@persistmemory/cli 0.4.0 → 0.5.0

package/dist/bin.js

@@ -344,7 +344,7 @@ var SignalFired = class extends Error {
 };
 function untilAborted(work, signal) {
   work.catch(() => void 0);
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     if (signal.aborted) {
       reject(new SignalFired());
       return;
@@ -354,7 +354,7 @@ function untilAborted(work, signal) {
     work.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve8(value);
+        resolve9(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -364,14 +364,14 @@ function untilAborted(work, signal) {
   });
 }
 function defaultSleep(ms, signal) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     if (signal?.aborted) {
       reject(new AbortError());
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve8();
+      resolve9();
     }, ms);
     function onAbort() {
       clearTimeout(timer);
@@ -1404,7 +1404,7 @@ function shortDate(iso) {
 }
 
 // src/help.ts
-var VERSION = true ? "0.4.0" : versionFromManifest();
+var VERSION = true ? "0.5.0" : versionFromManifest();
 var PACKAGE = "@persistmemory/cli";
 var HELP = `
   pm \u2014 PersistMemory from your terminal
@@ -1446,14 +1446,24 @@ var HELP = `
     remember -                       capture whatever is piped in
     remember --file <path>           capture a file's contents
 
-    agent                            answer file requests from this machine.
-                                     Reads ~/Desktop, ~/Documents and
-                                     ~/Downloads by default, and nothing
-                                     outside them. It stays in the foreground.
-                                     Background it, and stop it later, with:
+    agent                            answer file and command requests from this
+                                     machine. Reads the folders in your home
+                                     directory \u2014 never anything hidden \u2014 and
+                                     nothing outside them. It says which ones
+                                     when it starts. Stays in the foreground;
+                                     background it and stop it later with:
                                        nohup pm agent > ~/agent.log 2>&1 &
                                        pkill -f "pm agent"
-    agent --root <dir> [--root ...]  choose the folders yourself instead
+    agent --root <dir> [--root ...]  choose the folders for this run
+
+    Settings live in ~/.persistmemory/agent.json, and apply every time:
+
+      {
+        "roots": ["~/code", "~/Documents"],
+        "mode":  "ask",          ask | auto-read | plan
+        "allow": ["swift"],      programs this machine treats as reads
+        "deny":  ["rm"]          programs it refuses, whatever is approved
+      }
 
     search <query>                   search your memory
     list memories                    the most recent memories
@@ -1612,8 +1622,8 @@ async function startLoopback(options = {}) {
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   let resolveCallback;
   let rejectCallback;
-  const received = new Promise((resolve8, reject) => {
-    resolveCallback = resolve8;
+  const received = new Promise((resolve9, reject) => {
+    resolveCallback = resolve9;
     rejectCallback = reject;
   });
   const server = createServer((request, response) => {
@@ -1649,9 +1659,9 @@ async function startLoopback(options = {}) {
     response.end(donePage(callback));
     resolveCallback?.(callback);
   });
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve8);
+    server.listen(0, "127.0.0.1", resolve9);
   });
   const address = server.address();
   if (address === null || typeof address === "string") {
@@ -1915,7 +1925,7 @@ function safeEqual(a, b) {
 }
 async function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     const child = spawn(command, args, {
