandbox.
+// Operator ruling 2026-10-31: pushing and opening a pull request ask in every mode except YOLO.
+/** Why a command publishes to a remote, or null. Read from the raw text on purpose: a push hidden in
+ * a substitution, `sh -c` or a compound command still counts, and a false match only asks. */
+export function publishesToRemote(command) {
+    for (const part of command.split(/&&|\|\||[;|\n]|\$\(|`/)) {
+        const words = part.replace(/["']/g, ' ').trim().split(/\s+/);
+        const at = words.findIndex((w) => /(^|\/)(git|gh|tea)$/.test(w));
+        if (at < 0)
+            continue;
+        const tool = words[at].split('/').pop();
+        const rest = words.slice(at + 1).filter((w) => !w.startsWith('-'));
+        if (tool === 'git') {
+            // git's own options take a value: -C dir, -c key=value.
+            const args = words.slice(at + 1);
+            let i = 0;
+            while (i < args.length && args[i].startsWith('-'))
+                i += ['-C', '-c'].includes(args[i]) ? 2 : 1;
+            if (args[i] === 'push')
+                return 'pushes commits to a remote';
+        }
+        else if (/^(pr|pulls)$/.test(rest[0] ?? '') && rest[1] === 'create')
+            return 'opens a pull request on the forge';
+    }
+    return null;
+}
+/** The author and committer git would use here, from the person's own git config (repo, global and
+ * system), so a sandboxed command that cannot read ~/.gitconfig still commits as them. Empty when
+ * either the name or the email is missing: Salaam never invents an identity. */
+export function gitIdentityEnv(root, env = process.env) {
+    const read = (key) => {
+        try {
+            return execFileSync('git', ['config', '--get', key], {
+                cwd: root,
+                encoding: 'utf8',
+                timeout: 2000,
+                env: { ...env, GIT_TERMINAL_PROMPT: '0' },
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+        }
+        catch {
+            return '';
+        }
+    };
+    const name = read('user.name'), email = read('user.email');
+    if (!name || !email || /[\0\n]/.test(name + email))
+        return {};
+    return {
+        GIT_AUTHOR_NAME: name,
+        GIT_AUTHOR_EMAIL: email,
+        GIT_COMMITTER_NAME: name,
+        GIT_COMMITTER_EMAIL: email,
+    };
+}
+/** git check-ref-format --branch, plus nothing a shell would read specially. */
+export function validBranchName(name) {
+    return (/^[A-Za-z0-9._/-]+$/.test(name) &&
+        !/^[-./]|\/$|\.\.|\/\/|\/\.|\.lock(\/|$)|\.$/.test(name) &&
+        name !== '@');
+}
+export const GIT_PREFS_PATH = join(homedir(), '.config', 'salaam', 'git.json');
+/** Per-person commit trailers: {"trailers": ["Key: value"], "session_trailer": true}. */
+export function loadGitPrefs(path = GIT_PREFS_PATH) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return { trailers: [], sessionTrailer: false };
+    }
+    const trailers = Array.isArray(raw.trailers)
+        ? raw.trailers.filter((t) => typeof t === 'string' && /^[A-Za-z][A-Za-z0-9-]*: [^\n\r]+$/.test(t))
+        : [];
+    return { trailers, sessionTrailer: raw.session_trailer === true };
+}
+const RULES = 'Never use --amend, rebase, reset or force anything, never pass --no-verify, and never change git config or hooks.';
+export function commitInstruction(o) {
+    const trailers = [...o.trailers, ...(o.sessionTrailer ? [`Salaam-Session: ${o.session}`] : [])];
+    return [
+        'Commit the current work.',
+        'Run git status and git diff (staged and unstaged) to see what changed.',
+        'Stage only the files that belong to this change, by path with git add; leave unrelated or generated files alone and say which you left.',
+        'Write a commit message in this repository’s style (read git log --oneline -10): a short subject, a blank line, then a body saying why.',
+        trailers.length
+            ? `End the message with exactly these trailer lines:\n${trailers.join('\n')}`
+            : 'Add no trailer lines.',
+        'Commit with git commit -F and a message file in the system temp directory, so the approval shows the exact message. The author comes from the person’s own git config; do not set one.',
+        RULES,
+    ].join('\n');
+}
+export function branchInstruction(name) {
+    if (!validBranchName(name))
+        throw new Error(`"${name}" is not a valid git branch name.`);
