@linzumi/cli 0.0.35-beta → 0.0.36-beta

package/README.md

@@ -63,7 +63,7 @@ Install the CLI or run it with `npx`:
 
 ```bash
 npm install -g @linzumi/cli@latest
-npx -y @linzumi/cli@0.0.35-beta --version
+npx -y @linzumi/cli@0.0.36-beta --version
 linzumi --version
 ```
 
@@ -114,7 +114,8 @@ linzumi paths add ~/code/my-app
 ```
 
 The trust list lives at `~/.linzumi/config.json`. The bootstrap agent
-adds `/tmp/hello_linzumi` for you on first run.
+adds `/tmp/hello_linzumi` for you on first run. For `linzumi connect`, the
+selected `--cwd` is also trusted for that runner process.
 
 ## When something looks wrong
 

package/dist/index.js

@@ -9421,7 +9421,7 @@ async function main(args) {
       process.stdout.write(connectGuideText());
       return;
     case "version":
-      process.stdout.write(`linzumi 0.0.35-beta
+      process.stdout.write(`linzumi 0.0.36-beta
 `);
       return;
     case "auth":
@@ -9935,13 +9935,15 @@ async function parseRunnerArgs(args, deps = {
     process.exit(0);
   }
   if (values.get("version") === true) {
-    process.stdout.write(`linzumi 0.0.35-beta
+    process.stdout.write(`linzumi 0.0.36-beta
 `);
     process.exit(0);
   }
   const channelTarget = parseChannelSessionTarget(values);
   const kandanUrl = required(values, "linzumi-url");
   const cwd = stringValue3(values, "cwd") ?? process.cwd();
+  const cwdAllowedCwds = assertConfiguredAllowedCwds([cwd]);
+  const configuredAllowedCwds = values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : readConfiguredAllowedCwds();
   const codexBin = stringValue3(values, "codex-bin") ?? "codex";
   const customCodeServerBin = stringValue3(values, "code-server-bin");
   const explicitToken = stringValue3(values, "token");
@@ -9981,7 +9983,7 @@ async function parseRunnerArgs(args, deps = {
     launchTui: values.get("launch-tui") === true,
     fast: values.get("fast") === true,
     logFile: stringValue3(values, "log-file"),
-    allowedCwds: values.has("allowed-cwd") ? assertConfiguredAllowedCwds(parseAllowedCwdList(stringValue3(values, "allowed-cwd"))) : readConfiguredAllowedCwds(),
+    allowedCwds: Array.from(new Set([...cwdAllowedCwds, ...configuredAllowedCwds])),
     allowedForwardPorts: parseAllowedPortList(stringValue3(values, "forward-port")),
     codeServerBin: editorRuntime.codeServerBin,
     editorRuntime: editorRuntime.runtime,
@@ -10221,7 +10223,7 @@ Codex:
   --stream-flush-ms <ms>      Batch live Codex deltas before Linzumi persistence, default 150
   --fast                      Mark this runner as low-latency/fast in the availability message
   --log-file <path>           JSONL event log path, default <cwd>/.linzumi-runner.log
-  --allowed-cwd <paths>       Comma-separated roots where Linzumi may start new local Codex sessions
+  --allowed-cwd <paths>       Extra comma-separated roots where Linzumi may start local Codex sessions
   --forward-port <ports>      Comma-separated local TCP ports Linzumi may expose as authenticated previews
   --code-server-bin <path>    Custom development code-server executable. The default editor runtime is downloaded from Linzumi.
 
@@ -10318,8 +10320,9 @@ Usage:
   linzumi paths add <path>
   linzumi paths remove <path>
 
-Trusted paths are stored in ~/.linzumi/config.json. linzumi connect uses them
-unless --allowed-cwd is passed for that runner process.
+Trusted paths are stored in ~/.linzumi/config.json. linzumi connect always
+trusts its selected cwd for that runner process and also uses configured paths
+unless --allowed-cwd is passed with explicit extra roots.
 `;
 }
 function startHelpText() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "0.0.35-beta",
+  "version": "0.0.36-beta",
   "description": "Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.",
   "type": "module",
   "bin": {