       stdio: "ignore",
       // Detached so closing the terminal does not close the browser, and so
@@ -1924,7 +1934,7 @@ async function openBrowser(url) {
     });
     child.once("error", reject);
     child.unref();
-    resolve8();
+    resolve9();
   });
 }
 async function describe(response) {
@@ -1986,16 +1996,16 @@ async function currentCredential(resolved, deps) {
 // src/context.ts
 import { createInterface } from "node:readline";
 async function askOnTty(prompt, input = process.stdin, output = process.stdout) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const readline = createInterface({ input, output });
     let answered = false;
     readline.question(prompt, (answer3) => {
       answered = true;
-      resolve8(answer3.trim());
+      resolve9(answer3.trim());
       readline.close();
     });
     readline.once("close", () => {
-      if (!answered) resolve8("");
+      if (!answered) resolve9("");
     });
   });
 }
@@ -2005,16 +2015,16 @@ var BACKSPACE = "\b";
 async function readSecretFromTty(prompt) {
   const input = process.stdin;
   if (!input.isTTY) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const readline = createInterface({ input });
       let answered = false;
       readline.once("line", (line) => {
         answered = true;
-        resolve8(line.trim());
+        resolve9(line.trim());
         readline.close();
       });
       readline.once("close", () => {
-        if (!answered) resolve8("");
+        if (!answered) resolve9("");
       });
     });
   }
@@ -2023,14 +2033,14 @@ async function readSecretFromTty(prompt) {
   input.setRawMode?.(true);
   input.resume();
   input.setEncoding("utf8");
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let value = "";
     const finish2 = () => {
       input.removeListener("data", onData);
       input.setRawMode?.(previouslyRaw);
       input.pause();
       process.stdout.write("\n");
-      resolve8(value.trim());
+      resolve9(value.trim());
     };
     const onData = (chunk) => {
       for (const character of chunk) {
@@ -2066,9 +2076,9 @@ async function readStdin() {
 
 // src/commands/agent.ts
 import { hostname } from "node:os";
-import { homedir as homedir2 } from "node:os";
-import { basename, join as join4, resolve as resolve3 } from "node:path";
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { basename, join as join6, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
 
 // src/files.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -2176,6 +2186,335 @@ ${head.join("\n")}`;
   ].join("\n");
 }
 
+// src/commands/run-command.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join4, resolve as resolvePath } from "node:path";
+var CLASSES = new Map([
+  // Reads. Report on the filesystem and change nothing.
+  ...[
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "wc",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "find",
+    "grep",
+    "rg",
+    "fd",
+    "tree",
+    "pwd",
+    "date",
+    "uname",
+    "which",
+    "echo",
+    "sort",
+    "uniq",
+    "diff",
+    "basename",
+    "dirname",
+    "realpath",
+    "ps",
+    "env"
+  ].map((name) => [name, "read"]),
+  // Writes. Recoverable or not, they change the machine.
+  ...[
+    "rm",
+    "mv",
+    "cp",
+    "mkdir",
+    "rmdir",
+    "touch",
+    "chmod",
+    "chown",
+    "ln",
+    "tee",
+    "truncate",
+    "dd",
+    "kill",
+    "killall",
+    "make",
+    "cargo",
+    "swift",
+    "xcodebuild",
+    "gradle",
+    "docker",
+    "brew",
+    "apt",
+    "yum"
+  ].map((name) => [name, "write"]),
+  // A way out. See the trifecta note above.
+  ...["curl", "wget", "nc", "ncat", "telnet", "ssh", "scp", "rsync", "ftp", "http", "httpie"].map((name) => [name, "network"]),
+  // Every command at once, wearing one name.
