loopat 0.1.20 → 0.1.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopat",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Self-hosted AI workspace built around context management — works solo, scales to teams",
   "license": "Apache-2.0",
   "homepage": "https://github.com/simpx/loopat",
@@ -14,6 +14,7 @@
   },
   "files": [
     "bin/",
+    "scripts/install-sandbox-claude.mjs",
     "server/src/",
     "!server/src/serve-rs",
     "!server/src/port-proxy-rs",
@@ -34,6 +35,7 @@
     "build": "bun install && (cd web && bun run build)",
     "build:web": "cd web && bunx tsc -b && bunx vite build",
     "prepublishOnly": "bun install && bun run build:web",
+    "postinstall": "node scripts/install-sandbox-claude.mjs",
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui"
   },

package/scripts/install-sandbox-claude.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * postinstall: make sure a LINUX claude binary is available for the sandbox.
+ *
+ * loopat runs the AI inside a linux podman sandbox, so it needs the
+ * linux-<arch> claude binary. npm only installs the claude-agent-sdk platform
+ * binary matching the HOST (os/cpu filtered optionalDependencies) — so on a
+ * linux host we already have it (no-op here), but on macOS/Windows npm installs
+ * the darwin/win binary and the sandbox would hit "Exec format error".
+ *
+ * On a non-linux host we fetch the linux-<arch> binary into
+ * <loopat>/sandbox-claude (pinned to the SDK version we depend on) using npm's
+ * --os/--cpu override. Best-effort: a failure only means sandbox AI won't run
+ * on this host until fixed; the install itself still succeeds.
+ */
+import { execFileSync } from "node:child_process"
+import { existsSync, mkdirSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+import { createRequire } from "node:module"
+
+if (process.platform === "linux") process.exit(0) // host claude IS the sandbox claude
+
+const arch = process.arch // "arm64" | "x64"
+const pkg = `@anthropic-ai/claude-agent-sdk-linux-${arch}`
+const installDir = resolve(dirname(fileURLToPath(import.meta.url)), "..")
+const dest = join(installDir, "sandbox-claude")
+const binary = join(dest, "node_modules", pkg, "claude")
+
+if (existsSync(binary)) process.exit(0) // already fetched
+
+try {
+  const require = createRequire(import.meta.url)
+  let version = ""
+  try {
+    version = require("@anthropic-ai/claude-agent-sdk/package.json").version
+  } catch {}
+  const spec = version ? `${pkg}@${version}` : pkg
+  mkdirSync(dest, { recursive: true })
+  console.log(`[loopat] host is ${process.platform}/${arch}; fetching linux claude for the sandbox (${spec})…`)
+  execFileSync(
+    "npm",
+    ["install", "--prefix", dest, "--no-save", "--os=linux", `--cpu=${arch}`, spec],
+    { stdio: "inherit" },
+  )
+  if (existsSync(binary)) console.log(`[loopat] sandbox claude ready at ${binary}`)
+  else console.warn(`[loopat] sandbox claude install finished but ${binary} is missing`)
+} catch (e) {
+  console.warn(`[loopat] could not fetch linux claude for the sandbox: ${e?.message ?? e}`)
+  console.warn(`[loopat] sandbox AI won't run on this host until fixed; everything else works.`)
+}

package/server/src/bootstrap.ts

@@ -6,7 +6,7 @@
 import { existsSync } from "node:fs"
 import { execFileSync } from "node:child_process"
 import { join } from "node:path"
-import { resolveClaudeBinary } from "./claude-binary"
+import { resolveSandboxClaudeBinary } from "./claude-binary"
 import { configPath, loadKnowledgeConfig, type WorkspaceConfig, type KnowledgeConfig } from "./config"
 import {
   WORKSPACE,
@@ -68,14 +68,19 @@ function checkPodman(): Check {
 }
 
 function checkClaudeBinary(): Check {
+  // The AI runs in the linux sandbox, so what matters is the SANDBOX claude.
   try {
-    const p = resolveClaudeBinary()
-    return { ok: true, label: `claude binary (${p.split("/").slice(-3).join("/")})` }
-  } catch (e: any) {
+    const p = resolveSandboxClaudeBinary()
+    const tag = process.platform === "linux" ? "" : " [linux, for sandbox]"
+    return { ok: true, label: `claude binary${tag} (${p.split("/").slice(-3).join("/")})` }
+  } catch {
     return {
       ok: false,
-      label: "claude binary",
-      hint: "run `bun install` in the loopat repo root — SDK ships the binary as a platform-specific package",
+      label: "claude binary (sandbox/linux)",
+      hint:
+        process.platform === "linux"
+          ? "run `bun install` in the loopat repo root — SDK ships the binary as a platform-specific package"
+          : "the linux claude for the sandbox wasn't fetched (postinstall). Reinstall loopat, or run the `npm install --os=linux ...` command from the resolve error",
     }
   }
 }

