loopat 0.1.20 → 0.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopat",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Self-hosted AI workspace built around context management — works solo, scales to teams",
   "license": "Apache-2.0",
   "homepage": "https://github.com/simpx/loopat",
@@ -14,6 +14,7 @@
   },
   "files": [
     "bin/",
+    "scripts/install-sandbox-claude.mjs",
     "server/src/",
     "!server/src/serve-rs",
     "!server/src/port-proxy-rs",
@@ -34,6 +35,7 @@
     "build": "bun install && (cd web && bun run build)",
     "build:web": "cd web && bunx tsc -b && bunx vite build",
     "prepublishOnly": "bun install && bun run build:web",
+    "postinstall": "node scripts/install-sandbox-claude.mjs",
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui"
   },

package/scripts/install-sandbox-claude.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * postinstall: make sure a LINUX claude binary is available for the sandbox.
+ *
+ * loopat runs the AI inside a linux podman sandbox, so it needs the
+ * linux-<arch> claude binary. npm only installs the claude-agent-sdk platform
+ * binary matching the HOST (os/cpu filtered optionalDependencies) — so on a
+ * linux host we already have it (no-op here), but on macOS/Windows npm installs
+ * the darwin/win binary and the sandbox would hit "Exec format error".
+ *
+ * On a non-linux host we fetch the linux-<arch> binary into
+ * <loopat>/sandbox-claude (pinned to the SDK version we depend on) using npm's
+ * --os/--cpu override. Best-effort: a failure only means sandbox AI won't run
+ * on this host until fixed; the install itself still succeeds.
+ */
+import { execFileSync } from "node:child_process"
+import { existsSync, mkdirSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+import { createRequire } from "node:module"
+
+if (process.platform === "linux") process.exit(0) // host claude IS the sandbox claude
+
+const arch = process.arch // "arm64" | "x64"
+const pkg = `@anthropic-ai/claude-agent-sdk-linux-${arch}`
+const installDir = resolve(dirname(fileURLToPath(import.meta.url)), "..")
+const dest = join(installDir, "sandbox-claude")
+const binary = join(dest, "node_modules", pkg, "claude")
+
+if (existsSync(binary)) process.exit(0) // already fetched
+
+try {
+  const require = createRequire(import.meta.url)
+  let version = ""
+  try {
+    version = require("@anthropic-ai/claude-agent-sdk/package.json").version
+  } catch {}
+  const spec = version ? `${pkg}@${version}` : pkg
+  mkdirSync(dest, { recursive: true })
+  console.log(`[loopat] host is ${process.platform}/${arch}; fetching linux claude for the sandbox (${spec})…`)
+  // The platform binary declares os=linux, so `--os=linux --cpu` hits
+  // EBADPLATFORM on a darwin host — `--force` is what actually fetches it.
+  execFileSync("npm", ["install", "--prefix", dest, "--no-save", "--force", spec], { stdio: "inherit" })
+  if (existsSync(binary)) console.log(`[loopat] sandbox claude ready at ${binary}`)
+  else console.warn(`[loopat] sandbox claude install finished but ${binary} is missing`)
+} catch (e) {
+  console.warn(`[loopat] could not fetch linux claude for the sandbox: ${e?.message ?? e}`)
+  console.warn(`[loopat] sandbox AI won't run on this host until fixed; everything else works.`)
+}

package/server/src/bootstrap.ts

@@ -6,7 +6,7 @@
 import { existsSync } from "node:fs"
 import { execFileSync } from "node:child_process"
 import { join } from "node:path"
-import { resolveClaudeBinary } from "./claude-binary"
+import { resolveSandboxClaudeBinary } from "./claude-binary"
 import { configPath, loadKnowledgeConfig, type WorkspaceConfig, type KnowledgeConfig } from "./config"
 import {
   WORKSPACE,
@@ -68,14 +68,19 @@ function checkPodman(): Check {
 }
 