+  ...["sh", "bash", "zsh", "fish", "python", "python3", "node", "ruby", "perl", "osascript", "eval"].map((name) => [name, "interpreter"])
+]);
+var SUBCOMMAND_READS = /* @__PURE__ */ new Map([
+  [
+    "git",
+    /* @__PURE__ */ new Set([
+      "status",
+      "log",
+      "diff",
+      "show",
+      "branch",
+      "remote",
+      "describe",
+      "blame",
+      "shortlog",
+      "ls-files",
+      "rev-parse",
+      "config"
+    ])
+  ],
+  ["npm", /* @__PURE__ */ new Set(["ls", "list", "view", "outdated", "why", "config"])],
+  ["yarn", /* @__PURE__ */ new Set(["list", "why", "info", "config"])],
+  ["docker", /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect"])]
+]);
+var MAX_OUTPUT_BYTES = 256 * 1024;
+var TIMEOUT_MS = 2e4;
+function describe2(argv) {
+  return argv.join(" ");
+}
+function programOf(argv) {
+  const first = argv[0] ?? "";
+  return first.split("/").pop() ?? first;
+}
+function classify(argv, policy) {
+  const program = programOf(argv);
+  if (policy.allow.includes(program)) return "read";
+  const reads = SUBCOMMAND_READS.get(program);
+  if (reads) {
+    const sub = argv.slice(1).find((one) => !one.startsWith("-"));
+    return sub && reads.has(sub) ? "read" : "write";
+  }
+  return CLASSES.get(program) ?? "unknown";
+}
+function judge(argv, policy) {
+  const program = programOf(argv);
+  if (!argv[0]) {
+    return { commandClass: "unknown", automatic: false, refusal: "No command was given.", reason: "empty" };
+  }
+  if (policy.deny.includes(program)) {
+    return {
+      commandClass: "unknown",
+      automatic: false,
+      refusal: `This machine refuses "${program}".`,
+      reason: "on this machine's deny list"
+    };
+  }
+  const commandClass = classify(argv, policy);
+  if (commandClass === "network") {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `"${program}" can reach the network. This machine will not run it, and no approval enables it: a command that reads private files and can also send them is the one combination nobody can review by looking at it.`,
+      reason: "reads private data and has a way out"
+    };
+  }
+  if (commandClass === "interpreter") {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `"${program}" runs a language, which is every command at once. Ask for the specific command instead.`,
+      reason: "an interpreter is not one command"
+    };
+  }
+  const outside = pathOutsideRoots(argv, policy.roots);
+  if (outside) {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `${outside} is outside the folders this machine may read.`,
+      reason: "outside the roots"
+    };
+  }
+  if (policy.mode === "plan") {
+    return {
+      commandClass,
+      automatic: false,
+      reason: "this machine is in plan mode and runs nothing"
+    };
+  }
+  return {
+    commandClass,
+    automatic: policy.mode === "auto-read" && commandClass === "read",
+    reason: commandClass === "read" ? "reads and changes nothing" : commandClass === "write" ? "changes this machine" : "not a command this machine recognises"
+  };
+}
+function pathOutsideRoots(argv, roots) {
+  for (const argument of argv.slice(1)) {
+    if (argument.startsWith("-")) continue;
+    if (!argument.startsWith("/") && !argument.startsWith("~") && !argument.startsWith(".") && !argument.includes("/")) {
+      continue;
+    }
+    const resolved = expand(argument, roots[0] ?? process.cwd());
+    if (!roots.some((root) => resolved === root || resolved.startsWith(`${root}/`))) {
+      return argument;
+    }
+  }
+  return void 0;
+}
+function expand(argument, base) {
+  const home = process.env["HOME"] ?? "";
+  const withHome = argument.startsWith("~") ? join4(home, argument.slice(1)) : argument;
+  return isAbsolute2(withHome) ? resolvePath(withHome) : resolvePath(base, withHome);
+}
+async function runCommand(argv, policy) {
+  const verdict = judge(argv, policy);
+  if (verdict.refusal) return { ok: false, text: verdict.refusal };
+  if (policy.mode === "plan") {
+    return { ok: false, text: `Plan mode: this machine did not run \`${describe2(argv)}\`.` };
+  }
+  const cwd = policy.roots[0];
+  if (!cwd) return { ok: false, text: "This machine has no folders it may read." };
+  try {
+    if (!statSync2(cwd).isDirectory()) return { ok: false, text: `${cwd} is not a folder.` };
+  } catch {
+    return { ok: false, text: `${cwd} does not exist.` };
+  }
+  return new Promise((resolve9) => {
+    const child = spawn2(argv[0], argv.slice(1), {
+      cwd,
+      // NO shell. With one, every character a model can produce is a character
+      // the shell can act on, and the argument list stops meaning anything.
+      shell: false,
+      /*
+              A bare environment.
+      
+              This process holds the credential that authorises the machine, and
+              handing it to a subprocess a model chose would mean `env` — or anything
+              that prints its environment — returning that key.
