@xingjisoft/neutrino 0.1.4 → 0.1.5

package/dist/llm/risk.js

@@ -0,0 +1,377 @@
+/**
+ * Tool-call risk assessment.
+ *
+ * The agent may run shell commands and touch files. Everything it does is
+ * classified here before it happens, so the caller can decide whether the user
+ * has to approve it:
+ *
+ *   - `high`    — commands that can escalate privileges, install software,
+ *                 rewrite history, talk to the network, or touch anything
+ *                 outside the working directory.
+ *   - `extreme` — delete-class commands: they destroy data with no undo.
+ *
+ * Everything else returns `null` and runs unsupervised.
+ */
+import os from "node:os";
+import path from "node:path";
+/** Wrappers that merely delegate to the command that follows them. */
+const WRAPPERS = new Set([
+    "sudo",
+    "doas",
+    "runas",
+    "pkexec",
+    "command",
+    "builtin",
+    "exec",
+    "nohup",
+    "time",
+    "nice",
+    "ionice",
+    "stdbuf",
+    "xargs",
+    "env",
+    "watch",
+    "timeout",
+    "strace",
+    "ltrace",
+    "busybox",
+]);
+/** Head commands that destroy data. */
+const DELETION_HEADS = new Map([
+    ["rm", "deletes files or directories (rm)"],
+    ["rmdir", "removes directories (rmdir)"],
+    ["del", "deletes files (del)"],
+    ["erase", "deletes files (erase)"],
+    ["rd", "removes directories (rd)"],
+    ["shred", "overwrites and deletes files (shred)"],
+    ["wipe", "destroys data (wipe)"],
+    ["unlink", "removes a file (unlink)"],
+    ["mkfs", "formats a filesystem (mkfs)"],
+    ["format", "formats a disk (format)"],
+    ["fdisk", "repartitions a disk (fdisk)"],
+    ["diskpart", "repartitions a disk (diskpart)"],
+    ["srm", "securely deletes files (srm)"],
+    ["remove-item", "deletes files or directories (Remove-Item)"],
+    ["clear-content", "empties a file (Clear-Content)"],
+]);
+/** Head commands that need a human (or a reviewer) to look at them. */
+const HIGH_RISK_HEADS = new Map([
+    ["sudo", "escalates privileges (sudo)"],
+    ["su", "switches user (su)"],
+    ["doas", "escalates privileges (doas)"],
+    ["runas", "escalates privileges (runas)"],
+    ["pkexec", "escalates privileges (pkexec)"],
+    ["visudo", "edits the sudoers policy (visudo)"],
+    ["chmod", "changes file permissions (chmod)"],
+    ["chown", "changes file ownership (chown)"],
+    ["chgrp", "changes file group (chgrp)"],
+    ["setcap", "changes process capabilities (setcap)"],
+    ["systemctl", "controls system services (systemctl)"],
+    ["service", "controls system services (service)"],
+    ["launchctl", "controls system services (launchctl)"],
+    ["sc", "controls system services (sc)"],
+    ["reg", "edits the Windows registry (reg)"],
+    ["shutdown", "shuts the machine down (shutdown)"],
+    ["reboot", "reboots the machine (reboot)"],
+    ["poweroff", "powers the machine off (poweroff)"],
+    ["halt", "halts the machine (halt)"],
+    ["kill", "kills a process (kill)"],
+    ["pkill", "kills processes by name (pkill)"],
+    ["killall", "kills processes by name (killall)"],
+    ["taskkill", "kills processes (taskkill)"],
+    ["apt", "installs or removes system packages (apt)"],
+    ["apt-get", "installs or removes system packages (apt-get)"],
+    ["yum", "installs or removes system packages (yum)"],
+    ["dnf", "installs or removes system packages (dnf)"],
+    ["pacman", "installs or removes system packages (pacman)"],
+    ["apk", "installs or removes system packages (apk)"],
+    ["brew", "installs or removes system packages (brew)"],
+    ["snap", "installs or removes system packages (snap)"],
+    ["pip", "installs Python packages (pip)"],
+    ["pip3", "installs Python packages (pip3)"],
+    ["conda", "changes the Python environment (conda)"],
+    ["gem", "installs Ruby packages (gem)"],
+    ["npm", "changes Node packages (npm)"],
