loom-agent 1.2.27 → 1.2.36

package/CHANGELOG.md

@@ -4,6 +4,96 @@ All notable changes to **Loom Code** are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.36] — fix `loom web` / `loom acp` / `loom attach`
+
+### Fixed
+- **`loom web` launched the TUI instead of the browser server.** Since 1.2.34
+  the npm shims prefer `bin/loom-bun.js`, whose non-TUI branch routed every
+  subcommand into `src/core/cli.js`'s interactive `main()` — which has no
+  handler for `web`/`acp`/`attach`, so control fell through to the full-screen
+  app (reproduced: splash painted, no HTTP listener). `bin/loom-bun.js` now
+  routes those three subcommands directly to their own entry points, exactly
+  like `bin/loom.js` always did. Verified end-to-end on a global install:
+  `/api/health` → 200, UI served, banner prints.
+
+## [1.2.35] — security hardening
+
+### Fixed
+- **webfetch SSRF guard (`src/tools/index.js`).** The fetch tool is driven by
+  the model, and prompt-injected page content could steer it at cloud
+  metadata (`169.254.169.254`), localhost services, or internal hosts.
+  webfetch now allows only `http:`/`https:` (no `file:`/`ftp:`/`data:`),
+  refuses loopback, RFC1918, CGNAT, link-local/metadata, IPv6 ULA/link-local
+  and IPv4-mapped targets, **resolves DNS before connecting** so
+  hostname→internal-IP tricks fail, follows redirects manually and re-checks
+  every hop, and fails closed on unresolvable hosts.
+- **MCP servers no longer inherit the full shell environment**
+  (`src/mcp/mcp-client.js`). Every spawned MCP server used to receive all of
+  `process.env` — provider API keys, cloud tokens, cookies — handing them to
+  whatever npm package a config starts. Servers now get a minimal OS/runtime
+  baseline (PATH, ComSpec, TEMP/HOME, proxy vars) plus only what their own
+  config explicitly declares (`cfg.env`). Secrets are opt-in per server.
+- **Skills install name traversal blocked (`src/skills/skills-manager.js`).**
+  A remote-provided install name like `../../escapee` was joined raw onto
+  `~/.loom/skills`. Names are now a strict allowlist
+  (`^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$`); traversal attempts error instead of
+  silently renaming or escaping the skills directory.
+
+### Added
+- **`loom web` session hardening (`src/web/web-server.js`).** Login tokens
+  previously lived until server restart; they now expire after **12 h**
+  (tunable via `LOOM_SERVER_TOKEN_TTL_MS`, cookie `Max-Age` kept in sync), a
+  lazy sweep drops expired tokens, and new **`POST /api/auth/logout`**
+  revokes the presented token immediately.
+- **Security headers on every response:** `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY`, `Referrer-Policy: no-referrer`; the browser UI
+  additionally ships a strict `Content-Security-Policy`
+  (`default-src 'none'; connect-src 'self'` — the page is self-contained).
+- **LAN-exposure warning:** `loom web --hostname 0.0.0.0` (or `::`) without
+  `LOOM_SERVER_PASSWORD` now prints an explicit warning that anyone on the
+  network can run an agent and reach its tools/files.
+- **New regression suite `src/tools/security.test.js`** plus five web-server
+  hardening tests (headers, CSP, token TTL expiry, Max-Age sync, logout).
+
+## [1.2.34] — bundle bun with the npm install
+
+### Added
+- **`npm i -g loom-agent` now brings its own bun.** The `@oven/bun-<platform>`
+  binaries (pinned to bun 1.3.14, the version the project builds against) ship
+  as `optionalDependencies`; npm downloads only the one matching the user's
+  OS/arch, and no install scripts are involved (npm allow-scripts policies
+  cannot break it). The postinstall rewrites the `loom` shims to prefer the
+  bundled binary, then `bun` from PATH.
+- **No-bun users are never stranded:** if neither the bundled binary nor a
+  PATH bun exists, the shim falls back to `node bin/loom.js` (the line-mode
+  REPL) with a hint — instead of dying with "'bun' is not recognized".
+  `findBun()` and the bin respawn paths check the bundled location first too.
+
+## [1.2.33] — fix frozen splash on global installs + stable model picker
+
+### Fixed
+- **Global npm installs froze on the splash screen** ("Build … no key", no
+  keyboard input) while repo checkouts worked. Root cause: the launch chain
+  started Bun at the package root and later ran `process.chdir()` back to the
+  user's project inside `tui-open.tsx`. That mid-flight chdir killed OpenTUI's
+  repaint/input pipeline after the first frame — signals kept updating and
+  Solid effects kept firing (verified with runtime instrumentation), but no
+  frame ever reached the terminal again.
+- The launcher now registers the Solid JSX preloader with **absolute
+  `--preload` paths** and starts Bun **directly in the user's project
+  directory**, so no chdir ever happens: `bin/loom-bun.js`, `bin/loom-tui.js`,
+  the postinstall-rewritten shims, and the core-CLI TUI spawn
+  (`src/core/cli.js`) were all switched to that scheme.
+- **Model picker jitter** — scrolling `/models` (and every `SelectModal`:
+  `/connect`, theme pickers, MCP preset picker) bounced the whole modal.
+  Section headers added an extra margin row, so the centered frame's height
+  flipped between 12/13/14 rows on every page of a header-heavy list. The
+  list window is now a fixed 12 rows (headers are plain one-row entries), the
+  window is computed once per change instead of mutating during render, and
+  mouse-hover no longer yanks the selection while a keyboard/wheel scroll is
+  settling. Regression test added (29b: modal title row must never move while
+  scrolling).
+
 ## [Unreleased]
 
 ### Added

package/README.md

@@ -1,9 +1,18 @@
-# Loom Code
+```
+ ██╗      ██████╗  ██████╗ ███╗   ███╗      ██████╗ ██████╗ ██████╗ ███████╗
+ ██║     ██╔═══██╗██╔═══██╗████╗ ████║     ██╔════╝██╔═══██╗██╔══██╗██╔════╝
+ ██║     ██║   ██║██║   ██║██╔████╔██║     ██║     ██║   ██║██║  ██║█████╗
+ ██║     ██║   ██║██║   ██║██║╚██╔╝██║     ██║     ██║   ██║██║  ██║██╔══╝
+ ███████╗╚██████╔╝╚██████╔╝██║ ╚═╝ ██║     ╚██████╗██████╔╝██████╔╝███████╗
+ ╚══════╝ ╚═════╝  ╚═════╝ ╚═╝     ╚═╝      ╚═════╝╚═════╝ ╚═════╝ ╚══════╝
+```
 
 [![npm version](https://img.shields.io/npm/v/loom-agent?style=flat&color=blue)](https://www.npmjs.com/package/loom-agent)
 [![License: MIT](https://img.shields.io/npm/l/loom-agent?style=flat&color=green)](LICENSE)
 [![Platform: Win/Mac/Linux](https://img.shields.io/badge/platform-Win--Mac--Linux-orange)](#)
 
+![Loom Code splash — connected to NVIDIA](docs/screenshot.png)
+
 An AI-powered coding agent for the terminal with multi-provider support and a full terminal UI.
 