+            */
+      env: {
+        PATH: process.env["PATH"] ?? "/usr/bin:/bin",
+        HOME: process.env["HOME"] ?? "",
+        LANG: process.env["LANG"] ?? "C"
+      }
+    });
+    let output = "";
+    let truncated = false;
+    const collect = (chunk) => {
+      if (truncated) return;
+      output += chunk.toString("utf8");
+      if (output.length > MAX_OUTPUT_BYTES) {
+        output = output.slice(0, MAX_OUTPUT_BYTES);
+        truncated = true;
+        child.kill("SIGKILL");
+      }
+    };
+    child.stdout.on("data", collect);
+    child.stderr.on("data", collect);
+    const timer = setTimeout(() => child.kill("SIGKILL"), TIMEOUT_MS);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve9({ ok: false, text: `Could not run it: ${error.message}` });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      const notes = [
+        truncated ? `
+
+[output cut off at ${MAX_OUTPUT_BYTES} bytes]` : "",
+        code !== 0 && code !== null ? `
+
+[exit code ${code}]` : ""
+      ].join("");
+      resolve9({ ok: code === 0, text: `$ ${describe2(argv)}
+
+${output}${notes}` });
+    });
+  });
+}
+
+// src/commands/agent-config.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync, statSync as statSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join5, resolve as resolve3 } from "node:path";
+var NOT_MATERIAL = /* @__PURE__ */ new Set([
+  "Library",
+  "Applications",
+  "System",
+  "Public",
+  "node_modules",
+  "go",
+  "Parallels",
+  "VirtualBox VMs"
+]);
+function discoverRoots(home = homedir2(), list = (path) => {
+  try {
+    return readdirSync(path);
+  } catch {
+    return [];
+  }
+}, isDirectory = (path) => {
+  try {
+    return statSync3(path).isDirectory();
+  } catch {
+    return false;
+  }
+}) {
+  return list(home).filter((name) => !name.startsWith(".")).filter((name) => !NOT_MATERIAL.has(name)).map((name) => join5(home, name)).filter(isDirectory).sort();
+}
+function expandHome(path, home = homedir2()) {
+  return path.startsWith("~") ? resolve3(home, path.slice(1).replace(/^[/\\]/, "")) : resolve3(path);
+}
+var MODES = /* @__PURE__ */ new Set(["ask", "auto-read", "plan"]);
+function readAgentConfig(path, read2 = (at) => readFileSync5(at, "utf8"), exists = (at) => existsSync5(at), home = homedir2()) {
+  if (!exists(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(read2(path));
+  } catch (error) {
+    return { error: `${path} is not valid JSON: ${error instanceof Error ? error.message : ""}` };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { error: `${path} should hold an object, like {"roots": ["~/code"]}.` };
+  }
+  const held = parsed;
+  const config = {};
+  if (held["roots"] !== void 0) {
+    if (!Array.isArray(held["roots"]) || held["roots"].some((one) => typeof one !== "string")) {
+      return { error: `${path}: "roots" should be a list of folders.` };
+    }
+    config.roots = held["roots"].map((one) => expandHome(one, home));
+  }
+  if (held["mode"] !== void 0) {
+    if (typeof held["mode"] !== "string" || !MODES.has(held["mode"])) {
+      return { error: `${path}: "mode" should be "ask", "auto-read" or "plan".` };
+    }
+    config.mode = held["mode"];
+  }
+  for (const key of ["allow", "deny"]) {
+    if (held[key] === void 0) continue;
+    if (!Array.isArray(held[key]) || held[key].some((one) => typeof one !== "string")) {
+      return { error: `${path}: "${key}" should be a list of program names.` };
+    }
+    config[key] = held[key];
+  }
+  return { config };
+}
+function resolveAgentConfig(args) {
+  const roots = args.flagRoots && args.flagRoots.length > 0 ? args.flagRoots : args.stored?.roots && args.stored.roots.length > 0 ? args.stored.roots : args.discovered ?? [];
+  return {
+    roots,
+    /*
+          `ask` unless the owner said otherwise.