 function checkClaudeBinary(): Check {
+  // The AI runs in the linux sandbox, so what matters is the SANDBOX claude.
   try {
-    const p = resolveClaudeBinary()
-    return { ok: true, label: `claude binary (${p.split("/").slice(-3).join("/")})` }
-  } catch (e: any) {
+    const p = resolveSandboxClaudeBinary()
+    const tag = process.platform === "linux" ? "" : " [linux, for sandbox]"
+    return { ok: true, label: `claude binary${tag} (${p.split("/").slice(-3).join("/")})` }
+  } catch {
     return {
       ok: false,
-      label: "claude binary",
-      hint: "run `bun install` in the loopat repo root — SDK ships the binary as a platform-specific package",
+      label: "claude binary (sandbox/linux)",
+      hint:
+        process.platform === "linux"
+          ? "run `bun install` in the loopat repo root — SDK ships the binary as a platform-specific package"
+          : "the linux claude for the sandbox wasn't fetched (postinstall). Reinstall loopat, or run the `npm install --os=linux ...` command from the resolve error",
     }
   }
 }

package/server/src/claude-binary.ts

@@ -1,7 +1,11 @@
-import { existsSync } from "node:fs"
-import { execSync } from "node:child_process"
+import { existsSync, mkdirSync } from "node:fs"
+import { execSync, execFile } from "node:child_process"
+import { promisify } from "node:util"
 import { fileURLToPath } from "node:url"
 import { dirname, resolve, join } from "node:path"
+import { createRequire } from "node:module"
+
+const execFileP = promisify(execFile)
 
 function detectIsMusl(): boolean {
   if (process.platform !== "linux") return false
@@ -66,3 +70,50 @@ export function resolveClaudeBinary(): string {
   }
   throw new Error(`claude binary not found; tried:\n${candidates.join("\n")}`)
 }
+
+/** Where the fetched linux claude lives on a non-linux host. */
+function sandboxClaudeDir(): string {
+  const installDir = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..")
+  return join(installDir, "sandbox-claude")
+}
+function sandboxClaudeBinaryPath(): string {
+  return join(sandboxClaudeDir(), "node_modules", "@anthropic-ai", `claude-agent-sdk-linux-${process.arch}`, "claude")
+}
+
+/**
+ * The claude binary the SANDBOX runs (the AI executes inside a linux podman
+ * container). On a linux host that's just the host claude. On a non-linux host
+ * npm only installed the host (e.g. darwin) binary, so we fetch the linux-<arch>
+ * one into <loopat>/sandbox-claude — bind THAT into the sandbox, not the host
+ * binary (otherwise: "Exec format error").
+ */
+export function resolveSandboxClaudeBinary(): string {
+  if (process.platform === "linux") return resolveClaudeBinary()
+  const candidate = sandboxClaudeBinaryPath()
+  if (existsSync(candidate)) return candidate
+  throw new Error(`sandbox (linux) claude not found at ${candidate}; run ensureSandboxClaudeBinary() (loopat fetches it on first boot)`)
+}
+
+/**
+ * Make sure the sandbox's linux claude exists, fetching it if not. No-op on a
+ * linux host (host claude IS the sandbox claude). On a non-linux host this runs
+ * `npm install --force` (the platform binary has os=linux, so --os/--cpu hit
+ * EBADPLATFORM; --force is what gets it). Pinned to the SDK version. Best-effort
+ * and idempotent: once fetched, returns immediately. npx does NOT run package
+ * postinstall scripts, so this boot-time fetch is what actually covers
+ * `npx loopat`.
+ */
+export async function ensureSandboxClaudeBinary(onLog?: (m: string) => void): Promise<void> {
+  if (process.platform === "linux") return
+  if (existsSync(sandboxClaudeBinaryPath())) return
+  const arch = process.arch
+  let version = ""
+  try { version = createRequire(import.meta.url)("@anthropic-ai/claude-agent-sdk/package.json").version } catch {}
+  const spec = `@anthropic-ai/claude-agent-sdk-linux-${arch}${version ? `@${version}` : ""}`
+  const dest = sandboxClaudeDir()
+  mkdirSync(dest, { recursive: true })
+  onLog?.(`host is ${process.platform}/${arch}; fetching linux claude for the sandbox (${spec})…`)
+  await execFileP("npm", ["install", "--prefix", dest, "--no-save", "--force", spec], { timeout: 180_000 })
+  if (!existsSync(sandboxClaudeBinaryPath())) throw new Error(`fetch finished but ${sandboxClaudeBinaryPath()} missing`)
+  onLog?.(`sandbox claude ready`)
+}

