loom-agent 1.2.33 → 1.2.37

package/CHANGELOG.md

@@ -4,6 +4,124 @@ All notable changes to **Loom Code** are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased] — completion harness, specialist agents, headless browser, TUI refresh
+
+### Added
+- **Drive-to-completion harness (`src/core/session.js`).** When the model ends
+  a turn with todos still pending/in_progress (the "stops between tasks"
+  failure), the loop injects a continuation listing the unfinished items — up
+  to 5 nudges per turn, build mode only, only when the turn actually wrote
+  todos. Cancelled/completed items via todowrite stop the nudging cleanly.
+  Child subagent sessions inherit the same guard.
+- **Transient provider-error retry.** Network blips / 5xx / stream resets now
+  retry the model call twice (side-effect free) instead of killing the turn
+  mid-task.
+- **Specialist subagents (`src/core/agents.js`)**: `research` (multi-source
+  investigation, sourced report), `coder` (isolated implementation),
+  `reviewer` (severity-ranked code review), `tester` (reproduce → test →
+  green), `web` (headless-browser work). All non-delegating (`no task tool`).
+- **Main orchestrator prompt.** The `build` primary agent now carries an
+  orchestrator role prompt (todo-first, delegate-to-specialists, verify,
+  finish). Primary-agent prompts are actually wired into the system prompt now
+  (`Session._primaryBlock()`) — previously `build`/`plan`/`chat` prompts were
+  registry-only and never reached the model.
+- **`browser` tool (`src/tools/browser.js`).** Headless Chromium control via
+  Playwright: goto/click/fill/press/text/eval/links/screenshot/close. Engine:
+  bundled `playwright` if installed, else `playwright-core` + system
+  Chrome/Edge. The page singleton persists across calls. Permissions: passive
+  reads allow, interactive click/fill/press ask.
+
+### Changed
+- **TUI design overhaul.** The splash leads with the full LOOM CODE wordmark
+  in solid terracotta over a separator rule and a pill-style status
+  row; the default "Loom Dark" (and Light) palettes got deeper surface
+  stepping so panels read without borders. Every selection surface — command
+  palette, slash/file popups, select modals, permission popup — now uses a
+  tinted active row with a `▸` marker; the command palette finally renders
+  each command's description; modals gained a title divider; toasts carry a
+  kind-colored status dot (● ok / ✖ error / ◆ info) and clip long text so
+  they never cover the chat. System notices sit on a tinted surface, the
+  assistant footer is brand-colored, markdown headings get an h1/h2/h3 color
+  hierarchy, the input placeholder color-codes /commands @file !shell, and
+  hard-coded reds now follow the theme's error color. Still grid-line-free in
+  the main view — color and spacing do the work, no box frames.
+- **Sidebar version now tracks `package.json`** (it was stuck at a hardcoded
+  v1.2.0 while the package moved on); splash and sidebar share one source.
+- **`task` tool description now lists every built-in subagent with its specialty.**
+- **Stop messages show the real state, not canned text.** Continuation nudges
+  now quote the model's ACTUAL last message plus the open todo list (instead
+  of one identical line every time); the empty-reply nudge reports the real
+  tool-call count; a build turn that ends with open todos returns them
+  (`resp.openTodos`) and the TUI appends "Stopped with N todo(s) still open: …"
+  with the actual items; the interrupt line reports kept chars + the
+  in-progress todo; the plan-complete line includes the planned step count;
+  "(no response)"/"(interrupted)" placeholders describe what happened.
+
+## [1.2.36] — fix `loom web` / `loom acp` / `loom attach`
+
+### Fixed
+- **`loom web` launched the TUI instead of the browser server.** Since 1.2.34
+  the npm shims prefer `bin/loom-bun.js`, whose non-TUI branch routed every
+  subcommand into `src/core/cli.js`'s interactive `main()` — which has no
+  handler for `web`/`acp`/`attach`, so control fell through to the full-screen
+  app (reproduced: splash painted, no HTTP listener). `bin/loom-bun.js` now
+  routes those three subcommands directly to their own entry points, exactly
+  like `bin/loom.js` always did. Verified end-to-end on a global install:
+  `/api/health` → 200, UI served, banner prints.
+
+## [1.2.35] — security hardening
+
+### Fixed
+- **webfetch SSRF guard (`src/tools/index.js`).** The fetch tool is driven by
+  the model, and prompt-injected page content could steer it at cloud
+  metadata (`169.254.169.254`), localhost services, or internal hosts.
+  webfetch now allows only `http:`/`https:` (no `file:`/`ftp:`/`data:`),
+  refuses loopback, RFC1918, CGNAT, link-local/metadata, IPv6 ULA/link-local
+  and IPv4-mapped targets, **resolves DNS before connecting** so
+  hostname→internal-IP tricks fail, follows redirects manually and re-checks
+  every hop, and fails closed on unresolvable hosts.
+- **MCP servers no longer inherit the full shell environment**
+  (`src/mcp/mcp-client.js`). Every spawned MCP server used to receive all of
+  `process.env` — provider API keys, cloud tokens, cookies — handing them to
+  whatever npm package a config starts. Servers now get a minimal OS/runtime
+  baseline (PATH, ComSpec, TEMP/HOME, proxy vars) plus only what their own
+  config explicitly declares (`cfg.env`). Secrets are opt-in per server.
+- **Skills install name traversal blocked (`src/skills/skills-manager.js`).**
+  A remote-provided install name like `../../escapee` was joined raw onto
+  `~/.loom/skills`. Names are now a strict allowlist
+  (`^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$`); traversal attempts error instead of
+  silently renaming or escaping the skills directory.
+
+### Added
+- **`loom web` session hardening (`src/web/web-server.js`).** Login tokens
+  previously lived until server restart; they now expire after **12 h**
+  (tunable via `LOOM_SERVER_TOKEN_TTL_MS`, cookie `Max-Age` kept in sync), a
+  lazy sweep drops expired tokens, and new **`POST /api/auth/logout`**
+  revokes the presented token immediately.
+- **Security headers on every response:** `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY`, `Referrer-Policy: no-referrer`; the browser UI
+  additionally ships a strict `Content-Security-Policy`
+  (`default-src 'none'; connect-src 'self'` — the page is self-contained).
+- **LAN-exposure warning:** `loom web --hostname 0.0.0.0` (or `::`) without
+  `LOOM_SERVER_PASSWORD` now prints an explicit warning that anyone on the
+  network can run an agent and reach its tools/files.
+- **New regression suite `src/tools/security.test.js`** plus five web-server
+  hardening tests (headers, CSP, token TTL expiry, Max-Age sync, logout).
+
+## [1.2.34] — bundle bun with the npm install
+
+### Added
+- **`npm i -g loom-agent` now brings its own bun.** The `@oven/bun-<platform>`
+  binaries (pinned to bun 1.3.14, the version the project builds against) ship
+  as `optionalDependencies`; npm downloads only the one matching the user's
+  OS/arch, and no install scripts are involved (npm allow-scripts policies
+  cannot break it). The postinstall rewrites the `loom` shims to prefer the
+  bundled binary, then `bun` from PATH.
+- **No-bun users are never stranded:** if neither the bundled binary nor a
+  PATH bun exists, the shim falls back to `node bin/loom.js` (the line-mode
+  REPL) with a hint — instead of dying with "'bun' is not recognized".
+  `findBun()` and the bin respawn paths check the bundled location first too.
+
 ## [1.2.33] — fix frozen splash on global installs + stable model picker
 