+    
+          The mode decides how much happens with nobody watching, so the default
+          is the one that does least. `auto-read` is a reasonable thing to choose
+          and an unreasonable thing to be given.
+        */
+    mode: args.stored?.mode ?? "ask",
+    allow: args.stored?.allow ?? [],
+    deny: args.stored?.deny ?? [],
+    source: args.flagRoots && args.flagRoots.length > 0 ? "flags" : args.stored?.roots && args.stored.roots.length > 0 ? "config" : "discovered"
+  };
+}
+
 // src/commands/agent.ts
 async function said(response, fallback) {
   const body = await response.json().catch(() => void 0);
@@ -2183,7 +2522,7 @@ async function said(response, fallback) {
   return message2 ?? `${fallback} (${response.status})`;
 }
 function locate(roots, requested) {
-  const expanded = requested.startsWith("~") ? resolve3(homedir2(), requested.slice(1).replace(/^[/\\]/, "")) : requested;
+  const expanded = requested.startsWith("~") ? resolve4(homedir3(), requested.slice(1).replace(/^[/\\]/, "")) : requested;
   if (!expanded.includes("/") && !expanded.includes("\\")) {
     const wanted2 = expanded.trim().toLowerCase();
     const named = roots.find((root) => basename(root).toLowerCase() === wanted2);
@@ -2199,18 +2538,38 @@ function locate(roots, requested) {
   throw new Error(`${requested} is not inside any allowed folder (${roots.join(", ")})`);
 }
 function uncontested(target) {
-  if (!existsSync4(target)) return target;
+  if (!existsSync6(target)) return target;
   const dot = target.lastIndexOf(".");
   const stem = dot > target.lastIndexOf("/") && dot !== -1 ? target.slice(0, dot) : target;
   const extension = stem === target ? "" : target.slice(dot);
   for (let n = 1; n < 1e3; n += 1) {
     const candidate = `${stem} (${n})${extension}`;
-    if (!existsSync4(candidate)) return candidate;
+    if (!existsSync6(candidate)) return candidate;
   }
   throw new Error(`${target} and a thousand names beside it are taken.`);
 }
-async function answer(context, apiUrl, token, roots, request) {
+async function answer(context, apiUrl, token, settings, request) {
+  const roots = settings.roots;
   let located;
+  if (request.kind === "run_command") {
+    if (!request.argv || request.argv.length === 0) {
+      return { ok: false, error: "No command was given." };
+    }
+    const policy = {
+      mode: settings.mode,
+      allow: settings.allow,
+      deny: settings.deny,
+      roots
+    };
+    const outcome = await runCommand(request.argv, policy);
+    if (!outcome.ok) return { ok: false, error: outcome.text };
+    return upload(
+      apiUrl,
+      token,
+      `${(request.argv[0] ?? "output").split("/").pop()}.txt`,
+      Buffer.from(outcome.text, "utf8")
+    );
+  }
   try {
     located = locate(roots, request.path);
   } catch (error) {
@@ -2231,10 +2590,10 @@ async function answer(context, apiUrl, token, roots, request) {
     }
     try {
       let target = located;
-      if (existsSync4(located) && statSync2(located).isDirectory()) {
+      if (existsSync6(located) && statSync4(located).isDirectory()) {
         const disposition = fetched.headers.get("content-disposition") ?? "";
         const named = /filename="([^"]+)"/.exec(disposition)?.[1];
-        target = join4(located, basename(named ?? "file"));
+        target = join6(located, basename(named ?? "file"));
       }
       target = uncontested(target);
       writeFileSync4(target, downloaded, { flag: "wx" });
@@ -2257,12 +2616,12 @@ ${downloaded.length} bytes
   let filename = request.path.split("/").pop() ?? "file";
   if (request.kind === "list_dir") {
     try {
-      const stats = statSync2(located);
+      const stats = statSync4(located);
       if (!stats.isDirectory()) return { ok: false, error: `${request.path} is not a folder.` };