+    return [
+        `Switch to branch ${name}: run git switch ${name} if it exists (git branch --list ${name}), otherwise git switch -c ${name}.`,
+        'If there are uncommitted changes that would be overwritten, stop and tell me instead of forcing.',
+        RULES,
+    ].join('\n');
+}
+export function prInstruction(o) {
+    if (!o.tool)
+        throw new Error('/pr needs gh or tea on this machine to open a pull request.');
+    const create = o.tool === 'gh'
+        ? `gh pr create --base ${o.base} --head ${o.branch} --title <title> --body-file <file>`
+        : `tea pr create --base ${o.base} --head ${o.branch} --title <title> --description <body>`;
+    return [
+        `Open a pull request for ${o.branch} into ${o.base}.`,
+        `Read git log ${o.base}..HEAD and git diff ${o.base}...HEAD, then draft a title and a body: what changed, why, and how it was tested.`,
+        `Push the branch with git push -u origin ${o.branch}; never use --force or any push option that rewrites the remote.`,
+        `Then open it with ${create}, writing the body to a file in the system temp directory.`,
+        'Pushing and opening the pull request each ask for approval; show the drafted title and body before asking.',
+        RULES,
+    ].join('\n');
+}
+function gitOut(root, args) {
+    try {
+        return execFileSync('git', args, {
+            cwd: root,
+            encoding: 'utf8',
+            timeout: 2000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/** The checked-out branch, or null when detached. */
+export const currentBranch = (root) => gitOut(root, ['branch', '--show-current']) || null;
+/** The remote's default branch (origin/HEAD), else main. */
+export function defaultBase(root) {
+    const ref = gitOut(root, ['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD']);
+    return ref?.replace(/^origin\//, '') || 'main';
+}
+/** Which forge CLI opens pull requests here: gh for GitHub remotes, tea otherwise, if installed. */
+export function forgeTool(root) {
+    const run = (cmd, args) => {
+        try {
+            return execFileSync(cmd, args, {
+                cwd: root,
+                encoding: 'utf8',
+                timeout: 2000,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+        }
+        catch {
+            return null;
+        }
+    };
+    const url = run('git', ['remote', 'get-url', 'origin']) ?? '';
+    const has = (cmd) => run(cmd, ['--version']) !== null;
+    if (/github\.com[:/]/.test(url))
+        return has('gh') ? 'gh' : null;
+    return has('tea') ? 'tea' : has('gh') ? 'gh' : null;
+}

package/dist/src/hooks.js

@@ -0,0 +1,351 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, relative, sep } from 'node:path';
+import { ServiceError } from './protocol.js';
+/** Hooks for a person's own desk sessions (Phase 4b, operator 2026-10-31), in the Claude Code
+ * format: `{"hooks": {"PreToolUse": [{"matcher": "Bash", "hooks": [{"type": "command",
+ * "command": "...", "timeout": 30}]}]}}`. Yours live in `~/.config/salaam/hooks.json`; a
+ * repository's `.salaam/hooks.json` is ignored until you trust that exact file, and any change to it
+ * needs trusting again. A hook can block a tool call or a prompt; it can never approve anything. */
+export const HOOK_EVENTS = [
+    'PreToolUse',
+    'PostToolUse',
+    'UserPromptSubmit',
+    'Stop',
+    'Notification',
+];
+const MAX_FILE = 64 * 1024;
+const MAX_COMMAND = 4096;
+const MAX_HANDLERS = 16;
+const MAX_CONTEXT = 8192;
+const DEFAULT_TIMEOUT = 60;
+const MAX_TIMEOUT = 600;
+const BLOCKING = new Set(['PreToolUse', 'UserPromptSubmit']);
+const TOOL_EVENTS = new Set(['PreToolUse', 'PostToolUse']);
+export function defaultUserHooksFile(env = process.env) {
+    return (env.SALAAM_HOOKS_FILE ||
+        join(env.XDG_CONFIG_HOME || join(env.HOME || homedir(), '.config'), 'salaam', 'hooks.json'));
+}
+const sha = (data) => 'sha256:' + createHash('sha256').update(data).digest('hex');
+export function parseHooks(text) {
+    const problems = [];
+    const config = {};
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (error) {
+        return { config, problems: ['not valid JSON: ' + error.message] };
+    }
+    const events = raw?.hooks;
+    if (!events || typeof events !== 'object' || Array.isArray(events))
+        return { config, problems: ['expected {"hooks": {...}}'] };