 ## Features

package/bin/loom-bun.js

@@ -1,61 +1,104 @@
-#!/usr/bin/env bun
-// npm invokes bin targets through Node on Windows, so re-launch under Bun
-// when this file was not started by Bun itself.
-const path = require("path");
-const fs = require("fs");
-const { spawnSync } = require("child_process");
-
-// Bun discovers bunfig.toml ONLY from its starting cwd, and the Solid JSX
-// plugin ONLY works when loaded through that bunfig preload phase — runtime
-// registration from another cwd silently no-ops (proven). So unless bun is
-// ALREADY sitting in the package root, respawn it there once. The user's
-// real directory rides along in LOOM_START_CWD and is restored by
-// tui-open.tsx after its imports finish loading.
-const pkgRoot = path.join(__dirname, "..");
-const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
-if (!underBun) {
-  const result = spawnSync(
-    process.platform === "win32" ? "bun.exe" : "bun",
-    [__filename, ...process.argv.slice(2)],
-    {
-      stdio: "inherit",
-      cwd: pkgRoot,
-      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
-      windowsHide: false,
-    }
-  );
-  if (result.error) {
-    console.error("[loom] Bun is required for the full CLI. Install it from https://bun.sh/");
-    process.exit(1);
-  }
-  process.exit(result.status == null ? 1 : result.status);
-}
-process.title = "loom-code";
-(async () => {
-  try {
-    // The npm bin entry bypasses src/index.js, so load dotenv here for both
-    // the package environment and the project from which `loom` was run.
-    const dotenv = require("dotenv");
-    dotenv.config({ path: path.join(__dirname, "..", ".env") });
-    const startCwd = process.env.LOOM_START_CWD || process.cwd();
-    const projectEnv = path.join(startCwd, ".env");
-    if (fs.existsSync(projectEnv)) dotenv.config({ path: projectEnv, override: false });
-    // The npm global shim can start Bun outside the package directory, so do
-    // not depend on bunfig.toml discovery for Windows console setup.
-    await import("../src/tui-preload.js");
-    const args = process.argv.slice(2);
-    const coreMode = args.includes("--basic") || args.includes("-p") || args.includes("--print")
-      || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v")
-      || ["acp", "web", "attach", "graph"].includes(args[0]);
-    if (!coreMode) {
-      await import("@opentui/solid/preload");
-      await import("../src/tui-open.tsx");
-      return;
-    }
-    const { main } = require("../src/core/cli.js");
-    await main();
-  } catch (err) {
-    console.error(err && err.message ? err.message : String(err));
-    process.exit(1);
-  }
-})();
+#!/usr/bin/env bun
+// npm invokes bin targets through Node on Windows, so re-launch under Bun
+// when this file was not started by Bun itself.
+const path = require("path");
+const fs = require("fs");
+const { spawnSync } = require("child_process");
+
+// The Solid JSX transform must register in Bun's preload phase, so the
+// preloads are passed as ABSOLUTE paths. That lets Bun start directly in the
+// user's project directory — the old "spawn at the package root, then chdir
+// to the project inside tui-open.tsx" dance froze the TUI after the first
+// frame (splash paints once, then no repaints and no keyboard input; proven
+// by A/B-launching the identical entry with and without the mid-flight
+// process.chdir). No chdir ever happens now: LOOM_START_CWD always equals
+// the starting directory, so the restore in tui-open.tsx is a no-op kept
+// only as a safety net.
+const pkgRoot = path.join(__dirname, "..");
+const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
+if (!underBun) {
+  // Prefer the bundled @oven bun binary (shipped as an optional dep), then
+  // whatever bun is on PATH. Without either, still respawn so the inner
+  // failure message can guide the user.
+  const OVEN = {
+    "win32-x64": "bun-windows-x64",
+    "win32-arm64": "bun-windows-aarch64",
+    "darwin-x64": "bun-darwin-x64",
+    "darwin-arm64": "bun-darwin-aarch64",
+    "linux-x64": "bun-linux-x64",
+    "linux-arm64": "bun-linux-aarch64",
+  };
+  let bunCmd = process.platform === "win32" ? "bun.exe" : "bun";
+  const short = OVEN[process.platform + "-" + process.arch];
+  const exe = process.platform === "win32" ? "bun.exe" : "bun";
+  const ovenCandidates = short ? [
+    path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe),
+    path.join(pkgRoot, "..", "@oven", short, "bin", exe),
+  ] : [];
+  for (const c of ovenCandidates) {
+    if (fs.existsSync(c)) { bunCmd = c; break; }
+  }
+  const result = spawnSync(
+    bunCmd,
+    [
+      "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
+      __filename,
+      ...process.argv.slice(2),
+    ],
+    {
+      stdio: "inherit",
+      cwd: process.env.LOOM_START_CWD || process.cwd(),
+      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
+      windowsHide: false,
+    }
+  );
+  if (result.error) {
+    console.error("[loom] Bun is required for the full CLI. Install it from https://bun.sh/");
+    process.exit(1);
+  }
+  process.exit(result.status == null ? 1 : result.status);
+}
+process.title = "loom-code";
+(async () => {
+  try {
+    // The npm bin entry bypasses src/index.js, so load dotenv here for both
+    // the package environment and the project from which `loom` was run.
+    const dotenv = require("dotenv");
+    dotenv.config({ path: path.join(__dirname, "..", ".env") });
+    const startCwd = process.env.LOOM_START_CWD || process.cwd();
+    const projectEnv = path.join(startCwd, ".env");
+    if (fs.existsSync(projectEnv)) dotenv.config({ path: projectEnv, override: false });
+    // The npm global shim can start Bun outside the package directory, so do
+    // not depend on bunfig.toml discovery for Windows console setup.
+    await import("../src/tui-preload.js");
+    const args = process.argv.slice(2);
+    const coreMode = args.includes("--basic") || args.includes("-p") || args.includes("--print")
+      || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v")
+      || ["acp", "web", "attach", "graph"].includes(args[0]);
+    if (!coreMode) {
+      await import("@opentui/solid/preload");
+      await import("../src/tui-open.tsx");
+      return;
+    }
+    // Subcommands that must never reach the interactive CLI/TUI: cli.main()
+    // has no handler for them and would fall through to launching the full
+    // screen app (`loom web` painted the splash instead of serving HTTP).
+    if (args[0] === "web") {
+      require("../src/web/web-server.js").main();
+      return;
+    }
+    if (args[0] === "acp") {
+      require("../src/acp/acp-server.js").main();
+      return;
+    }
+    if (args[0] === "attach") {
+      require("../src/web/attach.js").main();
+      return;
+    }
+    const { main } = require("../src/core/cli.js");
+    await main();
+  } catch (err) {
+    console.error(err && err.message ? err.message : String(err));
+    process.exit(1);
+  }
+})();

package/bin/loom-tui.js

@@ -4,30 +4,55 @@
 const path = require("path");
 const { spawnSync } = require("child_process");
 