-      const entries = readdirSync(located, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".")).slice(0, MAX_LISTED).map((entry) => {
+      const entries = readdirSync2(located, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".")).slice(0, MAX_LISTED).map((entry) => {
         if (entry.isDirectory()) return `${entry.name}/`;
         try {
-          return `${entry.name}  ${sizeOf(join4(located, entry.name))}`;
+          return `${entry.name}  ${sizeOf(join6(located, entry.name))}`;
         } catch {
           return entry.name;
         }
@@ -2280,9 +2639,9 @@ ${listing}
     }
   }
   try {
-    const stats = statSync2(located);
+    const stats = statSync4(located);
     if (!stats.isFile()) return { ok: false, error: `${request.path} is not a file.` };
-    bytes = readFileSync4(located);
+    bytes = readFileSync6(located);
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.message : "could not read it" };
   }
@@ -2322,18 +2681,9 @@ async function upload(apiUrl, token, filename, bytes) {
   if (!stored.attachToken) return { ok: false, error: "the upload returned no reference" };
   return { ok: true, attachToken: stored.attachToken, bytes: bytes.length };
 }
-function defaultRoots(home = homedir2(), isDirectory = (path) => {
-  try {
-    return statSync2(path).isDirectory();
-  } catch {
-    return false;
-  }
-}) {
-  return ["Desktop", "Documents", "Downloads"].map((name) => join4(home, name)).filter(isDirectory);
-}
 var MAX_LISTED = 200;
 function sizeOf(path) {
-  const size = statSync2(path).size;
+  const size = statSync4(path).size;
   if (size < 1024) return `${size} B`;
   if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
   return `${(size / (1024 * 1024)).toFixed(1)} MB`;
@@ -2345,26 +2695,41 @@ async function agentCommand(context) {
     return 1;
   }
   const roots = (listFlag(context.args, "root") ?? []).map(
-    (one) => resolve3(one.startsWith("~") ? resolve3(homedir2(), one.slice(1).replace(/^[/\\]/, "")) : one)
+    (one) => resolve4(one.startsWith("~") ? resolve4(homedir3(), one.slice(1).replace(/^[/\\]/, "")) : one)
   );
-  if (roots.length === 0) {
-    const usual = defaultRoots();
-    if (usual.length === 0) {
-      context.error(
-        "This machine has no Desktop, Documents or Downloads folder, so there is nothing to offer by default. Say which folders it may read from:"
-      );
-      context.error("");
-      context.error("  pm agent --root ~/projects");
-      return 1;
-    }
-    roots.push(...usual);
-    context.print(
-      `Reading from ${usual.map((path) => path.replace(homedir2(), "~")).join(", ")} \u2014 nothing outside them. Use --root to choose your own.`
+  const configPath = join6(context.paths.dir, "agent.json");
+  const stored = readAgentConfig(configPath);
+  if (stored.error) {
+    context.error(stored.error);
+    return 1;
+  }
+  const settings = resolveAgentConfig({
+    flagRoots: roots,
+    ...stored.config ? { stored: stored.config } : {},
+    discovered: discoverRoots()
+  });
+  if (settings.roots.length === 0) {
+    context.error(
+      "There is nothing in your home directory this machine would offer, so say which folders it may read from:"
     );
+    context.error("");
+    context.error("  pm agent --root ~/projects");
+    context.error("");
+    context.error(`Or write them once in ${configPath}:`);
+    context.error("");
+    context.error('  { "roots": ["~/projects"], "mode": "ask" }');
+    return 1;
   }
+  roots.length = 0;
+  roots.push(...settings.roots);
+  const shown = settings.roots.map((path) => path.replace(homedir3(), "~"));
+  const where = settings.source === "flags" ? "" : settings.source === "config" ? ` (from ${configPath})` : " (found in your home directory)";
+  context.print(
+    `Reading ${shown.join(", ")} \u2014 nothing outside them${where}. Mode: ${settings.mode}.`
+  );
   for (const root of roots) {
     try {