+    let handlers = 0;
+    for (const [event, groups] of Object.entries(events)) {
+        if (!HOOK_EVENTS.includes(event)) {
+            problems.push(`${event}: not supported; Salaam runs ${HOOK_EVENTS.join(', ')}`);
+            continue;
+        }
+        if (!Array.isArray(groups)) {
+            problems.push(`${event}: expected a list of matcher groups`);
+            continue;
+        }
+        for (const group of groups) {
+            const g = group;
+            if (g?.matcher !== undefined && typeof g.matcher !== 'string') {
+                problems.push(`${event}: matcher must be a string`);
+                continue;
+            }
+            if (typeof g.matcher === 'string' && !validMatcher(g.matcher)) {
+                problems.push(`${event}: matcher ${JSON.stringify(g.matcher)} is not a valid pattern`);
+                continue;
+            }
+            if (!Array.isArray(g.hooks)) {
+                problems.push(`${event}: a group needs a hooks list`);
+                continue;
+            }
+            const kept = [];
+            for (const h of g.hooks) {
+                const hook = h;
+                if (hook?.type !== 'command') {
+                    problems.push(`${event}: hook type ${JSON.stringify(hook?.type)} is not supported (command only)`);
+                    continue;
+                }
+                if (typeof hook.command !== 'string' || !hook.command.trim()) {
+                    problems.push(`${event}: a command hook needs a command`);
+                    continue;
+                }
+                if (Buffer.byteLength(hook.command) > MAX_COMMAND) {
+                    problems.push(`${event}: a hook command is longer than 4 KiB`);
+                    continue;
+                }
+                if (hook.timeout !== undefined &&
+                    (typeof hook.timeout !== 'number' || !(hook.timeout > 0) || hook.timeout > MAX_TIMEOUT)) {
+                    problems.push(`${event}: timeout must be 1–${MAX_TIMEOUT} seconds`);
+                    continue;
+                }
+                if (++handlers > MAX_HANDLERS * HOOK_EVENTS.length) {
+                    problems.push('too many hooks; the rest are ignored');
+                    break;
+                }
+                kept.push({
+                    command: hook.command,
+                    ...(hook.timeout !== undefined ? { timeout: hook.timeout } : {}),
+                });
+            }
+            if (kept.length)
+                (config[event] ??= []).push({
+                    ...(g.matcher !== undefined ? { matcher: g.matcher } : {}),
+                    hooks: kept.slice(0, MAX_HANDLERS),
+                });
+        }
+    }
+    return { config, problems };
+}
+function validMatcher(m) {
+    if (m === '' || m === '*' || /^[A-Za-z0-9_|,-]+$/.test(m))
+        return true;
+    try {
+        new RegExp(m);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Claude Code's rule: empty or `*` matches everything, plain names (letters, digits, `_`, `-`,
+ * separated by `|` or `,`) are exact, anything else is a regular expression. `names` holds the
+ * Salaam tool name and its Claude Code alias (`Bash`, `Edit`, …). */
+export function matchesTool(matcher, names) {
+    if (matcher === undefined || matcher === '' || matcher === '*')
+        return true;
+    if (/^[A-Za-z0-9_|,-]+$/.test(matcher)) {
+        const wanted = matcher.split(/[|,]/);
+        return names.some((n) => wanted.includes(n));
+    }
+    const re = new RegExp('^(?:' + matcher + ')$');
+    return names.some((n) => re.test(n));
+}
+export class Hooks {
+    store;
+    run;
+    userFile;
+    constructor(store, run, userFile = defaultUserHooksFile()) {
+        this.store = store;
+        this.run = run;
+        this.userFile = userFile;
+        store.db.exec('CREATE TABLE IF NOT EXISTS hook_trust(root TEXT NOT NULL,path TEXT NOT NULL,digest TEXT NOT NULL,trusted_at TEXT NOT NULL,PRIMARY KEY(root,path))');
+    }
+    repoFile(session) {
+        return join(this.store.session(session).cwd, '.salaam', 'hooks.json');
+    }
+    /** Your hooks and this workspace's, read afresh, each with its trust state. */
+    sources(session) {
+        const root = this.store.session(session).cwd;
+        const out = [];
+        for (const [scope, path] of [
+            ['user', this.userFile],