-// Respawn from the package root so bunfig.toml's preload chain (Solid JSX
-// transform) loads natively — see bin/loom-bun.js.
+// Preloads are ABSOLUTE paths so Bun starts directly in the user's project
+// directory — see bin/loom-bun.js for why the package-root + chdir dance is
+// gone (it froze the TUI after the first frame).
 const pkgRoot = path.join(__dirname, "..");
 const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
 if (!underBun) {
-	const result = spawnSync(
-		process.platform === "win32" ? "bun.exe" : "bun",
-		[__filename, ...process.argv.slice(2)],
-		{
-			stdio: "inherit",
-			cwd: pkgRoot,
-			env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
-			windowsHide: false,
-		}
-	);
-	if (result.error) {
-		console.error("[loom] Bun is required for the TUI. Install it from https://bun.sh/");
-		process.exit(1);
-	}
-	process.exit(result.status == null ? 1 : result.status);
+  // Prefer the bundled @oven bun binary (shipped as an optional dep), then
+  // whatever bun is on PATH — same scheme as bin/loom-bun.js.
+  const OVEN = {
+    "win32-x64": "bun-windows-x64",
+    "win32-arm64": "bun-windows-aarch64",
+    "darwin-x64": "bun-darwin-x64",
+    "darwin-arm64": "bun-darwin-aarch64",
+    "linux-x64": "bun-linux-x64",
+    "linux-arm64": "bun-linux-aarch64",
+  };
+  let bunCmd = process.platform === "win32" ? "bun.exe" : "bun";
+  const short = OVEN[process.platform + "-" + process.arch];
+  const exe = process.platform === "win32" ? "bun.exe" : "bun";
+  const ovenCandidates = short ? [
+    path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe),
+    path.join(pkgRoot, "..", "@oven", short, "bin", exe),
+  ] : [];
+  for (const c of ovenCandidates) {
+    if (fs.existsSync(c)) { bunCmd = c; break; }
+  }
+  const result = spawnSync(
+    bunCmd,
+    [
+      "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
+      __filename,
+      ...process.argv.slice(2),
+    ],
+    {
+      stdio: "inherit",
+      cwd: process.env.LOOM_START_CWD || process.cwd(),
+      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
+      windowsHide: false,
+    }
+  );
+  if (result.error) {
+    console.error("[loom] Bun is required for the TUI. Install it from https://bun.sh/");
+    process.exit(1);
+  }
+  process.exit(result.status == null ? 1 : result.status);
 }
 
 (async () => {
-	await import("../src/tui-preload.js");
-	await import("@opentui/solid/preload");
-	await import("../src/tui-open.tsx");
-})();
+  await import("../src/tui-preload.js");
+  await import("@opentui/solid/preload");
+  await import("../src/tui-open.tsx");
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loom-agent",
-  "version": "1.2.27",
+  "version": "1.2.36",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/toshalkumbhar8979-design/loomcode.git"
@@ -9,7 +9,7 @@
   "bugs": {
     "url": "https://github.com/toshalkumbhar8979-design/loomcode/issues"
   },
-  "description": "Loom Code — AI-powered coding agent for the terminal. Multi-provider support including NVIDIA. OpenTUI interface.",
+  "description": "Loom Code — AI-powered coding agent for the terminal. Multi-provider support including NVIDIA. OpenTUI interface.",
   "main": "src/index.js",
   "publishConfig": {
     "access": "public",
@@ -24,12 +24,13 @@
     "dev": "node --watch src/index.js",
     "setup": "node src/setup.js",
     "test": "bun run src/tui/test-interactive.tsx && bun run test:unit && bun run lint:core",
-    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/web/web-server.test.js src/tui/keybinds.test.ts",
+    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/tools/security.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/web/web-server.test.js src/tui/keybinds.test.ts",
     "lint:core": "node node_modules/typescript/bin/tsc -p tsconfig.core.json",
     "smoke:acp": "node scripts/acp-smoke.js",
     "tui": "bun bin/loom-tui.js",
     "tui:win": "\"%USERPROFILE%\\..\\bun\\bin\\bun.exe\" run src/tui-open.tsx",
     "prepublishOnly": "npm test",
+    "postinstall": "node scripts/postinstall.js",
     "lint": "tsc --noEmit"
   },
   "dependencies": {
@@ -61,7 +62,13 @@
     "@opentui/core-darwin-x64": "0.5.3",
     "@opentui/core-linux-arm64": "0.5.3",
     "@opentui/core-linux-x64": "0.5.3",
-    "@opentui/core-win32-x64": "0.5.3"
+    "@opentui/core-win32-x64": "0.5.3",
+    "@oven/bun-darwin-aarch64": "1.3.14",
+    "@oven/bun-darwin-x64": "1.3.14",
+    "@oven/bun-linux-aarch64": "1.3.14",
+    "@oven/bun-linux-x64": "1.3.14",
+    "@oven/bun-windows-aarch64": "1.3.14",
+    "@oven/bun-windows-x64": "1.3.14"
   },
   "overrides": {
     "glob": "^13.0.6"
@@ -90,6 +97,7 @@
     "LOOM.md",
     "docs/acp.md",
     "scripts/acp-smoke.js",
+    "scripts/postinstall.js",
     "docs/web.md",
     "src/web/index.html",
     "src/web/graph-view.html"
@@ -113,6 +121,6 @@
     "doc": "docs"
   },
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "type": "commonjs"
 }