-      if (!statSync2(root).isDirectory()) {
+      if (!statSync4(root).isDirectory()) {
         context.error(`${root} is not a folder.`);
         return 1;
       }
@@ -2438,7 +2803,7 @@ async function agentCommand(context) {
         const { items } = await claimed.json();
         for (const request of items) {
           context.print(`Reading ${request.path}`);
-          const outcome = await answer(context, apiUrl, await authorization(), roots, request);
+          const outcome = await answer(context, apiUrl, await authorization(), settings, request);
           const done = await call(
             `complete/${encodeURIComponent(request.id)}`,
             outcome.ok ? { result: { attachToken: outcome.attachToken } } : { error: outcome.error }
@@ -2460,8 +2825,8 @@ async function agentCommand(context) {
 
 // src/commands/google.ts
 import { writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename2, resolve as resolve4 } from "node:path";
-import { readFileSync as readFileSync5 } from "node:fs";
+import { basename as basename2, resolve as resolve5 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
 async function callApi(context, path, init = {}) {
   const credential = context.resolved.credential;
   if (!credential) {
@@ -2526,7 +2891,7 @@ async function driveGet(context, fileId) {
   const disposition = response.headers.get("content-disposition") ?? "";
   const named = /filename="([^"]+)"/.exec(disposition)?.[1];
   const out = stringFlag(context.args, "out");
-  const target = resolve4(out ?? basename2(named ?? fileId));
+  const target = resolve5(out ?? basename2(named ?? fileId));
   writeFileSync5(target, Buffer.from(await response.arrayBuffer()));
   context.print(target);
   return 0;
@@ -2538,7 +2903,7 @@ async function drivePut(context, path) {
   }
   let bytes;
   try {
-    bytes = readFileSync5(resolve4(path));
+    bytes = readFileSync7(resolve5(path));
   } catch {
     context.error(`Cannot read ${path}.`);
     return 1;
@@ -2622,8 +2987,8 @@ async function mailCommand(context) {
 }
 
 // src/commands/requests.ts
-import { existsSync as existsSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
 async function requestsCommand(context) {
   if (context.args.words[1] === "get") return collectCommand(context);
   const credential = context.resolved.credential;
@@ -2691,8 +3056,8 @@ async function collectCommand(context) {
     return 1;
   }
   const name = stringFlag(context.args, "output", "o") ?? filename;
-  const target = resolve5(name);
-  if (existsSync5(target)) {
+  const target = resolve6(name);
+  if (existsSync7(target)) {
     context.error(`${target} already exists. Pass --output to write somewhere else.`);
     return 1;
   }
@@ -2702,14 +3067,14 @@ async function collectCommand(context) {
 }
 
 // src/workspace.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname3, join as join5, resolve as resolvePath } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname3, join as join7, resolve as resolvePath2 } from "node:path";
 var WORKSPACE_FILE = ".persistmemory.json";
 function findWorkspace(from = process.cwd()) {
-  let dir = resolvePath(from);
+  let dir = resolvePath2(from);
   for (; ; ) {
-    const file = join5(dir, WORKSPACE_FILE);
-    if (existsSync6(file)) {
+    const file = join7(dir, WORKSPACE_FILE);
+    if (existsSync8(file)) {
       const config = readWorkspace(file);
       if (config) return { file, dir, config };
     }
@@ -2720,7 +3085,7 @@ function findWorkspace(from = process.cwd()) {
 }
 function readWorkspace(file) {
   try {
-    const parsed = JSON.parse(readFileSync6(file, "utf8"));
+    const parsed = JSON.parse(readFileSync8(file, "utf8"));
     const space = parsed.space;
     if (space && typeof space === "object" && typeof space.id === "string" && space.id !== "" && typeof space.name === "string") {
       return { space: { id: space.id, name: space.name } };
