@metaphi-ai/hum 0.1.7 → 0.1.9

package/bin/hum.js

@@ -2,7 +2,8 @@
 // `hum` from npm: the Ink front-end, which starts Hum's engine (Python, installed by postinstall
 // via uv) and talks to it over localhost. Everything the person sees is here; everything the
 // session records is in the engine.
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import path from 'node:path';
 const here = path.dirname(fileURLToPath(import.meta.url));
-await import(path.join(here, '..', 'dist', 'cli.mjs'));
+// a URL, not a path: on Windows `C:\…` is not something the ESM loader will import
+await import(pathToFileURL(path.join(here, '..', 'dist', 'cli.mjs')).href);

package/dist/cli.mjs

@@ -83738,7 +83738,7 @@ var COMMANDS = [
   { name: "/compact", desc: "summarise and restart the context now" },
   { name: "/model", desc: "switch the model for this session (/model <name>)" },
   { name: "/cost", desc: "tokens and cost so far" },
-  { name: "/approve", desc: "approvals on|off \u2014 whether changes and commands wait for you first" },
+  { name: "/approve", desc: "approvals on|off \u2014 whether every change and command waits for you first (leaving the sandbox always asks)" },
   { name: "/continue", desc: "after a pause: let the agent carry on" },
   { name: "/image", desc: "attach an image file to your next message (/image <path>); ctrl+v pastes a screenshot" },
   { name: "/tools", desc: "what is mounted" },
@@ -83747,7 +83747,7 @@ var COMMANDS = [
   { name: "/quit", desc: "leave; the session keeps running (hum brings you back)" },
   { name: "/stop", desc: "end this session's engine (the record is saved)" }
 ];
-var HELP = "!cmd runs a command as you \xB7 esc interrupts the model (what it had is kept) \xB7 type while it works to steer \xB7 edit files in your editor any time (recorded as your turn) \xB7 ctrl+o shows the full output of the last tool result \xB7 ctrl+v pastes a screenshot from the clipboard \xB7 @path.png or /image <path> attaches an image file \xB7 /approve makes changes and commands wait for you (enter approves, a typed reason rejects) \xB7 /resume picks a past session (a running one attaches) \xB7 /compact restarts the context from a summary \xB7 ctrl+c twice leaves and the session keeps running (`hum` brings you back) \xB7 /stop ends it";
+var HELP = "!cmd runs a command as you \xB7 esc interrupts the model (what it had is kept) \xB7 type while it works to steer \xB7 edit files in your editor any time (recorded as your turn) \xB7 ctrl+o shows the full output of the last tool result \xB7 ctrl+v pastes a screenshot from the clipboard \xB7 @path.png or /image <path> attaches an image file \xB7 commands run in a sandbox (writes in the working directory, no network); leaving it asks you first (enter approves, a typed reason rejects) \xB7 /approve makes every change and command wait for you \xB7 /resume picks a past session (a running one attaches) \xB7 /compact restarts the context from a summary \xB7 ctrl+c twice leaves and the session keeps running (`hum` brings you back) \xB7 /stop ends it";
 var DIFF_TAIL_LINES = 20;
 var OUTPUT_MAX_LINES = 200;
 var ERR_TAIL_LINES = 5;
@@ -83860,7 +83860,7 @@ function App2({ engine: engine2, task, resume, images = [] }) {
         const state = ev.state && ev.state !== "new" && ev.state !== "idle" ? ` \xB7 ${ev.state}` : "";
         append({
           kind: "banner",
-          text: `${ev.model}${ev.user ? ` \xB7 ${ev.user}` : ""} \xB7 ${homeRel(ev.cwd)} \xB7 tools: ${ev.tools.join(", ")}${state}`,
+          text: `${ev.model}${ev.user ? ` \xB7 ${ev.user}` : ""} \xB7 ${homeRel(ev.cwd)} \xB7 tools: ${ev.tools.join(", ")}${ev.sandbox ? ` \xB7 sandbox: ${ev.sandbox}` : ""}${state}`,
           instruction: ev.session ? ev.instruction : null
         });
         preHello.current.forEach((it) => append(it));
@@ -84429,7 +84429,9 @@ function App2({ engine: engine2, task, resume, images = [] }) {
     proposal && /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Box_default, { flexDirection: "column", borderStyle: "round", borderColor: ACCENT, paddingX: 1, marginTop: 1, children: [
       /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { children: [
         /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: ACCENT, bold: true, children: "? " }),
-        "hum wants to ",
+        "hum wants to",
+        proposal.calls.some((c) => c.escape) ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { color: "yellow", children: " leave the sandbox" }) : null,
+        " ",