+            ['repo', this.repoFile(session)],
+        ]) {
+            if (!existsSync(path) && !isLink(path))
+                continue;
+            const problems = [];
+            let digest = null;
+            let config = {};
+            try {
+                const real = realpathSync(path);
+                if (scope === 'repo' && !inside(realpathSync(root), real))
+                    throw new Error('resolves outside the repository; ignored');
+                if (lstatSync(real).size > MAX_FILE)
+                    throw new Error('larger than 64 KiB; ignored');
+                const bytes = readFileSync(real);
+                digest = sha(bytes);
+                const parsed = parseHooks(bytes.toString('utf8'));
+                config = parsed.config;
+                problems.push(...parsed.problems);
+            }
+            catch (error) {
+                problems.push(error.message);
+                digest = null;
+            }
+            const trusted = scope === 'user'
+                ? digest !== null
+                : digest !== null && this.trustedDigest(root, path) === digest;
+            out.push({ scope, path, digest, trusted, config, problems });
+        }
+        return out;
+    }
+    trustedDigest(root, path) {
+        const row = this.store.db
+            .prepare('SELECT digest FROM hook_trust WHERE root=? AND path=?')
+            .get(root, path);
+        return row?.digest;
+    }
+    /** Trust this workspace's hooks file as reviewed: `digest` must be the content shown to you. */
+    trust(session, digest) {
+        const source = this.sources(session).find((s) => s.scope === 'repo');
+        if (!source || !source.digest)
+            throw new ServiceError('hooks_missing', 'This workspace has no readable .salaam/hooks.json', 404);
+        if (source.digest !== digest)
+            throw new ServiceError('hooks_changed', 'The hooks file changed since you reviewed it; review it again', 409);
+        const root = this.store.session(session).cwd;
+        this.store.transaction(() => {
+            this.store.db
+                .prepare('INSERT INTO hook_trust VALUES (?,?,?,?) ON CONFLICT(root,path) DO UPDATE SET digest=excluded.digest,trusted_at=excluded.trusted_at')
+                .run(root, source.path, digest, new Date().toISOString());
+            this.store.event(session, 'hooks.trusted', { path: source.path, digest });
+        });
+        return { ...source, trusted: true };
+    }
+    revoke(session) {
+        const root = this.store.session(session).cwd;
+        const path = this.repoFile(session);
+        this.store.transaction(() => {
+            this.store.db.prepare('DELETE FROM hook_trust WHERE root=? AND path=?').run(root, path);
+            this.store.event(session, 'hooks.revoked', { path });
+        });
+    }
+    /** Run every trusted hook for `event`. Blocking events stop at the first block. */
+    async fire(session, event, payload, names) {
+        const notices = [];
+        const context = [];
+        const cwd = this.store.session(session).cwd;
+        const input = JSON.stringify({ session_id: session, cwd, hook_event_name: event, ...payload });
+        for (const source of this.sources(session)) {
+            if (!source.trusted)
+                continue;
+            for (const group of source.config[event] ?? []) {
+                if (TOOL_EVENTS.has(event) && !matchesTool(group.matcher, names))
+                    continue;
+                for (const handler of group.hooks) {
+                    const started = Date.now();
+                    const r = await this.run(session, handler.command, input, (handler.timeout ?? DEFAULT_TIMEOUT) * 1000);
+                    const decision = parseDecision(r.stdout);
+                    let blocked;
+                    if (BLOCKING.has(event) && !r.refused && !r.timedOut) {
+                        if (r.code === 2)
+                            blocked = r.stderr.trim() || `Blocked by a ${event} hook`;
+                        else if (r.code === 0 && decision.block)
+                            blocked = decision.reason || `Blocked by a ${event} hook`;
+                    }
+                    if (r.refused)
+                        notices.push(`${event} hook refused: ${r.refused}`);
+                    else if (r.timedOut)
