Salaam 0.0.7

Summary

Salaam v0.0.7 fixes pasted images in plain sessions and reorganises the code. A plain salaam session (read-only, no commands) used to refuse pasted images with "Only a local session takes pasted images" and sent @ mentions as bare text. Every local session now attaches both. Board sessions still get exactly what was typed.

The rest of the release is structural. src/ is now 20 modules, each imported only through its index.ts and layered so imports point one way, with no file over 1,000 lines. The structure is described in docs/contributor/code-structure.md. CI now runs type-aware oxlint through npm run lint, and the number of existing findings may fall but never rise. The work was done in phases, and along the way it replaced any types with named types, tightened promise handling, and made the TUI a command registry with panels and the CLI one module per group. Commands, keys, HTTP routes, ACP messages and the state database are unchanged.

Operators should know that host digests change value. source_digest and build_digest once again hash every file under src/ and dist/src/, and the Pi bundle digest now also covers the persona file the house extension loads. Anything that compares these digests against earlier values will see a difference. The material gives no other upgrade steps.

---

What's Changed

• Take pasted images and @ mentions in every local session by @rakeshgangwar in #114
• Modularity and code quality (0.0.7) by @rakeshgangwar in #115
• Release 0.0.7 by @rakeshgangwar in #116

Full Changelog: v0.0.6...v0.0.7

Salaam 0.0.6

Summary

Salaam v0.0.6 lets you paste a screenshot into a message, gives background servers and watchers network access to allowed hosts, and lets you open Salaam in Zed with no service running. Pressing Ctrl+V reads the system clipboard (natively on macOS and Windows, through wl-paste or xclip on Linux). The image goes with the message as [image #N] and is saved in the outbox alongside it. Each image can be up to 3.75 MB, and macOS scales a larger one down first.

Background commands now get network through the broker allowlist, as foreground ones do, for as long as they run. A refused host is listed in the command's output, and the agent also sees what the command reached. This also fixes a bug where a background command's approval claimed network access through the allowlist that it did not actually have. For Zed, salaam acp --local starts the service itself, and a new session uses the same model a new terminal session would. The documentation at docs.salaam.sh has been restructured into Intro, Usage, Configure and Operate, with new pages for the CLI, editors, permissions, sandbox, rules (AGENTS.md), commands, hooks and troubleshooting. Command and key tables are now generated from the code.

The notes list no steps to take before or after upgrading. On Linux, pasting images needs wl-paste or xclip to be installed. Users will see image paste in the terminal, background commands that can reach allowed hosts, and a Zed session that no longer needs a running service.

---

What's Changed

• Zed: the desk adapter starts the service and uses the terminal's model by @rakeshgangwar in #108
• docs: restructure the docs site like OpenCode's by @rakeshgangwar in #109
• docs: keep the docs true to the code by @rakeshgangwar in #110
• feat: paste an image with Ctrl+V; background commands get broker network by @rakeshgangwar in #111
• release: 0.0.6 by @rakeshgangwar in #112
• Fix the release-blocking macOS checks by @rakeshgangwar in #113

Full Changelog: v0.0.5...v0.0.6

Salaam 0.0.5

What's Changed

• docs: interactive audit against 11 harnesses, and the daily-driver plan by @rakeshgangwar in #102
• Salaam as a daily driver: phases 1–3 and session modes by @rakeshgangwar in #103
• Salaam trial polish and Phase 4: keys, approvals, git, commands, hooks, classifier by @rakeshgangwar in #104
• Zed drives your desk session; model switch keeps its choice by @rakeshgangwar in #105
• Tool calls in their own turn, honest usage, and one command outside the sandbox by @rakeshgangwar in #106
• release: prepare v0.0.5 by @rakeshgangwar in #107

Full Changelog: v0.0.4...v0.0.5

Salaam 0.0.4

Summary

Salaam v0.0.4 does board work on a protected AgentPod station, made to match the Hermes workflow, and adds a sandbox for local commands. The changelog highlights approvals ("Approve for this run", and per-agent "Always allow" on workspace writes for owners and admins), a completion critic that lets a read-only reviewer judge verified deliverables against a plan's rubric, and read-only checkpoints of a station run with a diff against the live workspace and restore exactly as approved. Local commands now run in bubblewrap on Linux and Seatbelt on macOS. With command_network: "broker", they reach only the hosts the operator lists in the stk policy. That setting needs SuperToolkit v0.0.4.

Other themes are board parity and run limits. Tool steps on the board now carry their output and a readable title, plan updates reach the card, and the hub serves board reads. Steps have request budgets, rate-limited steps retry and then stop provably, and a fetch host that keeps failing is paused briefly instead of failing the run. The operator persona can be pinned by digest in the host manifest. A new --tools-user option (SALAAM_TOOLS_USER) runs local agent commands, edits and undo as a separate unprivileged OS user, so tools cannot read the provider credential. Fixes include a verification read refused at spawn no longer stopping the daemon from starting, and a run stopped by its own failed acceptance check now reaching the board as failed instead of parking.