+    ["pnpm", "changes Node packages (pnpm)"],
+    ["yarn", "changes Node packages (yarn)"],
+    ["cargo", "changes Rust packages (cargo)"],
+    ["dotnet", "changes .NET packages (dotnet)"],
+    ["docker", "controls containers (docker)"],
+    ["podman", "controls containers (podman)"],
+    ["kubectl", "controls a cluster (kubectl)"],
+    ["helm", "controls a cluster (helm)"],
+    ["terraform", "changes infrastructure (terraform)"],
+    ["ansible", "changes remote machines (ansible)"],
+    ["crontab", "edits scheduled jobs (crontab)"],
+    ["schtasks", "edits scheduled jobs (schtasks)"],
+    ["ssh", "opens a remote shell (ssh)"],
+    ["scp", "copies files over the network (scp)"],
+    ["sftp", "transfers files over the network (sftp)"],
+    ["rsync", "mirrors files (rsync)"],
+    ["nc", "opens a raw network connection (nc)"],
+    ["ncat", "opens a raw network connection (ncat)"],
+    ["netcat", "opens a raw network connection (netcat)"],
+    ["telnet", "opens a raw network connection (telnet)"],
+    ["curl", "fetches data from the network (curl)"],
+    ["wget", "fetches data from the network (wget)"],
+    ["eval", "evaluates generated code (eval)"],
+    ["source", "runs another script in this shell (source)"],
+]);
+/**
+ * Subcommands of otherwise risky tools that change nothing: `npm run build`
+ * is routine, `npm install` is not.
+ */
+const SAFE_SUBCOMMANDS = new Map([
+    ["npm", /^(run|run-script|test|t|ls|list|view|info|outdated|audit|config|why|root|prefix|help|--version|-v)$/],
+    ["pnpm", /^(run|test|ls|list|why|audit|help|--version|-v)$/],
+    ["yarn", /^(run|test|ls|list|why|audit|help|--version|-v)$/],
+    ["bun", /^(run|test|--version|-v)$/],
+    ["pip", /^(list|show|freeze|help|--version|-v)$/],
+    ["pip3", /^(list|show|freeze|help|--version|-v)$/],
+    ["gem", /^(list|search|info|help|--version|-v)$/],
+    ["cargo", /^(build|check|test|bench|run|doc|fmt|clippy|tree|metadata|help|--version|-v)$/],
+    ["dotnet", /^(build|test|run|help|--version|-v)$/],
+    ["conda", /^(list|info|help|--version|-v)$/],
+    ["docker", /^(ps|images|logs|inspect|version|info|stats|history)$/],
+    ["podman", /^(ps|images|logs|inspect|version|info)$/],
+    ["kubectl", /^(get|describe|logs|version|top|explain|api-resources|config)$/],
+    ["helm", /^(list|status|version|search|show|template|history)$/],
+    ["terraform", /^(plan|validate|fmt|version|output|show|state\s+list)$/],
+    ["brew", /^(list|info|search|doctor|--version|-v)$/],
+    ["snap", /^(list|info|version|--version|-v)$/],
+]);
+/** Interpreters that only become dangerous with an inline program. */
+const INTERPRETERS = new Set(["node", "python", "python3", "perl", "ruby", "php", "bash", "sh", "zsh", "pwsh", "powershell"]);
+/** File names that carry credentials: touching them is never routine. */
+const SENSITIVE_PATHS = [/(^|[\\/])\.env(\.|$)/i, /(^|[\\/])id_(rsa|dsa|ecdsa|ed25519)(\.|$)/i, /(^|[\\/])\.ssh([\\/]|$)/i, /(^|[\\/])\.git[\\/](config|hooks)([\\/]|$)/i, /(^|[\\/])\.aws[\\/]credentials$/i];
+/** Remove quoted strings so `rg "rm -rf" .` is not mistaken for a deletion. */
+function stripQuoted(command) {
+    return command
+        .replace(/'(?:[^'\\]|\\.)*'/g, '""')
+        .replace(/"(?:[^"\\]|\\.)*"/g, '""');
+}
+/** Last path segment of a token, lowercased, without a `.exe` suffix. */
+function base(token) {
+    const name = token.split(/[\\/]/).pop() ?? token;
+    return name.replace(/\.exe$/i, "").toLowerCase();
+}
+/** Split a command line into the tokens that actually run something. */
+function segments(command) {
+    const out = [];
+    for (const part of stripQuoted(command).replace(/\r?\n/g, ";").split(/&&|\|\||[;|&]/)) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        let i = 0;
+        // Skip `sudo`, `env`, `timeout 5`, `VAR=x` and friends: the real command
+        // hides behind them and is what we care about.