package/scripts/postinstall.js

@@ -0,0 +1,140 @@
+// Postinstall: rewrite the npm-generated bin shims so `loom` starts ONE bun
+// process directly IN THE USER'S PROJECT DIRECTORY. The Solid JSX preloader
+// is registered with absolute --preload paths (the package-root cwd trick is
+// gone — starting at the package root forced a later process.chdir back to
+// the project inside tui-open.tsx, which froze the TUI after the first frame:
+// splash painted once, then no repaints and no keyboard input).
+const fs = require("fs");
+const path = require("path");
+
+const pkgRoot = path.resolve(__dirname, "..");
+
+// Bun, bundled: loom-agent lists the @oven/bun-<platform> binaries as
+// optionalDependencies, so `npm i -g loom-agent` brings the REAL bun binary
+// (pinned, matching the repo's bun) along even when the user has no bun
+// installed. npm skips non-matching platforms via each package's os/cpu
+// fields, and this resolution never needs install scripts (npm
+// allow-scripts policies can't break it). Resolved here once at install
+// time and baked into the shims as the preferred runtime; the shims still
+// fall back to whatever `bun` is on PATH, and — if NO bun exists at all —
+// to `node bin/loom.js` (line-mode REPL) instead of dying with
+// "'bun' is not recognized".
+function ovenBunPath() {
+    const PKGS = {
+        "win32-x64": "bun-windows-x64",
+        "win32-arm64": "bun-windows-aarch64",
+        "darwin-x64": "bun-darwin-x64",
+        "darwin-arm64": "bun-darwin-aarch64",
+        "linux-x64": "bun-linux-x64",
+        "linux-arm64": "bun-linux-aarch64",
+    };
+    const short = PKGS[process.platform + "-" + process.arch];
+    if (!short) return "";
+    const exe = process.platform === "win32" ? "bun.exe" : "bun";
+    const candidates = [
+        path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe), // nested (npm default)
+        path.join(pkgRoot, "..", "@oven", short, "bin", exe),           // hoisted
+    ];
+    for (var i = 0; i < candidates.length; i++) {
+        try { if (fs.existsSync(candidates[i])) return candidates[i]; } catch {}
+    }
+    return "";
+}
+
+var ovenPath = "";
+
+function shimDirs() {
+    const dirs = new Set();
+    if (path.basename(path.resolve(pkgRoot, "..")) !== "node_modules") return [];
+    dirs.add(path.resolve(pkgRoot, "..", ".."));
+    dirs.add(path.join(path.resolve(pkgRoot, ".."), ".bin"));
+    return [...dirs].filter(function(d) {
+        try {
+            return fs.existsSync(path.join(d, "loom.cmd")) || fs.existsSync(path.join(d, "loom"));
+        } catch {
+            return false;
+        }
+    });
+}
+
+function cmdShim(pkg, script) {
+    var pkgEscaped = pkg.replace(/\//g, "\\");
+    return [
+        "@ECHO off",
+        "SETLOCAL",
+        'SET "LOOM_START_CWD=%CD%"',
+        'IF EXIST "' + ovenPath + '" (SET "_prog=' + ovenPath + '") ELSE (SET "_prog=bun")',
+        '"%_prog%" --preload "%~dp0' + pkgEscaped + '\\src\\tui-preload.js" "%~dp0' + pkgEscaped + '\\bin\\' + script + '" %*',
+        "IF %ERRORLEVEL% NEQ 9009 EXIT /b %ERRORLEVEL%",
+        "REM bun not found (errorlevel 9009): fall back to the Node REPL",
+        "node \"%~dp0" + pkgEscaped + "\\bin\\loom.js\" %*",
+        "EXIT /b %ERRORLEVEL%",
+        ""
+    ].join("\r\n");
+}
+
+function psShim(pkg, script) {
+    return [
+        "#!/usr/bin/env pwsh",
+        "# rewritten by loom-agent postinstall (bundled bun + node fallback)",
+        "$env:LOOM_START_CWD = (Get-Location).Path",
+        "$pkg = Join-Path $PSScriptRoot '" + pkg + "'",
+        "$bun = '" + ovenPath + "'",
+        "if (-not ($bun -and (Test-Path $bun))) { $bun = 'bun' }",
+        "& $bun --preload (Join-Path $pkg 'src/tui-preload.js') (Join-Path $pkg 'bin/" + script + "') @args",
+        "if ($LASTEXITCODE -eq 9009) { node (Join-Path $pkg 'bin/loom.js') @args; exit $LASTEXITCODE }",
+        "exit $LASTEXITCODE",
+        ""
+    ].join("\n");
+}
+
+function shShim(pkg, script) {
+    return [
+        "#!/bin/sh",
+        "# rewritten by loom-agent postinstall (bundled bun + node fallback)",
+        'LOOM_START_CWD="$(pwd)"',
+        "export LOOM_START_CWD",
+        'PKG="$(dirname "$0")/' + pkg + '"',
+        'BUN="' + ovenPath + '"',
+        '[ -x "$BUN" ] || BUN="$(command -v bun || true)"',
+        'if [ -n "$BUN" ]; then',
+        '  exec "$BUN" --preload "$PKG/src/tui-preload.js" "$PKG/bin/' + script + '" "$@"',
+        "fi",
+        'echo "[loom] full TUI needs bun - install with: npm i -g bun (https://bun.sh)" >&2',
+        'exec node "$PKG/bin/loom.js" "$@"',
+        ""
+    ].join("\n");
+}
+
+try {
+    ovenPath = ovenBunPath();
+    if (ovenPath) {
+        console.log("[loom-agent] bundled bun found: " + ovenPath);
+    } else {
+        console.log("[loom-agent] bundled bun not present for " + process.platform + "-" + process.arch + " (optional dep skipped?) - shims will use bun from PATH, or fall back to the Node REPL");
+    }
+    for (var i = 0; i < shimDirs().length; i++) {
+        var dir = shimDirs()[i];
+        var relPkg = path.relative(dir, pkgRoot).split(path.sep).join("/");
+        if (!relPkg || relPkg.startsWith("..")) continue;
+        for (var j = 0; j < 2; j++) {
+            var name = j === 0 ? "loom" : "loom-tui";
+            var script = name === "loom" ? "loom-bun.js" : "loom-tui.js";
+            var targets = [
+                [name + ".cmd", cmdShim(relPkg, script)],
+                [name + ".ps1", psShim(relPkg, script)],
+                [name, shShim(relPkg, script)]
+            ];
+            for (var k = 0; k < targets.length; k++) {
+                var file = targets[k][0];
+                var content = targets[k][1];
+                var p = path.join(dir, file);
+                if (!fs.existsSync(p)) continue;
+                fs.writeFileSync(p, content, { mode: 0o755 });
+                console.log("[loom-agent] rewrote shim " + p);
+            }
+        }
+    }
+} catch (err) {
+    console.warn("[loom-agent] shim rewrite skipped: " + (err && err.message));
+}

package/src/core/cli.js

@@ -38,7 +38,7 @@ class LoomCLI {
       terminal: true,
     });
     console.log(LOOM_BASE);
-    console.log(`\n  Loom Code v1.2.27 — AI Coding Agent for the terminal`);
+    console.log(`\n  Loom Code v1.2.28 — AI Coding Agent for the terminal`);
     console.log(`  Press Ctrl+C or ESC to interrupt | /help for commands\n`);
 
     process.stdin.on('keypress', (str, key) => {
@@ -460,7 +460,31 @@ class LoomCLI {
 }
 
 function findBun() {
-  // Check common installation paths
+  // 1. The bundled bun binary shipped via @oven/bun-<platform> optional deps
+  //    (npm i -g loom-agent brings its own bun — works with zero setup).
+  try {
+    const PKGS = {
+      'win32-x64': 'bun-windows-x64',
+      'win32-arm64': 'bun-windows-aarch64',
+      'darwin-x64': 'bun-darwin-x64',
+      'darwin-arm64': 'bun-darwin-aarch64',
+      'linux-x64': 'bun-linux-x64',
+      'linux-arm64': 'bun-linux-aarch64',
+    };
+    const short = PKGS[process.platform + '-' + process.arch];
+    if (short) {
+      const exe = process.platform === 'win32' ? 'bun.exe' : 'bun';
+      const pkgRoot = path.join(__dirname, '..', '..');
+      const candidates = [
+        path.join(pkgRoot, 'node_modules', '@oven', short, 'bin', exe), // nested
+        path.join(pkgRoot, '..', '@oven', short, 'bin', exe),           // hoisted
+      ];
+      for (const c of candidates) {
+        if (fs.existsSync(c)) return c;
+      }
+    }
+  } catch {}
+  // 2. Common installation paths
   const paths = [
     path.join(os.homedir(), '.bun', 'bin', 'bun.exe'),
     path.join(os.homedir(), '.bun', 'bin', 'bun'),
@@ -471,7 +495,7 @@ function findBun() {
   for (const p of paths) {
     if (fs.existsSync(p)) return p;
   }
-  // Search PATH (Windows: where.exe, POSIX: which)
+  // 3. Search PATH (Windows: where.exe, POSIX: which)
   try {
     const { execSync } = require('child_process');
     const isWin = process.platform === 'win32';
@@ -575,19 +599,22 @@ if (args.includes('--help') || args.includes('-h')) {
       const tuiEntry = path.join(__dirname, '..', 'tui-open.tsx');
       if (bunPath && fs.existsSync(tuiEntry)) {
         const { spawnSync } = require('child_process');
-        // Start bun from the package root so it discovers bunfig.toml /
-        // tsconfig.json (Solid JSX preloader) even for global installs;
-        // LOOM_START_CWD restores the user's project dir in tui-bootstrap.js.
+        // The Solid JSX preloader is registered inside src/tui-preload.js
+        // (passed as an ABSOLUTE --preload path), so bun starts directly in
+        // the user's project directory. The old "start at the package root,
+        // chdir to the project inside tui-open" dance froze the TUI after
+        // the first frame (no repaints, no keyboard input) — see
+        // bin/loom-bun.js.
         const pkgRoot = path.join(__dirname, '..', '..');
+        const tuiPreload = path.join(pkgRoot, 'src', 'tui-preload.js');
         process.env.LOOM_START_CWD = process.cwd();
         process.env.LOOM_BIN_NAME = "loom";
-        process.env.BUN_CONFIG = path.join(pkgRoot, "bunfig.toml");
-        const tuiArgs = [tuiEntry];
+        const tuiArgs = ['--preload', tuiPreload, tuiEntry];
         if (sessionId) tuiArgs.push('-s', sessionId);
         if (autoMode) tuiArgs.push('--auto');
         const prompt = promptArgs.join(' ');
         if (prompt) tuiArgs.push(...prompt.split(/\s+/));
-        process.exit(spawnSync(bunPath, tuiArgs, { stdio: 'inherit', cwd: pkgRoot, env: process.env }).status ?? 0);
+        process.exit(spawnSync(bunPath, tuiArgs, { stdio: 'inherit', cwd: process.cwd(), env: process.env }).status ?? 0);
       }
       console.error('[loom] bun not found — full TUI requires bun (https://bun.sh/). Falling back to line-mode REPL.');
       console.error('[loom] Use --basic to skip this warning.\n');