+                        notices.push(`${event} hook timed out: ${short(handler.command)}`);
+                    else if (r.code !== 0 && r.code !== 2)
+                        notices.push(`${event} hook failed (exit ${r.code}): ${short(handler.command)}`);
+                    if (event === 'UserPromptSubmit' && r.code === 0 && !blocked) {
+                        const extra = decision.context ?? (decision.json ? '' : r.stdout.trim());
+                        if (extra)
+                            context.push(extra);
+                    }
+                    this.store.transaction(() => this.store.event(session, 'hook.run', {
+                        event,
+                        scope: source.scope,
+                        path: source.path,
+                        file_digest: source.digest,
+                        command_digest: sha(handler.command),
+                        exit_code: r.code,
+                        timed_out: r.timedOut,
+                        refused: !!r.refused,
+                        blocked: !!blocked,
+                        ...(decision.ignored ? { ignored_decision: decision.ignored } : {}),
+                        duration_ms: Date.now() - started,
+                        stdout_digest: sha(r.stdout),
+                        stderr_digest: sha(r.stderr),
+                        output_bytes: Buffer.byteLength(r.stdout) + Buffer.byteLength(r.stderr),
+                        truncated: r.truncated,
+                    }));
+                    if (blocked)
+                        return { blocked, notices };
+                }
+            }
+        }
+        const joined = context.join('\n\n');
+        return {
+            notices,
+            ...(joined ? { context: truncate(joined, MAX_CONTEXT) } : {}),
+        };
+    }
+}
+/** A JSON object on stdout, read the Claude Code way. "allow" and "ask" are recorded as ignored:
+ * Salaam's own approval flow decides those. */
+function parseDecision(stdout) {
+    const text = stdout.trim();
+    if (!text.startsWith('{'))
+        return { json: false };
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return { json: false };
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { json: false };
+    const specific = (value.hookSpecificOutput ?? {});
+    const decision = specific.permissionDecision;
+    const reason = typeof specific.permissionDecisionReason === 'string'
+        ? specific.permissionDecisionReason
+        : typeof value.reason === 'string'
+            ? value.reason
+            : undefined;
+    const context = typeof specific.additionalContext === 'string' ? specific.additionalContext : undefined;
+    if (decision === 'deny' || value.decision === 'block')
+        return { json: true, block: true, ...(reason ? { reason } : {}) };
+    return {
+        json: true,
+        ...(context ? { context } : {}),
+        ...(typeof decision === 'string' ? { ignored: decision } : {}),
+        ...(value.decision === 'approve' ? { ignored: 'approve' } : {}),
+    };
+}
+function inside(root, path) {
+    const r = relative(root, path);
+    return !r.startsWith('..') && !r.startsWith(sep);
+}
+function isLink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function short(command) {
+    const line = command.split('\n')[0];
+    return line.length > 60 ? line.slice(0, 57) + '…' : line;
+}
+function truncate(text, max) {
+    const buf = Buffer.from(text);
+    return buf.length <= max
+        ? text
+        : buf.subarray(0, max).toString('utf8') + '\n[hook output truncated]';
+}
+/** What `/hooks` shows, and what you review before trusting a workspace file: every command. */
+export function describeHooks(sources) {
+    if (!sources.length)
+        return "No hooks. Add your own in ~/.config/salaam/hooks.json, or a workspace's in .salaam/hooks.json (it runs only once you trust it with /hooks trust).";
+    return sources
+        .map((s) => {
+        const state = s.scope === 'user'
+            ? 'yours, runs'
+            : s.trusted
+                ? 'workspace, trusted (this exact content)'
+                : s.digest
+                    ? 'workspace, NOT trusted, does not run (/hooks trust to review)'
+                    : 'workspace, unreadable';
+        const lines = [`${s.path}  [${state}]`];
+        for (const event of HOOK_EVENTS)
+            for (const g of s.config[event] ?? [])