Before upgrading, operators should know that hosts without a usable bubblewrap or Seatbelt now refuse local commands. Install or repair the sandbox, or set unsandboxed_commands: "allow" in the host config. This release needs AgentPod v0.1.118 (hub) for the step output field and board reads. Without --tools-user, startup prints a warning.

Users will see plain-words approval offers, the new approval choices, readable titles on tool steps (including MCP steps with no input and finished steps), and failed runs showing as failed on the board.

---

What's Changed

• deploy: staging execution host on workbench, deployed from main by @rakeshgangwar in #40
• service start binds to the per-user AgentPod pins by default by @rakeshgangwar in #41
• Operator-declared MCP servers for standalone Salaam by @rakeshgangwar in #44
• spec: operator-declared MCP servers by @rakeshgangwar in #42
• deploy: staging smoke verifies a pins-bound daemon without an AgentPod admission by @rakeshgangwar in #45
• spec: run agent tool execution as a separate OS user by @rakeshgangwar in #43
• docs: AgentPod integration obligations by @rakeshgangwar in #47
• feat: run local agent tools as a separate OS user (--tools-user) by @rakeshgangwar in #46
• test: leave gated tool-user tests undefined, not skipped (evidence gate) by @rakeshgangwar in #48
• Salaam first-class: last_activity_at, launcher profile, host bind, mode-aware approvals by @rakeshgangwar in #49
• AgentPod: a fresh admission can continue a revoked interactive conversation by @rakeshgangwar in #51
• fix(acp): title operator MCP calls by server and tool; a fetch is kind fetch by @rakeshgangwar in #50
• deploy: staging deploy rolls launcher-profile Salaam hosts to the new commit by @rakeshgangwar in #52
• Salaam: tool failures name the tool, refused station calls are recorded, recovered tool errors don't fail checked steps by @rakeshgangwar in #53
• Landing: three.js section scenes, and CI that skips app jobs on landing-only changes by @rakeshgangwar in #54
• Landing: frontdoor 0.0.11 (calm footer, versions from the Worker) by @rakeshgangwar in #55
• docs: best-of-harnesses catalogue and Salaam gap analysis by @rakeshgangwar in #56
• Strict work: card activity, verified deliverables, ACP plan, revoke retirement by @rakeshgangwar in #57
• agentpod work: expire several unanswered review offers ended by a revoke by @rakeshgangwar in #58
• agentpod work: retire an attempt the request budget stopped before any effect by @rakeshgangwar in #59
• agentpod work: the request-budget shape accepts parallel operator MCP tools by @rakeshgangwar in #60
• host: a strict host can set how long an approval offer stays answerable by @rakeshgangwar in #61
• Accept created parent directories; retire runtime-stopped refused writes by @rakeshgangwar in #62
• Bound a task step's model requests by the task's limit by @rakeshgangwar in #63
• Retire a request-budget stop with its approved effects known by @rakeshgangwar in #64
• readable approvals: a decision offer says what is being approved by @rakeshgangwar in #65
• station patch: send the helper only its own fields by @rakeshgangwar in #66
• feat: approve for this run (approval scopes) by @rakeshgangwar in #67
• feat: always-allow approval rules per agent by @rakeshgangwar in #68
• feat: work status says when a stopped run can retire with known effects by @rakeshgangwar in #69
• fix: a helper refusal of the request itself is a definite failure by @rakeshgangwar in #70
• feat: pause fetches to a host that keeps failing, without failing the run by @rakeshgangwar in #71
• feat: completion hooks are required completion checks by @rakeshgangwar in #72
• feat: retry a rate-limited step as a fresh attempt, then stop provably by @rakeshgangwar in #73
• feat: a progression grant may carry the re-run allowance by @rakeshgangwar in #74
• feat: read-only station checkpoints and their diff by @rakeshgangwar in #75
• feat: a completion critic reviews the verified deliverables by @rakeshgangwar in #76
• feat: restore a checkpoint of an ended station run, exactly as approved by @rakeshgangwar in #77
• feat: run local commands in a bubblewrap sandbox on Linux by @rakeshgangwar in #78
• fix: compute the checkpoint diff from the live workspace by @rakeshgangwar in #79
• fix: send restore writes with the 64-hex request id the helper accepts by @rakeshgangwar in #81
• feat: pin an operator persona in the host manifest (item 9) by @rakeshgangwar in #82
• fix: a verification-budget stop with every step finished retires unattended by @rakeshgangwar in #83
• feat: work status names the guard that refuses a stopped run's settlement by @rakeshgangwar in #84
• feat: a refused verification-budget stop names the closed sub-check it misses by @rakeshgangwar in #85
• fix: a verification-budget stop stays provable after its runtime limit overwrites the reason by @rakeshgangwar in #86
• feat: offer Always allow on a workspace write approval (operator ruling 2026-10-28) by @rakeshgangwar in #87
• feat: a renewal adds a rule the hub newly lists (operator ruling 2026-10-28) by @rakeshgangwar in #88
• feat: readable tool titles, and board reads served by the hub (operator rulings 2026-10-28) by @rakeshgangwar in #89
• fix: worker gets salaam_board, reads first, every tool step titled by @rakeshgangwar in #90
• fix: an MCP step with no input or an unknown action is titled in plain words by @rakeshgangwar in #91
• fix: a finished tool step carries its output to the board by @rakeshgangwar in #92
• fix: a run its own acceptance check stopped reaches the board as a failed run by @rakeshgangwar in #93
• fix: a finished step's output rides the work-status activity tail by @rakeshgangwar in #94
• fix: a finished step on the card is titled like the call it finishes by @rakeshgangwar in #95
  *...