package/src/mcp/mcp-client.js

@@ -1,4 +1,34 @@
 const { spawn } = require('child_process');
+// Minimal OS/runtime baseline handed to every spawned MCP server (see note in
+// connectToJson). Explicit cfg.env keys are layered on top per server.
+const MCP_ENV_KEYS = [
+  'PATH', 'PATHEXT', 'COMSPEC', 'SystemRoot', 'windir', 'SystemDrive',
+  'TEMP', 'TMP', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',
+  'PROGRAMFILES', 'PROGRAMDATA', 'ALLUSERSPROFILE', 'COMMONPROGRAMFILES',
+  'PROCESSOR_ARCHITECTURE', 'NUMBER_OF_PROCESSORS', 'OS',
+  'COMPUTERNAME', 'USERNAME', 'LANG', 'TZ', 'TERM', 'SHELL',
+  'XDG_CONFIG_HOME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY',
+];
+/** @returns {Record<string,string>} filtered copy of process.env */
+function buildMcpBaseEnv() {
+  const out = /** @type {Record<string,string>} */ ({});
+  for (const k of MCP_ENV_KEYS) {
+    const v = process.env[k];
+    if (v !== undefined) out[k] = v;
+  }
+  return out;
+}
+const MCP_BASE_ENV = buildMcpBaseEnv();
+
+/**
+ * Compose the environment for one MCP server process: the filtered baseline
+ * plus whatever that server's config explicitly declares (cfg.env wins).
+ * @param {{env?: Record<string,string|undefined>|null}} cfg
+ * @returns {Record<string,string>}
+ */
+function mcpSpawnEnv(cfg) {
+  return Object.assign({}, MCP_BASE_ENV, cfg.env || {});
+}
 const { loadServers } = require('./mcp-manager');
 
 let toolCachePromise = null;
@@ -22,9 +52,19 @@ function killTree(child) {
 
 function connectToJson(cfg, timeoutMs) {
   return new Promise((resolve, reject) => {
+    // MCP servers are third-party processes. Inheriting the parent's FULL
+    // environment would hand every provider API key / cloud token / cookie in
+    // the user's shell to whatever npm package a config spawns. Instead pass a
+    // minimal OS/runtime baseline plus only what cfg.env explicitly declares —
+    // per-server secrets belong in the server's own env config, not leaked by
+    // inheritance. (network proxies forwarded; they carry routing, not auth.)
+    // Per-server environment via allowlist + explicit cfg.env only — see
+    // buildMcpBaseEnv/mcpSpawnEnv above; inheriting all of process.env would
+    // leak provider keys to every third-party server.
+    const env = mcpSpawnEnv(cfg);
     const child = spawn(cfg.command, cfg.args || [], {
       stdio: ['pipe', 'pipe', 'pipe'],
-      env: Object.assign({}, process.env, cfg.env || {}),
+      env,
       // No console window for stdio MCP servers: on Windows spawn() would
       // otherwise pop a flashing console up and down while chats happen.
       windowsHide: true,
@@ -198,4 +238,4 @@ function getCachedTools() {
   return warm();
 }
 
-module.exports = { getTools, getCachedTools, clearCache, buildToolName, callTool, warm, callRpc, killTree };
+module.exports = { getTools, getCachedTools, clearCache, buildToolName, callTool, warm, callRpc, killTree, buildMcpBaseEnv, mcpSpawnEnv };

package/src/skills/skills-manager.js

@@ -11,6 +11,19 @@ function validateUrl(url) {
   } catch { return false; }
 }
 
+/**
+ * Reduce an install target to a single safe folder name under ~/.loom/skills.
+ * Strict allowlist (alnum/_/./-, ≤64 chars): drives, separators and '..'
+ * segments are rejected outright, never silently collapsed, so remote-provided
+ * names can't rename unexpectedly or point outside the skills directory.
+ * @param {unknown} name
+ * @returns {string|null} cleaned single-segment name, or null when unusable
+ */
+function safeSkillName(name) {
+  const s = typeof name === 'string' ? name.trim() : '';
+  return /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(s) ? s : null;
+}
+
 const LOOM_DIR = path.join(os.homedir(), '.loom');
 
 function globalSkillsDir() {
@@ -111,8 +124,17 @@ function installFrom(srcDir, targetName) {
   if (!fs.existsSync(path.join(src, 'SKILL.md'))) {
     return { error: `No SKILL.md in ${src}` };
   }
-  const name = targetName || path.basename(src);
-  const dest = path.join(globalSkillsDir(), name);
+  const name = safeSkillName(targetName != null ? targetName : path.basename(src));
+  if (!name) {
+    return { error: `Invalid skill name: ${JSON.stringify(targetName)} — use letters/digits/-/_ only` };
+  }
+  const destRoot = globalSkillsDir();
+  const dest = path.join(destRoot, name);
+  // Paranoia check: `name` is already a sanitized single segment, so this can
+  // not trip short of path.join behavior changing underneath us.
+  if (path.resolve(dest) !== path.join(path.resolve(destRoot), name)) {
+    return { error: 'Invalid install location' };
+  }
   if (fs.existsSync(dest)) {
     fs.rmSync(dest, { recursive: true, force: true });
   }
@@ -210,4 +232,5 @@ module.exports = {
   globalSkillsDir,
   agentsSkillsDir,
   projectSkillsDir,
+  safeSkillName,
 };

package/src/tools/index.js

@@ -5,6 +5,7 @@ const { execSync, spawn } = require('child_process');
 const { glob: globLib } = require('glob');
 const { commandRiskLabel } = require('../core/permissions');
 const { loadConfig } = require('../config/settings');
+const dnsPromises = require('dns').promises;
 
 const cwd = process.cwd();
 