+                for (const h of g.hooks)
+                    lines.push(`  ${event}${g.matcher ? ` (${g.matcher})` : ''}: ${h.command}${h.timeout ? `  [${h.timeout}s]` : ''}`);
+        for (const p of s.problems)
+            lines.push(`  ! ${p}`);
+        if (s.digest)
+            lines.push(`  ${s.digest}`);
+        return lines.join('\n');
+    })
+        .join('\n\n');
+}

package/dist/src/host.js

@@ -1,4 +1,5 @@
 import { DEFAULT_COMMAND_NETWORK_SOCKET } from './command-network.js';
+import { loadDangerClassifierOptions } from './danger-classifier.js';
 import { spawn, execFileSync } from 'node:child_process';
 import { once } from 'node:events';
 import { readFileSync, readdirSync, mkdirSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, existsSync, realpathSync, constants, fstatSync, lstatSync, } from 'node:fs';
@@ -17,9 +18,9 @@ import { call } from './transport.js';
 import { readStationConfig } from './station-config.js';
 import { readToolkitConfig } from './toolkit-config.js';
 import { OperatorMcp } from './operator-mcp.js';
-import { chooseLocalSandbox, sandboxLabel } from './command-sandbox.js';
+import { chooseLocalSandbox, resolveReadPaths, sandboxLabel, } from './command-sandbox.js';
 import { loadPersona } from './persona.js';
-export function hostLocalSandbox(platform = process.platform, find, findSb, allowUnsandboxed = false, brokerSocket) {
+export function hostLocalSandbox(platform = process.platform, find, findSb, allowUnsandboxed = false, brokerSocket, readPaths = [], allowFullAccessSessions = false, allowYoloSessions = false, dangerClassifier) {
     const { kind } = chooseLocalSandbox('workspace-write', platform, find, findSb);
     return {
         kind,
@@ -34,8 +35,33 @@ export function hostLocalSandbox(platform = process.platform, find, findSb, allo
                 },
             }
             : {}),
+        ...(readPaths.length ? { read_paths: [...readPaths] } : {}),
+        ...(allowFullAccessSessions ? { full_access_sessions: 'allow' } : {}),
+        ...(allowYoloSessions ? { yolo_sessions: 'allow' } : {}),
+        ...(dangerClassifier ? { danger_classifier: dangerClassifier } : {}),
     };
 }
+/** The read-only paths outside the workspace the reviewed manifest lets local commands read. */
+export function hostReadPaths(m) {
+    const r = m.local_sandbox?.read_paths;
+    return Array.isArray(r) ? r.filter((p) => typeof p === 'string') : [];
+}
+/** Whether the reviewed manifest lets an interactive session choose full access (Phase 2b). */
+export function hostAllowsFullAccessSessions(m) {
+    return (m.local_sandbox?.full_access_sessions === 'allow');
+}
+/** Whether the reviewed manifest lets a desk session choose YOLO. */
+export function hostAllowsYoloSessions(m) {
+    return m.local_sandbox?.yolo_sessions === 'allow';
+}
+/** The command reviewer a host service may run: a reviewed config and optional pin, or none
+ * ({ pin: 'off' }). Absent means forbidden: hosts get no reviewer without the operator. */
+export function hostDangerClassifier(m) {
+    const d = m.local_sandbox?.danger_classifier;
+    if (!d || d.mode !== 'config')
+        return { pin: 'off' };
+    return { config: d.config, ...(d.pin ? { pin: d.pin } : {}) };
+}
 /** The broker socket local commands reach the network through, or null for no network. */
 export function hostCommandNetwork(m) {
     const n = m.local_sandbox?.command_network;
@@ -133,6 +159,10 @@ async function planAgentPod(c) {
         'unsandboxed_commands',
         'command_network',
         'command_network_socket',
+        'local_sandbox_read_paths',
+        'allow_full_access_sessions',
+        'allow_yolo_sessions',
+        'danger_classifier',
     ];
     if (Object.keys(c).some((k) => !fields.includes(k)))
         throw Error('Unexpected AgentPod host config field');
@@ -172,6 +202,12 @@ async function planAgentPod(c) {
     if (c.unsandboxed_commands !== undefined && c.unsandboxed_commands !== 'allow')
         throw Error('unsandboxed_commands is "allow" or absent');
     const allowUnsandboxed = c.unsandboxed_commands === 'allow';
+    if (c.allow_full_access_sessions !== undefined && c.allow_full_access_sessions !== true)
+        throw Error('allow_full_access_sessions is true or absent');
+    const allowFullAccessSessions = c.allow_full_access_sessions === true;
+    if (c.allow_yolo_sessions !== undefined && c.allow_yolo_sessions !== true)