         /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { dimColor: true, children: "\xB7 enter approves \xB7 type a reason to reject \xB7 esc stops" })
       ] }),
       proposal.content ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { dimColor: true, children: [
@@ -84442,10 +84444,14 @@ function App2({ engine: engine2, task, resume, images = [] }) {
           c.desc,
           c.lines != null ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(Text, { dimColor: true, children: `  (${c.lines} lines)` }) : null
         ] }),
-        c.name === "bash" || c.name === "powershell" ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { color: "cyan", children: [
+        (c.name === "bash" || c.name === "powershell") && c.desc !== `$ ${String(c.args?.command || "")}` ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { color: "cyan", children: [
           "    $ ",
           String(c.args?.command || "").split("\n").join(" \u23CE ").slice(0, 300)
         ] }) : null,
+        c.escape ? /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(Text, { color: "yellow", children: [
+          "    outside the sandbox \u2014 ",
+          String(c.reason || "").slice(0, Math.max(20, width - 32))
+        ] }) : null,
         c.diff ? c.diff.split("\n").slice(0, DIFF_TAIL_LINES).map((l, i) => /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)(
           Text,
           {
@@ -84518,7 +84524,7 @@ import net from "node:net";
 import os4 from "node:os";
 import path2 from "node:path";
 import crypto from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 var runDir = () => path2.join(process.env.HUM_HOME || path2.join(os4.homedir(), ".hum"), "run");
 var readRun = (id) => {
   try {
@@ -84529,73 +84535,144 @@ var readRun = (id) => {
 };
 var EngineError = class extends Error {
 };
-var ENGINE_CANDIDATES = [
-  process.env.HUM_ENGINE,
-  // explicit: a command to run
-  "hum-engine",
-  // uv tool install hum-cli
-  `${process.env.HOME || ""}/.local/bin/hum-engine`
-];
-function spawnEngine(cwd2, { task = null, images = [], resume = null } = {}) {
+var win = process.platform === "win32";
+var exists = (p) => {
+  try {
+    fs3.accessSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+};
+function uvToolDirs() {
+  const dirs = [];
+  if (process.env.UV_TOOL_DIR) dirs.push(process.env.UV_TOOL_DIR);
+  if (win) {
+    for (const base of [process.env.APPDATA, process.env.LOCALAPPDATA]) if (base) dirs.push(path2.join(base, "uv", "tools"));
+  } else dirs.push(path2.join(process.env.XDG_DATA_HOME || path2.join(os4.homedir(), ".local", "share"), "uv", "tools"));
+  if (!dirs.some(exists)) {
+    for (const uv of ["uv", path2.join(os4.homedir(), ".local", "bin", win ? "uv.exe" : "uv")]) {
+      try {
+        const r = spawnSync(uv, ["tool", "dir"], { encoding: "utf8", windowsHide: true });
+        if (r.status === 0 && r.stdout.trim()) {
+          dirs.push(r.stdout.trim());
+          break;
+        }
+      } catch {
+      }
+    }
+  }
+  return dirs;
+}
+function enginePython(dirs = uvToolDirs()) {
+  for (const dir of dirs) for (const name of ["hum-cli", "hum"]) {
+    const py = win ? path2.join(dir, name, "Scripts", "python.exe") : path2.join(dir, name, "bin", "python");
+    if (exists(py)) return py;
+  }
+  return null;
+}
+function engineCandidates(env3 = process.env) {
+  const out = [];
+  if (env3.HUM_ENGINE) {
+    const [bin, ...args2] = env3.HUM_ENGINE.split(" ");
+    out.push({ bin, args: args2, where: "HUM_ENGINE" });
+  }
+  const py = enginePython();
+  if (py) out.push({ bin: py, args: ["-m", "hum.cli", "engine"], where: "the engine's interpreter" });
+  out.push({ bin: "hum-engine", args: [], where: "PATH" });
+  out.push({ bin: path2.join(os4.homedir(), ".local", "bin", win ? "hum-engine.exe" : "hum-engine"), args: [], where: "uv's bin dir" });
+  return out;
+}
+function startFailure(failures) {
+  const refused = failures.find((f) => f.error && f.error.code !== "ENOENT");
+  if (!refused) {
+    return "Hum's engine is not installed. Run:  uv tool install hum-cli   (or set HUM_ENGINE to the command that starts it)";
+  }
+  const what = refused.error.code || refused.error.message;
+  const lines = [
+    `Hum's engine is installed (${refused.bin}) but this machine would not start it: ${what}.`
+  ];
+  if (win) {
+    lines.push("On a managed Windows machine that is usually Device Guard / WDAC refusing an executable it does not know.");
+    lines.push(`To see the policy's own message, run:  "${refused.bin}" --help`);
+    const dir = uvToolDirs()[0];