+        while (i < tokens.length) {
+            const head = base(tokens[i]);
+            if (WRAPPERS.has(head)) {
+                i++;
+                // `timeout 5 rm -rf x` — also skip the numeric argument.
+                if (head === "timeout" && i < tokens.length && /^\d/.test(tokens[i]))
+                    i++;
+                continue;
+            }
+            if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) {
+                i++;
+                continue;
+            }
+            break;
+        }
+        if (i < tokens.length)
+            out.push(tokens.slice(i));
+    }
+    return out;
+}
+/** `dd`/`truncate` are only destructive in specific shapes. */
+function conditionalDeletion(head, argv) {
+    const joined = argv.join(" ");
+    if (head === "dd")
+        return /\bof=/.test(joined) ? "overwrites a device or file (dd)" : null;
+    if (head === "truncate")
+        return /(-s\s*0\b|--size[=\s]0\b)/.test(joined) ? "truncates a file to zero bytes (truncate)" : null;
+    if (head === "docker" || head === "podman") {
+        // Only the subcommand counts: `docker run --rm` deletes nothing.
+        const sub = (argv[1] ?? "").toLowerCase();
+        if (sub === "rm" || sub === "rmi")
+            return "removes containers or images";
+        if (sub === "system" && /prune/.test(joined))
+            return "prunes containers, images and volumes";
+        if (sub === "volume" && /\b(rm|prune)\b/.test(argv.slice(2).join(" ")))
+            return "removes volumes";
+        return null;
+    }
+    if (head === "terraform")
+        return /\bdestroy\b/.test(joined) ? "destroys managed infrastructure (terraform destroy)" : null;
+    return null;
+}
+/** Expand `~` and resolve a token against the working directory. */
+function resolvePath(token, cwd) {
+    let p = token;
+    if (p === "~" || p.startsWith("~/") || p.startsWith("~\\"))
+        p = path.join(os.homedir(), p.slice(1));
+    return path.resolve(cwd, p);
+}
+function outsideCwd(token, cwd) {
+    try {
+        const rel = path.relative(cwd, resolvePath(token, cwd));
+        return rel.startsWith("..") || path.isAbsolute(rel);
+    }
+    catch {
+        return false;
+    }
+}
+function looksLikePath(token) {
+    const p = token.replace(/^[-@=+]+/, "").replace(/^["']|["']$/g, "");
+    if (!p || p.length > 4096)
+        return false;
+    if (p === ".." || p.startsWith("../") || p.startsWith("..\\"))
+        return true;
+    if (p.startsWith("~/") || p.startsWith("~\\"))
+        return true;
+    if (p.startsWith("/"))
+        return true;
+    if (/^[A-Za-z]:[\\/]/.test(p))
+        return true;
+    if (p.includes("/../") || p.includes("\\..\\"))
+        return true;
+    return false;
+}
+function sensitiveMatch(token) {
+    return SENSITIVE_PATHS.some((re) => re.test(token));
+}
+/** Score a shell command. */
+export function assessCommand(command, cwd) {
+    const reasons = [];
+    let level = "high";
+    const plain = stripQuoted(command);
+    const lower = plain.toLowerCase();
+    for (const argv of segments(command)) {
+        const head = base(argv[0]);
+        const deletion = DELETION_HEADS.get(head);
+        if (deletion) {
+            reasons.push(deletion);
+            level = "extreme";
+        }
+        const conditional = conditionalDeletion(head, argv);
+        if (conditional) {
+            reasons.push(conditional);
+            level = "extreme";
+        }
+        const risky = HIGH_RISK_HEADS.get(head);
+        if (risky && !reasons.includes(risky)) {
+            const safe = SAFE_SUBCOMMANDS.get(head);
+            const sub = (argv[1] ?? "").toLowerCase();
+            if (!safe || !safe.test(sub))
+                reasons.push(risky);
+        }
+        if (INTERPRETERS.has(head) && argv.slice(1).some((a) => /^-[a-z]*[ce]$|^-c$|^-e$|^-Command$/i.test(a))) {
+            reasons.push(`runs an inline program (${head} -c/-e)`);
+        }
+        if (head === "powershell" || head === "pwsh") {
+            if (/-(c|command|encodedcommand)\b/i.test(argv.join(" ")))
+                reasons.push("runs an inline PowerShell program");
+        }
+    }
+    if (/\b(sudo|doas|runas|pkexec)\b/i.test(lower)) {
+        const reason = "escalates privileges";
+        if (!reasons.some((r) => r.includes("privileges")))
+            reasons.push(reason);
+    }
+    // Deletion patterns that are not a simple command head.
