cumora 0.1.40 → 0.1.41

package/dist/cli.js

@@ -4,6 +4,8 @@
 import { mkdir as mkdir2, writeFile as writeFile2, readFile, chmod } from "node:fs/promises";
 import { homedir, hostname } from "node:os";
 import { join as join2 } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 
 // ../server/src/agents/runtime/sse-parse.ts
 async function* parseSseStream(body) {
@@ -88,8 +90,25 @@ function extraArgs(envVar) {
 var PERSONA_HEADER = (p) => `# ${p.name}${p.role ? ` \u2014 ${p.role}` : ""}
 
 You are **${p.name}**, a member of a team that collaborates in Cumora (a team chat).
-This directory is your private home: it persists across wakes. Keep durable
-memory, notes and working files here \u2014 they are yours alone.
+This directory is your private home and your working directory \u2014 it persists
+across wakes and is yours alone. Its layout:
+- \`CLAUDE.md\` (this file) + \`memory/\` + \`notes/\` \u2014 your durable memory and notes.
+- \`.claude/skills/\` \u2014 your skills.
+- \`workspace/\` \u2014 **put all project files and scratch here**: git clones, builds,
+  downloads, temp files. Always \`cd workspace\` (or use \`workspace/\u2026\` paths) for
+  that work \u2014 do NOT clutter your home root with project files.
+
+## Privacy boundary \u2014 STRICT
+You run on a machine that belongs to your operator. Everything OUTSIDE your home
+directory (other projects, \`~/.ssh\`, credentials, browser data, personal files)
+is private and not yours to touch.
+- Stay inside your home directory. Do not read, open, list, or search files
+  outside it unless the operator explicitly asks you to in this Cumora workspace.
+- NEVER paste, quote, summarize, or send the contents \u2014 or even the paths \u2014 of
+  any file outside your home into Cumora (replies, DMs, docs, kanban). Other
+  people see what you post there.
+- If a task seems to need something outside your home, ask in Cumora first;
+  don't go fetch it on your own.
 
 When you act in Cumora, use the \`cumora\` command-line tool (already on your
 PATH). Key commands:
@@ -115,8 +134,10 @@ var ClaudeAdapter = class {
   }
   run(args) {
     const flags = extraArgs("CUMORA_CLAUDE_ARGS");
-    const argv = flags.length ? [...flags, "-p", args.prompt] : ["-p", args.prompt, "--output-format", "stream-json", "--verbose", "--dangerously-skip-permissions"];
-    return spawnEngine(this.bin, argv, args);
+    const model = args.model ? ["--model", args.model] : [];
+    const argv = flags.length ? [...flags, "-p", args.prompt] : ["-p", args.prompt, ...model, "--output-format", "stream-json", "--verbose", "--dangerously-skip-permissions"];
+    const env = args.fastModel ? { ...args.env, ANTHROPIC_SMALL_FAST_MODEL: args.fastModel } : args.env;
+    return spawnEngine(this.bin, argv, { ...args, env });
   }
 };
 var CodexAdapter = class {
@@ -129,8 +150,9 @@ var CodexAdapter = class {
   }
   run(args) {
     const flags = extraArgs("CUMORA_CODEX_ARGS");
-    const argv = flags.length ? ["exec", ...flags, args.prompt] : ["exec", "--full-auto", args.prompt];
-    return spawnEngine(this.bin, argv, args);
+    const base = flags.length ? flags : ["--dangerously-bypass-approvals-and-sandbox", "--skip-git-repo-check"];
+    const model = args.model ? ["--model", args.model] : [];
+    return spawnEngine(this.bin, ["exec", ...model, ...base, args.prompt], args);
   }
 };
 var ADAPTERS = {
@@ -147,6 +169,7 @@ async function detectEngines() {
 }
 