@@ -2731,7 +3096,7 @@ function readWorkspace(file) {
   }
 }
 function writeWorkspace(dir, config) {
-  const file = join5(dir, WORKSPACE_FILE);
+  const file = join7(dir, WORKSPACE_FILE);
   writeFileSync7(file, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return file;
@@ -3001,9 +3366,9 @@ function message(error) {
 }
 
 // src/commands/maintain.ts
-import { existsSync as existsSync7, rmSync } from "node:fs";
+import { existsSync as existsSync9, rmSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { dirname as dirname4, resolve as resolve7 } from "node:path";
+import { dirname as dirname4, resolve as resolve8 } from "node:path";
 import { fileURLToPath } from "node:url";
 function installArgs(pkg = PACKAGE) {
   return ["install", "-g", "--prefer-online", `${pkg}@latest`];
@@ -3067,7 +3432,7 @@ Delete the file it runs from: ${processPath()}`
   return 0;
 }
 async function deleteCommand(context) {
-  if (!existsSync7(context.paths.dir)) {
+  if (!existsSync9(context.paths.dir)) {
     context.print(`Nothing to delete: ${context.paths.dir} does not exist.`);
     return 0;
   }
@@ -3096,7 +3461,7 @@ async function deleteCommand(context) {
   return 0;
 }
 function removeEverything(context) {
-  const dir = resolve7(context.paths.dir);
+  const dir = resolve8(context.paths.dir);
   if (dir === "/" || dir.split("/").filter(Boolean).length < 2) {
     context.error(`Refusing to delete ${dir}: that does not look like a data directory.`);
     return;
@@ -3108,7 +3473,7 @@ function installer() {
 }
 function processPath() {
   try {
-    return resolve7(dirname4(fileURLToPath(import.meta.url)));
+    return resolve8(dirname4(fileURLToPath(import.meta.url)));
   } catch {
     return process.argv[1] ?? "";
   }
@@ -3120,12 +3485,12 @@ import { randomUUID } from "node:crypto";
 import { relative as relative2 } from "node:path";
 
 // src/events.ts
-import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "node:fs";
-import { join as join6 } from "node:path";
+import { appendFileSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
 function openSessionLog(paths, id) {
-  const directory = join6(paths.dir, "sessions");
+  const directory = join8(paths.dir, "sessions");
   mkdirSync3(directory, { recursive: true, mode: 448 });
-  const path = join6(directory, `${id}.jsonl`);
+  const path = join8(directory, `${id}.jsonl`);
   return {
     id,
     path,
@@ -3137,8 +3502,8 @@ function openSessionLog(paths, id) {
       }
     },
     read() {
-      if (!existsSync8(path)) return [];
-      return readFileSync7(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+      if (!existsSync10(path)) return [];
+      return readFileSync9(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
         try {
           return [JSON.parse(line)];
         } catch {
@@ -3215,9 +3580,9 @@ async function sessionCommand(context) {
   context.print(`  Ask anything. /help for commands, /exit to leave.
 `);
   const readline = createInterface2({ input: process.stdin, output: process.stdout });
-  const ask = (prompt) => new Promise((resolve8) => {
-    readline.question(prompt, resolve8);
-    readline.once("close", () => resolve8(void 0));
+  const ask = (prompt) => new Promise((resolve9) => {
+    readline.question(prompt, resolve9);
+    readline.once("close", () => resolve9(void 0));
   });
   const root = process.cwd();
   let running = true;
@@ -3401,7 +3766,7 @@ async function write2(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 
 // src/spaces.ts
 async function spacesFor(context, client, env = process.env) {
@@ -3465,7 +3830,7 @@ async function rememberCommand(context) {
   let text;
   if (file) {
     try {
-      text = readFileSync8(file, "utf8");
+      text = readFileSync10(file, "utf8");
     } catch {
       context.error(`Could not read ${file}.`);
       return 1;