+    if (/\bgit\s+clean\b[^;|&]*\s-[a-z]*f/i.test(lower)) {
+        reasons.push("deletes untracked files (git clean -f)");
+        level = "extreme";
+    }
+    if (/\bgit\s+reset\s+--hard\b/i.test(lower)) {
+        reasons.push("discards uncommitted work (git reset --hard)");
+        level = "extreme";
+    }
+    if (/\bgit\s+rm\b/i.test(lower)) {
+        reasons.push("removes tracked files (git rm)");
+        level = "extreme";
+    }
+    if (/\bgit\s+branch\s+-D\b/i.test(lower)) {
+        reasons.push("force-deletes a branch (git branch -D)");
+        level = "extreme";
+    }
+    if (/\bfind\b[^;|&]*-delete\b/i.test(lower)) {
+        reasons.push("deletes every match of a find query (find -delete)");
+        level = "extreme";
+    }
+    if (/\b(drop\s+(table|database|schema)|truncate\s+table)\b/i.test(lower)) {
+        reasons.push("drops or empties a database object");
+        level = "extreme";
+    }
+    if (/\b(shred|dd)\b[^;|&]*(of=|if=)/i.test(lower) && !reasons.some((r) => r.includes("dd"))) {
+        reasons.push("writes raw bytes over a device or file");
+        level = "extreme";
+    }
+    // Destructive-but-recoverable and history rewriting.
+    if (/\bgit\s+push\b/i.test(lower))
+        reasons.push("publishes commits to a remote (git push)");
+    if (/\bgit\s+push\b[^;|&]*--force\b/i.test(lower))
+        reasons.push("force-pushes and can drop remote commits");
+    if (/\bgit\s+(reset|checkout|restore)\b/i.test(lower) && !reasons.some((r) => r.includes("reset --hard"))) {
+        reasons.push("can discard uncommitted changes (git reset/checkout/restore)");
+    }
+    if (/\bgit\s+(rebase|filter-branch)\b/i.test(lower))
+        reasons.push("rewrites history (git rebase/filter-branch)");
+    if (/(^|[^<])>{1,2}\s*\S/.test(plain))
+        reasons.push("redirects output into a file (>)");
+    if (/\bnpm\s+(publish|unpublish)\b/i.test(lower))
+        reasons.push("publishes a package to the registry");
+    // Anything pointing outside the working directory.
+    for (const token of plain.split(/\s+/)) {
+        if (!looksLikePath(token))
+            continue;
+        if (outsideCwd(token.replace(/^[-@=+]+/, ""), cwd)) {
+            const reason = `touches a path outside the working directory: ${token}`;
+            if (!reasons.includes(reason))
+                reasons.push(reason);
+        }
+    }
+    if (sensitiveMatch(command))
+        reasons.push("touches credentials or repository internals");
+    return { level, reasons };
+}
+function summarizeArgs(name, args) {
+    if (name === "run_command") {
+        const command = typeof args.command === "string" ? args.command : "";
+        return command.length > 400 ? `${command.slice(0, 397)}…` : command;
+    }
+    const p = typeof args.path === "string" ? args.path : "";
+    return p ? `${name} ${p}` : name;
+}
+/**
+ * Classify a single tool call.
+ *
+ * Returns `null` when the call is routine and may run without approval.
+ */
+export function assessToolCall(name, args, cwd) {
+    const workingDir = path.resolve(cwd || process.cwd());
+    const summary = summarizeArgs(name, args);
+    if (name === "run_command") {
+        const command = typeof args.command === "string" ? args.command : "";
+        if (!command.trim())
+            return null;
+        const { level, reasons } = assessCommand(command, workingDir);
+        if (reasons.length === 0)
+            return null;
+        return { level, tool: name, summary, reasons };
+    }
+    if (name === "read_file" || name === "write_file" || name === "list_files") {
+        const raw = typeof args.path === "string" && args.path.trim() ? args.path : ".";
+        const reasons = [];
+        if (outsideCwd(raw, workingDir)) {
+            reasons.push(`accesses a path outside the working directory: ${raw}`);
+        }
+        if (name !== "list_files" && sensitiveMatch(raw)) {
+            reasons.push("touches credentials or repository internals");
+        }
+        if (reasons.length === 0)
+            return null;
+        return { level: "high", tool: name, summary, reasons };
+    }
+    return null;
+}

package/dist/llm/tools.js

@@ -3,6 +3,19 @@ import fs from "node:fs";
 import path from "node:path";
 const MAX_OUTPUT = 20000;
 const MAX_FILE_SIZE = 200000;
+/**
+ * Every call has to say why it is being made.