 // ../server/src/agents/computer/daemon.ts
+var execFileP = promisify(execFile);
 var CONFIG_DIR = join2(homedir(), ".cumora");
 var CONFIG_PATH = join2(CONFIG_DIR, "computer.json");
 var AGENTS_ROOT = join2(CONFIG_DIR, "agents");
@@ -226,6 +249,21 @@ async function writeShim(binDir) {
   await writeFile2(shim, CUMORA_SHIM, "utf8");
   await chmod(shim, 493);
 }
+async function detectHostName() {
+  const base = hostname();
+  if (base && base.toLowerCase() !== "localhost") return base;
+  if (process.platform === "darwin") {
+    for (const key of ["ComputerName", "LocalHostName"]) {
+      try {
+        const { stdout } = await execFileP("scutil", ["--get", key]);
+        const name = stdout.trim();
+        if (name) return name;
+      } catch {
+      }
+    }
+  }
+  return base || "My computer";
+}
 async function doPair(code, serverUrl) {
   const engines = await detectEngines();
   if (engines.length === 0) {
@@ -234,11 +272,11 @@ async function doPair(code, serverUrl) {
   const paired = await api(
     serverUrl,
     "/api/computers/pair",
-    { method: "POST", body: JSON.stringify({ code, hostName: hostname(), engines }) }
+    { method: "POST", body: JSON.stringify({ code, hostName: await detectHostName(), engines }) }
   );
   await saveConfig({ serverUrl, computerId: paired.computerId, deviceToken: paired.deviceToken });
   console.log(`[computer] paired as ${paired.computerId} (engines: ${engines.join(", ") || "none"})`);
-  console.log(`[computer] run \`cumora agent computer\` to start hosting your agents.`);
+  console.log(`[computer] run \`npx cumora agent computer\` to start hosting your agents.`);
 }
 var AgentRunner = class {
   constructor(cfg, agent, engine) {
@@ -294,6 +332,8 @@ Use the \`cumora\` tool to catch up and respond:
 2. \`cumora messages <conversationId> --tail 30\` \u2014 read the relevant thread(s)
 3. \`cumora reply <conversationId> '<text>'\` \u2014 reply, in your own voice, only where you add something
 
+Privacy: stay inside your home directory. Never read files outside it, and never expose the contents or paths of anything outside your home in Cumora \u2014 this machine holds the operator's private files.
+
 If nothing genuinely needs you, it's fine to do nothing and stop. When finished, stop.`;
   }
   /** Run one turn. Coalesces concurrent wakes: a wake during a run schedules
@@ -320,6 +360,8 @@ If nothing genuinely needs you, it's fine to do nothing and stop. When finished,
             home: this.home,
             prompt: this.prompt(),
             env: this.engineEnv(),
+            model: this.agent.model,
+            fastModel: this.agent.fastModel,
             onLog: (line) => console.log(`[${this.agent.id}/${this.adapter.id}] ${line.slice(0, 500)}`),
             signal: controller.signal
           });
@@ -459,7 +501,7 @@ async function main() {
     return;
   }
   process.stderr.write(
-    "cumora \u2014 run your Cumora agents on this machine (BYOA)\n\nUsage:\n  cumora agent computer --pair <code> [--server <url>]   pair this machine\n  cumora agent computer [--server <url>]                 start the daemon\n\nNeeds `claude` (Claude Code) or `codex` on PATH. Get a pairing code from\nCumora \u2192 You \u2192 Computers \u2192 Add a computer.\n"
+    "cumora \u2014 run your Cumora agents on this machine (BYOA)\n\nUsage:\n  npx cumora agent computer --pair <code> [--server <url>]   pair this machine\n  npx cumora agent computer [--server <url>]                 start the daemon\n\nNeeds `claude` (Claude Code) or `codex` on PATH. Get a pairing code from\nCumora \u2192 You \u2192 Computers \u2192 Add a computer.\n"
   );
   process.exit(argv.length ? 1 : 0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cumora",
-  "version": "0.1.40",
+  "version": "0.1.41",
   "description": "Run your Cumora agents on your own machine or VPS, powered by your local Claude Code or Codex CLI (BYOA).",
   "type": "module",
   "bin": {