@@ -15,6 +16,74 @@ function globIgnore(full) {
   return ['node_modules', '.git'].map((n) => path.posix.join(base, '**', n, '**'));
 }
 
+// ---------------------------------------------------------------------------
+// SSRF guard (webfetch)
+//
+// The agent model decides which URLs webfetch opens, and prompt-injected page
+// content can steer it toward "check http://169.254.169.254/latest/meta-data"
+// or "read localhost:5984/_config". Those must fail closed:
+//   - only http/https, never file:/ftp:/data: transport tricks
+//   - loopback, link-local (cloud metadata!), RFC1918 private ranges, CGNAT,
+//     IPv6 ULA/link-local and IPv4-mapped addresses are refused
+//   - hostnames are resolved BEFORE connecting so a DNS name pointing into
+//     internal space is caught (checking the literal hostname is not enough)
+//   - redirects are followed manually and every hop re-checked, because a
+//     public URL can bounce straight at an internal one
+// ---------------------------------------------------------------------------
+/**
+ * True when an IPv4/IPv6 address string falls in a range the agent must never
+ * fetch (loopback, link-local/metadata, private, CGNAT, malformed).
+ * @param {string} ip
+ * @returns {boolean}
+ */
+function isPrivateAddress(ip) {
+  const s = String(ip || '').toLowerCase();
+  // IPv6 handling first: exact forms and prefix families we care about.
+  if (s.includes(':')) {
+    let bare = s.replace(/^\[|\]$/g, '');
+    if (bare === '::' || bare === '::1') return true;
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(bare);
+    if (mapped) return isPrivateAddress(mapped[1]);
+    if (/^f[cd][0-9a-f]{2}:/.test(bare)) return true;      // fc00::/7 ULA
+    if (/^fe[89ab][0-9a-f]:/.test(bare)) return true;      // fe80::/10 link-local
+    if (/^2001:db8:/.test(bare)) return true;              // documentation
+    return false;
+  }
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
+  if (!m) return false;
+  const o = m.slice(1).map(Number);
+  if (o.some((x) => x > 255)) return true;                 // malformed → refuse
+  const [a, b] = o;
+  return (
+    a === 0 ||                                             // this-network
+    a === 10 ||                                            // RFC1918
+    a === 127 ||                                           // loopback
+    (a === 100 && b >= 64 && b <= 127) ||                  // CGNAT 100.64/10
+    (a === 169 && b === 254) ||                            // link-local / metadata
+    (a === 172 && b >= 16 && b <= 31) ||                   // RFC1918
+    (a === 192 && b === 168)                               // RFC1918
+  );
+}
+
+/**
+ * Resolve a URL's host and report whether every resolved address is public.
+ * Unresolvable hosts fail closed (false).
+ * @param {URL} u
+ * @returns {Promise<boolean>}
+ */
+async function urlIsPublic(u) {
+  const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  if (!host || host === 'localhost' || host.endsWith('.localhost')) return false;
+  if (isPrivateAddress(host)) return false;
+  let addrs;
+  try {
+    addrs = /** @type {{address: string}[]} */ (await dnsPromises.lookup(host, { all: true }));
+  } catch {
+    return false;
+  }
+  return addrs.length > 0 && addrs.every((a) => !isPrivateAddress(a.address));
+}
+
 const MODES = ['build', 'plan', 'chat'];
 
 // Tools that never mutate the filesystem/state — safe to expose in plan mode.
@@ -251,10 +320,36 @@ const TOOLS = {
       url: { type: 'string', required: true, description: 'URL to fetch' },
     },
     async execute(params) {
+      let u;
       try {
-        const resp = await fetch(params.url, { signal: AbortSignal.timeout(15000) });
-        const text = await resp.text();
-        return text.slice(0, 10000);
+        u = new URL(String(params.url || ''));
+      } catch {
+        return { error: 'Invalid URL' };
+      }
+      if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        return { error: 'Blocked by webfetch policy: only http/https URLs are allowed' };
+      }
+      try {
+        // Follow redirects manually so every hop passes the SSRF guard — a
+        // public URL may legitimately bounce into an internal address.
+        let current = u;
+        const signal = AbortSignal.timeout(15000);
+        for (let hop = 0; hop < 5; hop++) {
+          if (!(await urlIsPublic(current))) {
+            return { error: `Blocked by webfetch policy: ${current.hostname} resolves to a private/reserved address (SSRF guard)` };
+          }
+          const resp = await fetch(current.toString(), { redirect: 'manual', signal });
+          if ([301, 302, 303, 307, 308].includes(resp.status)) {
+            const loc = resp.headers.get('location');
+            try { resp.body && resp.body.cancel(); } catch {}
+            if (!loc) return { error: `Fetch failed: redirect ${resp.status} without Location header` };
+            current = new URL(loc, current);
+            continue;
+          }
+          const text = await resp.text();
+          return text.slice(0, 10000);
+        }
+        return { error: 'Fetch failed: too many redirects' };
       } catch (e) {
         return { error: `Fetch failed: ${e.message}` };
       }
@@ -540,4 +635,4 @@ async function getAllToolDefinitions(mode = 'build') {
   }
 }
 
-module.exports = { TOOLS, MODES, READ_ONLY_TOOLS, getToolDefinitions, getAllToolDefinitions, executeTool };
+module.exports = { TOOLS, MODES, READ_ONLY_TOOLS, getToolDefinitions, getAllToolDefinitions, executeTool, isPrivateAddress };

package/src/tui/components/Modals.tsx

@@ -1,5 +1,5 @@
 // Modals -- provider picker, model picker, key input, base URL, settings, palette.
-import { createSignal, onMount } from "solid-js";
+import { createSignal, createMemo, onMount } from "solid-js";
 import { useKeyboard, usePaste } from "@opentui/solid";
 import { palette } from "../theme.ts";
 import * as kbs from "../keybinds.ts";
@@ -206,17 +206,25 @@ export function SelectModal(props: {
   // Start on the first real row (not a header).
   setIndex(firstSelectable());
 
+  // Hover must not fight scrolling: any keyboard/wheel/search index change
+  // locks hover-selection briefly, so the list sliding under a stationary
+  // cursor cannot yank the selection back (this feedback loop read as
+  // "jitter" while scrolling the model picker).
+  let hoverLockUntil = 0;
+  const lockHover = () => { hoverLockUntil = Date.now() + 250; };
+  const setIndexByKey = (fn: (i: number) => number) => { setIndex(fn); lockHover(); };
+
   const nav = kbNav();
 