+        throw Error('allow_yolo_sessions is true or absent');
+    const allowYoloSessions = c.allow_yolo_sessions === true;
     if (c.command_network !== undefined && c.command_network !== 'broker')
         throw Error('command_network is "broker" or absent');
     if (c.command_network_socket !== undefined) {
@@ -181,6 +217,19 @@ async function planAgentPod(c) {
         if (typeof sock !== 'string' || !isAbsolute(sock) || sock.includes('\0'))
             throw Error('command_network_socket must be an absolute path');
     }
+    const dangerClassifier = parseHostDangerClassifier(c.danger_classifier);
+    let readPaths = [];
+    if (c.local_sandbox_read_paths !== undefined) {
+        const raw = c.local_sandbox_read_paths;
+        if (!Array.isArray(raw) || raw.some((p) => typeof p !== 'string'))
+            throw Error('local_sandbox_read_paths is a list of absolute paths or "toolchain"');
+        try {
+            readPaths = resolveReadPaths(raw);
+        }
+        catch (error) {
+            throw Error(error.message);
+        }
+    }
     const brokerSocket = c.command_network === 'broker'
         ? String(c.command_network_socket ?? DEFAULT_COMMAND_NETWORK_SOCKET)
         : undefined;
@@ -253,7 +302,45 @@ async function planAgentPod(c) {
         pins_digest: digest(pins),
         workspace: pins.workspace,
         cli_digest: digest(readFileSync(join(ROOT, 'bin/salaam.mjs'), 'utf8')),
-        local_sandbox: hostLocalSandbox(undefined, undefined, undefined, allowUnsandboxed, brokerSocket),
+        local_sandbox: hostLocalSandbox(undefined, undefined, undefined, allowUnsandboxed, brokerSocket, readPaths, allowFullAccessSessions, allowYoloSessions, dangerClassifier),
+    };
+}
+function reviewerDigest(path) {
+    try {
+        return digest(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function parseHostDangerClassifier(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (raw === 'forbid')
+        return { mode: 'forbid' };
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw Error('danger_classifier is "forbid" or { config, pin? }');
+    const c = raw;
+    if (Object.keys(c).some((k) => k !== 'config' && k !== 'pin'))
+        throw Error('danger_classifier takes only config and pin');
+    if (typeof c.config !== 'string' || !isAbsolute(c.config) || c.config.includes('\0'))
+        throw Error('danger_classifier.config must be an absolute path');
+    let names;
+    try {
+        // Keys are named by environment variable and checked when the service starts, not here.
+        const anyKey = new Proxy({}, { get: () => 'checked-at-start' });
+        names = loadDangerClassifierOptions(JSON.parse(readFileSync(c.config, 'utf8')), anyKey).options.map((o) => o.name);
+    }
+    catch (error) {
+        throw Error('danger_classifier.config: ' + error.message);
+    }
+    if (c.pin !== undefined && (typeof c.pin !== 'string' || !names.includes(c.pin)))
+        throw Error("danger_classifier.pin must name one of the config's options");
+    return {
+        mode: 'config',
+        config: c.config,
+        digest: reviewerDigest(c.config),
+        ...(typeof c.pin === 'string' ? { pin: c.pin } : {}),
     };
 }
 export function hostDigests() {
@@ -389,8 +476,13 @@ export function readHost(path) {
             throw Error('Host CLI changed');
         if (Object.hasOwn(m, 'local_sandbox') &&
             canonical(m.local_sandbox) !==
-                canonical(hostLocalSandbox(undefined, undefined, undefined, hostAllowsUnsandboxed(m), hostCommandNetwork(m)?.socket)))
+                canonical(hostLocalSandbox(undefined, undefined, undefined, hostAllowsUnsandboxed(m), hostCommandNetwork(m)?.socket, hostReadPaths(m), hostAllowsFullAccessSessions(m), hostAllowsYoloSessions(m), m.local_sandbox?.danger_classifier)))
             throw Error('Host command sandbox changed; run host plan again');
+        {
+            const d = m.local_sandbox?.danger_classifier;
+            if (d?.mode === 'config' && reviewerDigest(d.config) !== d.digest)
+                throw Error('Host command reviewer config changed; run host plan again');
+        }
         const pins = readAgentPodPins(m.agentpod_config, m.state);
         const managed = hostMcp(m);
         if (m.schema === 3 || ([4, 5, 6].includes(m.schema) && Object.hasOwn(m, 'managed_mcp'))) {