package/server/src/claude-binary.ts

@@ -66,3 +66,22 @@ export function resolveClaudeBinary(): string {
   }
   throw new Error(`claude binary not found; tried:\n${candidates.join("\n")}`)
 }
+
+/**
+ * The claude binary the SANDBOX runs (the AI executes inside a linux podman
+ * container). On a linux host that's just the host claude. On a non-linux host
+ * npm only installed the host (e.g. darwin) binary, so postinstall fetched the
+ * linux-<arch> one into <loopat>/sandbox-claude — bind THAT into the sandbox,
+ * not the host binary (otherwise: "Exec format error").
+ */
+export function resolveSandboxClaudeBinary(): string {
+  if (process.platform === "linux") return resolveClaudeBinary()
+  const arch = process.arch
+  const installDir = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..")
+  const candidate = join(installDir, "sandbox-claude", "node_modules", "@anthropic-ai", `claude-agent-sdk-linux-${arch}`, "claude")
+  if (existsSync(candidate)) return candidate
+  throw new Error(
+    `sandbox (linux) claude not found at ${candidate}; postinstall may have failed. Fix: ` +
+      `npm install --prefix "${join(installDir, "sandbox-claude")}" --no-save --os=linux --cpu=${arch} @anthropic-ai/claude-agent-sdk-linux-${arch}`,
+  )
+}

package/server/src/podman.ts

@@ -60,7 +60,7 @@ import {
 import { loadConfig } from "./config"
 import { DEFAULT_VAULT, listVaultHomeMounts } from "./vaults"
 import { hostExecDir, writeHostShims } from "./host-exec"
-import { resolveClaudeBinary } from "./claude-binary"
+import { resolveSandboxClaudeBinary } from "./claude-binary"
 import { parse as tomlParse, stringify as tomlStringify } from "smol-toml"
 
 const execFileP = promisify(execFile)
@@ -221,7 +221,7 @@ export async function buildVolumeMounts(opts: ContainerOptions): Promise<VolumeM
   // sandbox exec's it by its host path, so bind that path in (ro) when it isn't
   // already covered by the install-dir mount — otherwise the AI is code 127.
   try {
-    const claudeDir = dirname(resolveClaudeBinary())
+    const claudeDir = dirname(resolveSandboxClaudeBinary())
     if (existsSync(claudeDir) && !claudeDir.startsWith(LOOPAT_INSTALL_DIR)) {
       mounts.push({ src: claudeDir, dst: claudeDir, ro: true })
     }

package/server/src/session.ts

@@ -5,7 +5,7 @@ import { createWriteStream, mkdirSync, existsSync } from "node:fs"
 import { randomUUID } from "node:crypto"
 import { join } from "node:path"
 import { loopClaudeDir, loopDir, loopHistoryPath, personalSkillsDir, workspaceTeamSkillsDir } from "./paths"
-import { resolveClaudeBinary } from "./claude-binary"
+import { resolveSandboxClaudeBinary } from "./claude-binary"
 import { loadConfig, loadPersonalConfig, parseDefault, type ProviderConfig } from "./config"
 import { buildLoopatAppend } from "./system-prompt"
 import { composeLoopClaudeConfig, writeLoopSettings } from "./compose"
@@ -21,8 +21,11 @@ import { updateLoopStatus } from "./loop-status"
 // Resolved lazily — each spawn re-reads the env var so the full-suite test
 // run, where module load order isn't guaranteed, sees the test's override
 // even if session.ts was imported earlier with the env var unset.
+// The AI runs inside the linux sandbox, so it needs the linux claude binary
+// (resolveSandboxClaudeBinary) — on a linux host that's the host claude; on a
+// darwin/win host it's the linux binary postinstall fetched into sandbox-claude.
 function getClaudeBinary(): string {
-  return process.env.LOOPAT_CLAUDE_BIN || resolveClaudeBinary()
+  return process.env.LOOPAT_CLAUDE_BIN || resolveSandboxClaudeBinary()
 }
 const DEBUG = !!process.env.LOOPAT_DEBUG || !!process.env.LOOPAT_DEBUG_SPAWN