Salaam 0.0.3

What's Changed

• Speed up CI and promote verified release artifacts by @rakeshgangwar in #20
• Refresh multi-agent sites and verify public deployments by @rakeshgangwar in #21
• feat: bind AgentPod execution authority and prove recovery (M19.1) by @rakeshgangwar in #22
• feat(agentpod): add durable ACP prompt receipts and history identities by @rakeshgangwar in #23
• feat(agentpod): complete reviewed startup and durable ACP outcomes by @rakeshgangwar in #24
• test: wait for settled job verification receipts by @rakeshgangwar in #25
• feat: add managed MCP and station workspace execution by @rakeshgangwar in #26
• Improve local coding, TUI commands and scoped autonomy by @rakeshgangwar in #27
• docs: product name casing (SuperPipeline, SuperWitness) by @rakeshgangwar in #29
• Bind Superpipeline runs to durable protected station tasks by @rakeshgangwar in #28
• landing: rewrite copy to the landing brief by @rakeshgangwar in #30
• feat: render the suite frame at build time; drop the site's own header and footer by @rakeshgangwar in #31
• landing: frontdoor 0.0.3 by @rakeshgangwar in #32
• landing: frontdoor 0.0.6 by @rakeshgangwar in #33
• landing: frontdoor 0.0.9 by @rakeshgangwar in #34
• landing: frontdoor 0.0.10 by @rakeshgangwar in #36
• M22: Reproducible private runtime and reviewed context admission by @rakeshgangwar in #35
• landing: search and agent discovery (sitemap, llms.txt, JSON-LD) by @rakeshgangwar in #38
• Expose durable execution evidence and recover stopped work safely by @rakeshgangwar in #37
• release: Salaam 0.0.3 by @rakeshgangwar in #39

Full Changelog: v0.0.2...v0.0.3

Salaam 0.0.2

Salaam 0.0.2 adds more provider choices and durable specialist teams to the same persistent coding session.

• Use the complete pinned Pi provider catalog with model discovery, API keys, OAuth and cloud credentials. Subscription routes that cannot enforce output-token caps require an explicit token-budget opt-out for durable tasks; request and runtime limits still apply.
• Assign native exploration, coding and review specialists to durable task steps. Coding specialists work in private drafts, and explicit integration checks preserve conflicting human edits.
• Run pinned Claude ACP, Gemini ACP and Codex app-server workers inside the supported Docker execution boundary, with shared approvals and durable invocation records.
• Delegate bounded analysis to authenticated A2A peers, or expose explicitly admitted analysis assignments through one-use inbound grants. Named Hermes and OpenClaw interoperability is verified for the documented plugin transports; their remote execution environments remain outside those proofs.
• Inspect native, harness and peer workers together in the Salaam TUI and reconnect to saved work without blindly replaying uncertain requests.

Install or upgrade

Requires Node.js 26.7.0 and npm 11.19.0:

npm install --global @superjackfruitlabs/salaam@0.0.2 --ignore-scripts
salaam --version
sal --help

Stop the daemon and back up its state before upgrading: state migrations are forward-only. See the upgrade guide, specialist teams, external harnesses and A2A peers.

The release workflow verifies the same bundled CLI tarball on macOS and Linux, including empty-cache offline installation, pinned Pi readiness, an offline turn and restart deduplication. Assets include checksums, source revision metadata, the installer and build provenance. Live provider credentials and external runtimes require separate operator configuration.

Salaam 0.0.1

Salaam's first release brings persistent coding sessions to the terminal, SSH, and ACP editors.

• Reconnect to the same session with durable prompt dispatch and recovery across daemon and worker restarts.
• Use the Salaam Night and Paper TUI, with the salaam and sal commands.
• Review operation-bound approvals and inspect task checkpoints, verification receipts, bounded progression, jobs, and recurring schedules.
• Install the bundled CLI package with pinned production dependencies. Release assets include checksums, source revision metadata, a verified installer, and a GitHub build attestation.

Install

Requires Node.js 26.7.0 and npm 11.19.0.

npm install --global @superjackfruitlabs/salaam@0.0.1 --ignore-scripts
salaam --version
sal --help

Start with the installation guide and quickstart. See salaam.sh for an overview.

The same release tarball is tested on Linux and macOS, including an offline Pi turn and recovery of the same attempt after a daemon restart. The release workflow also runs the full service acceptance suite and Linux Docker execution proofs. These are fixture-based checks; configure your provider separately.