   useKeyboard(key => {
     const ks = kbs.keyString(key);
     if (kbs.is("modal_cancel", ks)) { closeModal(); if (props.onCancel) props.onCancel(); return; }
-    if (kbs.dialogIs("dialog_select_prev", ks)) { setIndex(i => stepSelectable(i, -1)); firePreview(); return; }
-    if (kbs.dialogIs("dialog_select_next", ks)) { setIndex(i => stepSelectable(i, 1)); firePreview(); return; }
-    if (kbs.dialogIs("dialog_select_page_up", ks)) { setIndex(i => pageJump(i, -1)); firePreview(); return; }
-    if (kbs.dialogIs("dialog_select_page_down", ks)) { setIndex(i => pageJump(i, 1)); firePreview(); return; }
-    if (kbs.dialogIs("dialog_select_home", ks)) { setIndex(firstSelectable()); firePreview(); return; }
-    if (kbs.dialogIs("dialog_select_end", ks)) { setIndex(lastSelectable()); firePreview(); return; }
+    if (kbs.dialogIs("dialog_select_prev", ks)) { setIndexByKey(i => stepSelectable(i, -1)); firePreview(); return; }
+    if (kbs.dialogIs("dialog_select_next", ks)) { setIndexByKey(i => stepSelectable(i, 1)); firePreview(); return; }
+    if (kbs.dialogIs("dialog_select_page_up", ks)) { setIndexByKey(i => pageJump(i, -1)); firePreview(); return; }
+    if (kbs.dialogIs("dialog_select_page_down", ks)) { setIndexByKey(i => pageJump(i, 1)); firePreview(); return; }
+    if (kbs.dialogIs("dialog_select_home", ks)) { setIndexByKey(firstSelectable); firePreview(); return; }
+    if (kbs.dialogIs("dialog_select_end", ks)) { setIndexByKey(lastSelectable); firePreview(); return; }
     if (kbs.dialogIs("dialog_select_submit", ks)) {
       const opt = filtered()[index()];
       if (!opt || opt.isHeader) return;
@@ -226,11 +234,11 @@ export function SelectModal(props: {
     if (props.searchable) {
       // Reset to 0, not firstSelectable(): setQ is batched, so firstSelectable()
       // would read the STALE list and land past its end (dead arrows/blank row).
-      if (key.name === "backspace") { setQ(v => v.slice(0, -1)); setIndex(0); firePreview(); return; }
+      if (key.name === "backspace") { setQ(v => v.slice(0, -1)); setIndexByKey(() => 0); firePreview(); return; }
       const s = key.sequence;
       if (!key.ctrl && !key.meta && s && s.length <= 10 && s !== "\r" && s !== "\n") {
         setQ(v => v + s);
-        setIndex(0);
+        setIndexByKey(() => 0);
         firePreview();
         return;
       }
@@ -246,7 +254,7 @@ export function SelectModal(props: {
       if (j === i) break;
       i = j;
     }
-    setIndex(i);
+    setIndexByKey(() => i);
   };
   const clickRow = (i: number) => {
     if (i !== index()) {
@@ -257,12 +265,14 @@ export function SelectModal(props: {
     if (o?.isHeader) return;
     props.onPick(o?.value, o);
   };
-  let winStart = 0;
-  const win = () => {
+  // Window of 12 rows, computed ONCE per reactive change (the old version
+  // mutated `winStart` from inside the JSX — called three times per render).
+  let lastStart = 0;
+  const win = createMemo(() => {
     const total = filtered().length;
-    winStart = windowFor(index(), total, 12, winStart);
-    return { total, start: winStart, items: filtered().slice(winStart, winStart + 12) };
-  };
+    lastStart = windowFor(index(), total, 12, lastStart);
+    return { total, start: lastStart, items: filtered().slice(lastStart, lastStart + 12) };
+  });
   const rangeSub = () => {
     const w = win();
     if (w.total <= 12) return "";
@@ -271,21 +281,27 @@ export function SelectModal(props: {
 
   return (
     <ModalFrame title={props.title} subtitle={(props.searchable ? "search: " + (q() || "_") + rangeSub() : rangeSub())} footer={nav.prev + "/" + nav.next + " navigate  |  " + nav.submit + " select  |  wheel scroll  |  " + nav.cancel + " cancel" + (props.searchable ? "  |  type to search" : "")}>
-      <box onMouseScroll={scrollBy}>
+      {/* Fixed height: the modal frame must not resize while scrolling.
+          Headers used to add an extra margin row, so the centered modal
+          bounced between 12/13/14 rows on every page of a header-heavy list
+          (the model picker) — the "jitter". Every item is now exactly one
+          row and the window is always 12 rows tall. */}
+      <box onMouseScroll={scrollBy} height={12} flexShrink={0}>
         {win().items.map((opt, i) => {
           const abs = win().start + i;
           if (opt.isHeader) return (
-            <text fg={ui.secondary} marginTop={i === 0 ? 0 : 1}>
+            <text fg={ui.secondary}>
               {opt.header + ":"}
             </text>
           );
           const active = abs === index();
           return (
             <box
- flexDirection="row" paddingLeft={2}
-              // Hover moves the selection (live theme preview via onPreview);
-              // a click on the hovered row still selects+submits.
-              onMouseOver={() => { if (abs !== index()) { setIndex(abs); firePreview(); } }}
+              flexDirection="row" paddingLeft={2}
+              // Hover moves the selection (live theme preview via onPreview) —
+              // but only for genuine pointer movement, never while a
+              // keyboard/wheel scroll is settling (see hoverLockUntil).
+              onMouseOver={() => { if (Date.now() >= hoverLockUntil && abs !== index()) { setIndex(abs); firePreview(); } }}
               onMouseDown={() => setIndex(abs)}
               onMouseUp={() => clickRow(abs)}
             >

package/src/tui-preload.js

@@ -51,6 +51,61 @@ globalThis.__loomTrace = record;
 process.on("uncaughtException", (e) => record("uncaughtException", e));
 process.on("unhandledRejection", (r) => record("unhandledRejection", r));
 
+// Global npm installs live INSIDE node_modules, and @opentui/solid's loader
+// filter deliberately skips every node_modules path — so for installs the
+// app's own TSX would fall through to Bun's default React JSX transform and
+// crash at startup ("Cannot find module 'react/jsx-dev-runtime'").
+//
+// This preload is THE single registration point for the TUI launch chain
+// (shims and respawns pass ONLY this file via --preload, with an absolute
+// path), so it registers both plugins itself:
+//   1. The Solid JSX plugin — via the bare "@opentui/solid/bun-plugin"
+//      specifier, which resolves by walking up from this file and therefore
+//      works whether the dependency is nested inside the package or hoisted
+//      to the install root. Idempotent (symbol-guarded upstream).
+//   2. A supplemental loader scoped to THIS package's src directory only —
+//      real dependencies are never touched. It is a no-op in repo checkouts,
+//      where the solid plugin (non-node_modules paths) already handles these
+//      files first.
+if (typeof Bun !== "undefined" && Bun.plugin) {
+  try {
+    require("@opentui/solid/bun-plugin").ensureSolidTransformPlugin();
+  } catch {}
+  if (!globalThis.__loomAppTsxPlugin) {
+    try {
+      globalThis.__loomAppTsxPlugin = true;
+      const pkgSrc = __dirname; // tui-preload.js lives in src/
+      const pkgRoot = path.join(pkgSrc, "..");
+      const esc = pkgSrc.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      // Layout-proof transform lookup: nested (npm i -g default observed)
+      // and hoisted (top-level install node_modules) candidates.
+      const candidates = [
+        path.join(pkgRoot, "node_modules", "@opentui", "solid", "scripts", "solid-transform.js"),
+        path.join(pkgRoot, "..", "..", "@opentui", "solid", "scripts", "solid-transform.js"),
+      ];
+      let transformSolidSource = null;
+      for (const c of candidates) {
+        try { transformSolidSource = require(c).transformSolidSource; break; } catch {}
+      }
+      if (transformSolidSource) {
+        Bun.plugin({
+          name: "loom-app-solid-tsx",
+          setup(build) {
+            build.onLoad({ filter: new RegExp("^" + esc + "[\\\\/].+\\.tsx$") }, async (args) => {
+              const code = await Bun.file(args.path).text();
+              const contents = await transformSolidSource(code, {
+                filename: args.path,
+                moduleName: "@opentui/solid",
+              });
+              return { contents, loader: "js" };
+            });
+          },
+        });
+      }
+    } catch {}
+  }
+}
+
 // stdout byte-counter: frames flowing = counter climbs. This splits the two
 // remaining frozen-splash suspects with certainty — if the counter climbs but
 // the screen is frozen, the console is dropping VT repaints (mode flags); if