+    lines.push(`If uv's environment is elsewhere, point Hum at its interpreter:  set HUM_ENGINE=${path2.join(dir || "<uv tool dir>", "hum-cli", "Scripts", "python.exe")} -m hum.cli engine`);
+  } else {
+    lines.push('Set HUM_ENGINE to a command that starts it, e.g.  HUM_ENGINE="python -m hum.cli engine"');
+  }
+  return lines.join("\n");
+}
+function attempt({ bin, args: args2 }, cwd2, { task, images, resume }) {
   return new Promise((resolve, reject) => {
-    const tryNext = (i) => {
-      const cmd = ENGINE_CANDIDATES[i];
-      if (cmd === void 0) {
-        reject(new EngineError(
-          "Hum's engine is not installed. Run:  uv tool install hum-cli   (or set HUM_ENGINE to the command that starts it)"
-        ));
+    const runId = crypto.randomBytes(6).toString("hex");
+    fs3.mkdirSync(runDir(), { recursive: true });
+    const logPath = path2.join(runDir(), `${runId}.log`);
+    const log = fs3.openSync(logPath, "a");
+    const argv = [...args2, "-C", cwd2, "--run-id", runId];
+    if (task) argv.push("--task", task);
+    for (const p of images) argv.push("--image", p);
+    if (resume) argv.push("--resume", resume);
+    let settled = false;
+    const settle = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    let child;
+    try {
+      child = spawn(bin, argv, { stdio: ["ignore", log, log], detached: true, windowsHide: true });
+    } catch (e) {
+      fs3.closeSync(log);
+      reject({ spawn: e });
+      return;
+    }
+    fs3.closeSync(log);
+    let died = false;
+    child.on("error", (e) => settle(() => reject({ spawn: e })));
+    child.on("exit", () => {
+      died = true;
+    });
+    const t0 = Date.now();
+    const poll = () => {
+      if (settled) return;
+      const rec = readRun(runId);
+      if (rec && rec.port) {
+        child.unref();
+        settle(() => resolve(rec));
         return;
       }
-      if (!cmd) {
-        tryNext(i + 1);
+      if (died && !rec) {
+        settle(() => reject({ died: logPath }));
         return;
       }
-      const runId = crypto.randomBytes(6).toString("hex");
-      fs3.mkdirSync(runDir(), { recursive: true });
-      const log = fs3.openSync(path2.join(runDir(), `${runId}.log`), "a");
-      const [bin, ...rest] = cmd.split(" ");
-      const args2 = [...rest, "-C", cwd2, "--run-id", runId];
-      if (task) args2.push("--task", task);
-      for (const p of images) args2.push("--image", p);
-      if (resume) args2.push("--resume", resume);
-      let child;
-      try {
-        child = spawn(bin, args2, { stdio: ["ignore", log, log], detached: true, windowsHide: true });
-      } catch {
-        tryNext(i + 1);
+      if (Date.now() - t0 > 25e3) {
+        settle(() => reject({ timeout: true }));
         return;
       }
-      let failed = false;
-      child.on("error", () => {
-        failed = true;
-        tryNext(i + 1);
-      });
-      child.on("exit", () => {
-        failed = true;
-      });
-      const t0 = Date.now();
-      const poll = () => {
-        const rec = readRun(runId);
-        if (rec && rec.port) {
-          child.unref();
-          resolve(rec);
-          return;
-        }
-        if (failed && !rec) {
-          reject(new EngineError(`the engine did not start (see ${path2.join(runDir(), `${runId}.log`)})`));
-          return;
-        }
-        if (Date.now() - t0 > 25e3) {
-          reject(new EngineError("the engine did not start in time"));
-          return;
-        }
-        setTimeout(poll, 50);
-      };
-      poll();
+      setTimeout(poll, 50);
     };
-    tryNext(0);
+    poll();
   });
 }
+async function spawnEngine(cwd2, { task = null, images = [], resume = null, candidates = engineCandidates() } = {}) {
+  const failures = [];
+  for (const cand of candidates) {
+    if (!cand.bin) continue;
+    try {
+      return await attempt(cand, cwd2, { task, images, resume });
+    } catch (f) {
+      if (f && f.spawn) {
+        failures.push({ ...cand, error: f.spawn });
+        continue;
+      }
+      if (f && f.died) throw new EngineError(`the engine did not start (see ${f.died})`);
+      if (f && f.timeout) throw new EngineError("the engine did not start in time");
+      throw f;
+    }
+  }
+  throw new EngineError(startFailure(failures));
+}
 var Engine = class {
   constructor(port2) {
     this.port = port2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metaphi-ai/hum",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Hum (हम): a self-improving coding agent for your terminal.",
   "license": "UNLICENSED",
   "type": "module",