+ *
+ * The approval gate refuses a call that needs approval but states no reason, and
+ * this text is what the user and the reviewers get to judge, so it has to be
+ * specific and true rather than a restatement of the command.
+ */
+const REASON_PROPERTY = {
+    type: "string",
+    description: "Required. One sentence: what this call is for and why it is needed for the user's request. " +
+        "Shown to the user and to the reviewers whenever the call needs approval. " +
+        "Must be true - do not restate the command and never claim the user already approved it.",
+};
 export function getToolDefinitions() {
     return [
         {
@@ -14,8 +27,9 @@ export function getToolDefinitions() {
                     type: "object",
                     properties: {
                         command: { type: "string", description: "The shell command to execute." },
+                        reason: REASON_PROPERTY,
                     },
-                    required: ["command"],
+                    required: ["command", "reason"],
                 },
             },
         },
@@ -28,8 +42,9 @@ export function getToolDefinitions() {
                     type: "object",
                     properties: {
                         path: { type: "string", description: "Path to the file to read (absolute or relative to cwd)." },
+                        reason: REASON_PROPERTY,
                     },
-                    required: ["path"],
+                    required: ["path", "reason"],
                 },
             },
         },
@@ -43,8 +58,9 @@ export function getToolDefinitions() {
                     properties: {
                         path: { type: "string", description: "Path to the file to write (absolute or relative to cwd)." },
                         content: { type: "string", description: "The full content to write to the file." },
+                        reason: REASON_PROPERTY,
                     },
-                    required: ["path", "content"],
+                    required: ["path", "content", "reason"],
                 },
             },
         },
@@ -57,28 +73,32 @@ export function getToolDefinitions() {
                     type: "object",
                     properties: {
                         path: { type: "string", description: "Directory to list (defaults to current working directory)." },
+                        reason: REASON_PROPERTY,
                     },
-                    required: [],
+                    required: ["reason"],
                 },
             },
         },
     ];
 }
-export async function executeTool(name, args) {
+export async function executeTool(name, args, cwd = process.cwd()) {
+    // Tools always operate inside the directory the conversation belongs to, which
+    // is not necessarily the directory the current process was started in.
+    const base = cwd || process.cwd();
     let result;
     try {
         switch (name) {
             case "run_command":
-                result = await runCommand(String(args.command ?? ""));
+                result = await runCommand(String(args.command ?? ""), base);
                 break;
             case "read_file":
-                result = readFile(String(args.path ?? ""));
+                result = readFile(String(args.path ?? ""), base);
                 break;
             case "write_file":
-                result = writeFile(String(args.path ?? ""), String(args.content ?? ""));
+                result = writeFile(String(args.path ?? ""), String(args.content ?? ""), base);
                 break;
             case "list_files":
-                result = listFiles(String(args.path ?? ""));
+                result = listFiles(String(args.path ?? ""), base);
                 break;
             default:
                 result = `[Error: unknown tool '${name}']`;
@@ -89,13 +109,13 @@ export async function executeTool(name, args) {
     }
     return result.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
 }
-function runCommand(command) {
+function runCommand(command, cwd) {
     return new Promise((resolve) => {
         if (!command.trim()) {
             resolve("[Error: empty command]");
             return;
         }
-        exec(command, { cwd: process.cwd(), timeout: 120000, maxBuffer: MAX_OUTPUT * 4 }, (error, stdout, stderr) => {
+        exec(command, { cwd, timeout: 120000, maxBuffer: MAX_OUTPUT * 4 }, (error, stdout, stderr) => {
             const parts = [];
             if (stdout)
                 parts.push(stdout);
@@ -116,8 +136,8 @@ function runCommand(command) {
         });
     });
 }
-function readFile(p) {