package/src/web/web-server.js

@@ -111,22 +111,47 @@ function readBody(req, limit = 1_048_576) {
 
 function sendJson(res, status, obj) {
   const body = JSON.stringify(obj);
-  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
+  res.writeHead(status, Object.assign(securityHeaders(), {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': Buffer.byteLength(body),
+  }));
   res.end(body);
 }
 
 function sendText(res, status, text, extra) {
-  const headers = Object.assign({ 'Content-Type': 'text/plain; charset=utf-8', 'Content-Length': Buffer.byteLength(text) }, extra || {});
+  const headers = Object.assign(securityHeaders(), {
+    'Content-Type': 'text/plain; charset=utf-8',
+    'Content-Length': Buffer.byteLength(text),
+  }, extra || {});
   res.writeHead(status, headers);
   res.end(text);
 }
 
+// Baseline hardening on every response: stops MIME sniffing, clickjacking
+// and referrer leakage. The API is JSON-only and index.html is a single
+// self-contained page (one inline script, no external assets), so this
+// cannot break the UI.
+const SECURITY_HEADERS = {
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'DENY',
+  'Referrer-Policy': 'no-referrer',
+};
+const HTML_SECURITY_HEADERS = Object.assign({}, SECURITY_HEADERS, {
+  'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self' data:; connect-src 'self'",
+});
+/** @returns {Record<string,string>} fresh copy so callers can extend safely */
+function securityHeaders() {
+  return Object.assign({}, SECURITY_HEADERS);
+}
+
 // ── The web server ──────────────────────────────────────────────────────
 
 function createWebServer(opts) {
-  const tokens = new Map(); // token -> true (in-memory auth, server-lifetime)
+  const tokens = new Map(); // token -> issued-at ms (auth is server-lifetime, per-token TTL)
   const password = process.env.LOOM_SERVER_PASSWORD || '';
   const username = process.env.LOOM_SERVER_USERNAME || DEFAULT_USERNAME;
+  const tokenTtlMs =
+    Number((opts && opts.tokenTtlMs) || process.env.LOOM_SERVER_TOKEN_TTL_MS) || 12 * 60 * 60 * 1000;
   const hub = new Map(); // sessionId -> { session, active }
   const stats = { requests: 0, sessionsCreated: 0, messagesRun: 0 };
   const authFails = new Map(); // ip -> { count, lockedUntil }
@@ -173,10 +198,27 @@ function createWebServer(opts) {
 
   function authOk(req) {
     if (!password) return true;
+    sweepTokens();
     const cookieHeader = req.headers.cookie || '';
     const token = /(?:^|;\s*)loom_token=([^;\s]+)/.exec(cookieHeader)?.[1]
       || new URL(req.url, 'http://x').searchParams.get('token');
-    return !!(token && tokens.has(token));
+    return !!(token && tokenIsLive(token));
+  }
+
+  // Tokens are stamped at issue time and expire after tokenTtlMs (default 12h,
+  // env LOOM_SERVER_TOKEN_TTL_MS). Sweep runs opportunistically on each auth
+  // check — the map holds only this server's logins, so it stays tiny.
+  function tokenIsLive(token) {
+    const issuedAt = tokens.get(token);
+    if (typeof issuedAt !== 'number') return false;
+    return Date.now() - issuedAt <= tokenTtlMs && Date.now() >= issuedAt - 60_000;
+  }
+  function sweepTokens() {
+    if (!tokens.size) return;
+    const now = Date.now();
+    for (const [tok, issuedAt] of tokens) {
+      if (typeof issuedAt === 'number' && now - issuedAt > tokenTtlMs) tokens.delete(tok);
+    }
   }
 
   function requireAuth(req, res) {
@@ -266,8 +308,8 @@ function createWebServer(opts) {
           if (body.username === username && passwordMatches(body.password, password)) {
             authFails.delete(ip);
             const token = crypto.randomBytes(24).toString('hex');
-            tokens.set(token, true);
-            res.setHeader('Set-Cookie', 'loom_token=' + token + '; Path=/; HttpOnly; SameSite=Strict');
+            tokens.set(token, Date.now());
+            res.setHeader('Set-Cookie', 'loom_token=' + token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + Math.floor(tokenTtlMs / 1000));
             return sendJson(res, 200, { ok: true, username });
           }
           authAttemptFailed(ip);
@@ -277,6 +319,16 @@ function createWebServer(opts) {
       return sendJson(res, 200, { required: !password ? false : true, username: password ? username : null });
     }
 
+    // POST /api/auth/logout — revoke the presented session token immediately.
+    if (seg[0] === 'api' && seg.length === 3 && seg[1] === 'auth' && seg[2] === 'logout') {
+      if (req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' });
+      const cookieHeader = req.headers.cookie || '';
+      const token = /(?:^|;\s*)loom_token=([^;\s]+)/.exec(cookieHeader)?.[1];
+      if (token) tokens.delete(token);
+      res.setHeader('Set-Cookie', 'loom_token=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0');
+      return sendJson(res, 200, { ok: true });
+    }
+
     if (seg[0] === 'api' && seg[1] === 'health') return sendJson(res, 200, { ok: true });
 
     if (!requireAuth(req, res)) return;
@@ -371,7 +423,10 @@ function createWebServer(opts) {
     if (p === '/' || p === '/index.html') {
       fs.readFile(INDEX_FILE, 'utf8', (err, html) => {
         if (err) return sendText(res, 500, 'index.html missing: ' + err.message);
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Content-Length': Buffer.byteLength(html) });
+        res.writeHead(200, Object.assign(HTML_SECURITY_HEADERS, {
+          'Content-Type': 'text/html; charset=utf-8',
+          'Content-Length': Buffer.byteLength(html),
+        }));
         res.end(html);
       });
       return;
@@ -445,6 +500,16 @@ async function main() {
 
   console.log('Loom Web — version ' + require('../../package.json').version);
   if (o.password) console.log('Authentication required — user: ' + o.username + ' (LOOM_SERVER_USERNAME)');
+  const exposedToLan = o.hostname === '0.0.0.0' || o.hostname === '::';
+  if (exposedToLan) {
+    console.log('! NETWORK EXPOSURE WARNING !');
+    if (!o.password) {
+      console.log('! Binding ' + o.hostname + ' WITHOUT a password: anyone on your LAN can run an AI agent ');
+      console.log('! on this machine and reach its tools/files. Set LOOM_SERVER_PASSWORD before exposing.');
+    } else {
+      console.log('! Bound to ' + o.hostname + ' — protected by login, but keep the port firewalled where possible.');
+    }
+  }
   for (const a of addresses) console.log('  ' + a.label + ':      ' + a.url);
   if (o.mdns) {
     const m = advertiseMdns(o, port, (msg) => console.error('[loom web] ' + msg));