package/server/src/index.ts

@@ -58,6 +58,7 @@ import {
 import { loadConfig, loadPersonalConfig, savePersonalConfig, saveWorkspaceConfig, loadTokenUsage, getActiveProvider, readPersonalDiskRaw, savePersonalDisk, describeApiKeyRef, writeVaultEnv, deleteVaultEnv, loadKnowledgeConfig, saveKnowledgeConfig, type ProviderConfig, type ModelEntry } from "./config"
 import { listBoards, createBoard, renameBoard, listKanbanColumns, addCard, toggleCard, deleteCard, moveCard, updateCardMeta, updateCardBlock, reorderCards, createColumn, deleteColumn, readKanbanConfig, saveColumnOrder, setColumnColor, renameColumn, assignDriverForCard, createLoopFromCard, linkLoopToCard, kanbanUserCtx } from "./kanban"
 import { printBootstrapBanner } from "./bootstrap"
+import { ensureSandboxClaudeBinary } from "./claude-binary"
 import { serveHostExec, hostExecSocketPath } from "./host-exec"
 import {
   createUser,
@@ -3170,6 +3171,13 @@ console.log(`[loopat] server listening on http://${hostname}:${port}`)
   }
 }
 
+// On a non-linux host the sandbox needs a linux claude that npm/npx didn't
+// install (npx skips postinstall scripts) — fetch it in the background on first
+// boot (~18s, doesn't block the port; skipped once present / on a linux host).
+ensureSandboxClaudeBinary((m) => console.log(`[loopat] ${m}`)).catch((e) =>
+  console.warn(`[loopat] sandbox claude fetch failed: ${e?.message ?? e}; sandbox AI won't run until fixed`),
+)
+
 await printBootstrapBanner(cfg)
 const backfilled = await backfillAllMounts()
 if (backfilled > 0) console.log(`[loopat] backfilled context mounts on ${backfilled} loop(s)`)

package/server/src/podman.ts

@@ -60,7 +60,7 @@ import {
 import { loadConfig } from "./config"
 import { DEFAULT_VAULT, listVaultHomeMounts } from "./vaults"
 import { hostExecDir, writeHostShims } from "./host-exec"
-import { resolveClaudeBinary } from "./claude-binary"
+import { resolveSandboxClaudeBinary } from "./claude-binary"
 import { parse as tomlParse, stringify as tomlStringify } from "smol-toml"
 
 const execFileP = promisify(execFile)
@@ -221,7 +221,7 @@ export async function buildVolumeMounts(opts: ContainerOptions): Promise<VolumeM
   // sandbox exec's it by its host path, so bind that path in (ro) when it isn't
   // already covered by the install-dir mount — otherwise the AI is code 127.
   try {
-    const claudeDir = dirname(resolveClaudeBinary())
+    const claudeDir = dirname(resolveSandboxClaudeBinary())
     if (existsSync(claudeDir) && !claudeDir.startsWith(LOOPAT_INSTALL_DIR)) {
       mounts.push({ src: claudeDir, dst: claudeDir, ro: true })
     }

package/server/src/session.ts

@@ -5,7 +5,7 @@ import { createWriteStream, mkdirSync, existsSync } from "node:fs"
 import { randomUUID } from "node:crypto"
 import { join } from "node:path"
 import { loopClaudeDir, loopDir, loopHistoryPath, personalSkillsDir, workspaceTeamSkillsDir } from "./paths"
-import { resolveClaudeBinary } from "./claude-binary"
+import { resolveSandboxClaudeBinary } from "./claude-binary"
 import { loadConfig, loadPersonalConfig, parseDefault, type ProviderConfig } from "./config"
 import { buildLoopatAppend } from "./system-prompt"
 import { composeLoopClaudeConfig, writeLoopSettings } from "./compose"
@@ -21,8 +21,11 @@ import { updateLoopStatus } from "./loop-status"
 // Resolved lazily — each spawn re-reads the env var so the full-suite test
 // run, where module load order isn't guaranteed, sees the test's override
 // even if session.ts was imported earlier with the env var unset.
+// The AI runs inside the linux sandbox, so it needs the linux claude binary
+// (resolveSandboxClaudeBinary) — on a linux host that's the host claude; on a
+// darwin/win host it's the linux binary postinstall fetched into sandbox-claude.
 function getClaudeBinary(): string {
-  return process.env.LOOPAT_CLAUDE_BIN || resolveClaudeBinary()
+  return process.env.LOOPAT_CLAUDE_BIN || resolveSandboxClaudeBinary()
 }
 const DEBUG = !!process.env.LOOPAT_DEBUG || !!process.env.LOOPAT_DEBUG_SPAWN