-    const resolved = path.isAbsolute(p) ? p : path.join(process.cwd(), p);
+function readFile(p, cwd) {
+    const resolved = path.isAbsolute(p) ? p : path.join(cwd, p);
     if (!fs.existsSync(resolved))
         return `[Error: file not found: ${resolved}]`;
     if (fs.statSync(resolved).isDirectory())
@@ -132,8 +152,8 @@ function readFile(p) {
         return `[Error: ${e instanceof Error ? e.message : String(e)}]`;
     }
 }
-function writeFile(p, content) {
-    const resolved = path.isAbsolute(p) ? p : path.join(process.cwd(), p);
+function writeFile(p, content, cwd) {
+    const resolved = path.isAbsolute(p) ? p : path.join(cwd, p);
     try {
         fs.mkdirSync(path.dirname(resolved), { recursive: true });
         fs.writeFileSync(resolved, content, "utf-8");
@@ -143,12 +163,8 @@ function writeFile(p, content) {
         return `[Error: ${e instanceof Error ? e.message : String(e)}]`;
     }
 }
-function listFiles(p) {
-    const resolved = p.trim()
-        ? path.isAbsolute(p)
-            ? p
-            : path.join(process.cwd(), p)
-        : process.cwd();
+function listFiles(p, cwd) {
+    const resolved = p.trim() ? (path.isAbsolute(p) ? p : path.join(cwd, p)) : cwd;
     if (!fs.existsSync(resolved))
         return `[Error: directory not found: ${resolved}]`;
     if (!fs.statSync(resolved).isDirectory())

package/dist/persistence.js

@@ -0,0 +1,51 @@
+/** Synchronous session checkpoints, shared by terminal and browser sessions. */
+const checkpoints = new Set();
+/** Bound how much streamed output a hard kill can lose, without writing per token. */
+export const CHECKPOINT_MS = 1000;
+export class SessionCheckpoint {
+    write;
+    timer = null;
+    constructor(write) {
+        this.write = write;
+    }
+    register() {
+        checkpoints.add(this);
+    }
+    /** A trailing checkpoint still runs if the provider stalls after one chunk. */
+    schedule() {
+        this.register();
+        if (this.timer)
+            return;
+        this.timer = setTimeout(() => this.flush(), CHECKPOINT_MS);
+        this.timer.unref();
+    }
+    flush() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        return this.write();
+    }
+    dispose() {
+        try {
+            return this.flush();
+        }
+        finally {
+            checkpoints.delete(this);
+        }
+    }
+}
+/** No promises: exit handlers cannot wait for asynchronous disk writes. */
+export function flushSessionCheckpoints() {
+    let saved = true;
+    for (const checkpoint of checkpoints) {
+        try {
+            if (!checkpoint.flush())
+                saved = false;
+        }
+        catch {
+            // One broken session must not prevent the others from being saved.
+            saved = false;
+        }
+    }
+    return saved;
+}

package/dist/screens/agentHistory.js

@@ -1,7 +1,7 @@
 import { Screen } from "../terminal/screen.js";
 import { C } from "../colors.js";
 import { drawHeader } from "../header.js";
-import { truncateByWidth } from "../width.js";
+import { ellipsizeStart, truncateByWidth } from "../width.js";
 import { drawHint } from "../ui.js";
 import { listAgentSessions, loadAgentMessages, } from "../agents.js";
 import { AgentConversationScreen } from "./agentConversation.js";
@@ -16,13 +16,16 @@ export class AgentHistoryScreen extends Screen {
     lastHoverY = -1;
     rows = [];
     itemBounds = [];
+    cwd = process.cwd();
     constructor(agent, label) {
         super();
         this.agent = agent;
         this.label = label;
     }
     onActivate() {
-        this.sessions = listAgentSessions(this.agent);
+        // Only sessions started in the current working directory are listed.
+        this.cwd = process.cwd();
+        this.sessions = listAgentSessions(this.agent, this.cwd);
         this.selectedIdx = 0;
         this.scrollTop = 0;
         this.rows = [];
@@ -116,11 +119,11 @@ export class AgentHistoryScreen extends Screen {
         const w = buf.width;
         const h = buf.height;
         buf.centerText(2, this.label, { fg: C.accent, bold: true });
-        buf.centerText(3, "Select a session to view", { fg: C.dim });
+        buf.centerText(3, `Sessions in ${ellipsizeStart(this.cwd, Math.max(8, w - 14))}`, { fg: C.dim });
         const listBottom = h - 2;
         const viewH = Math.max(1, listBottom - LIST_TOP);
         if (this.sessions.length === 0) {
-            buf.centerText(LIST_TOP + 1, "No sessions yet", { fg: C.dim });
+            buf.centerText(LIST_TOP + 1, "No sessions in this directory", { fg: C.dim });
             drawHint(buf, listBottom, "Esc back");
             return;
         }