 ### Fixed

package/README.md

@@ -1,8 +1,18 @@
-# Loom Code
+```
+ ██╗      ██████╗  ██████╗ ███╗   ███╗      ██████╗ ██████╗ ██████╗ ███████╗
+ ██║     ██╔═══██╗██╔═══██╗████╗ ████║     ██╔════╝██╔═══██╗██╔══██╗██╔════╝
+ ██║     ██║   ██║██║   ██║██╔████╔██║     ██║     ██║   ██║██║  ██║█████╗
+ ██║     ██║   ██║██║   ██║██║╚██╔╝██║     ██║     ██║   ██║██║  ██║██╔══╝
+ ███████╗╚██████╔╝╚██████╔╝██║ ╚═╝ ██║     ╚██████╗██████╔╝██████╔╝███████╗
+ ╚══════╝ ╚═════╝  ╚═════╝ ╚═╝     ╚═╝      ╚═════╝╚═════╝ ╚═════╝ ╚══════╝
+```
 
 [![npm version](https://img.shields.io/npm/v/loom-agent?style=flat&color=blue)](https://www.npmjs.com/package/loom-agent)
 [![License: MIT](https://img.shields.io/npm/l/loom-agent?style=flat&color=green)](LICENSE)
 [![Platform: Win/Mac/Linux](https://img.shields.io/badge/platform-Win--Mac--Linux-orange)](#)
+[![Website: loomcluster.in](https://img.shields.io/badge/website-loomcluster.in-success)](https://loomcluster.in/)
+
+![Loom Code splash — connected to NVIDIA](docs/screenshot.png)
 
 An AI-powered coding agent for the terminal with multi-provider support and a full terminal UI.
 
@@ -20,7 +30,8 @@ An AI-powered coding agent for the terminal with multi-provider support and a fu
 - Session memory, /undo, /redo, /compact, /reset, /fork
 - One-shot print mode: `loom -p "query"`
 - Editor integration via the Agent Client Protocol (ACP): `loom acp` (JSON-RPC over stdio) so Zed, JetBrains, and Neovim plugins can drive Loom as their coding agent
-- Browser interface via `loom web` — a zero-dependency Node HTTP server (chat in the browser, password auth, CORS) plus `loom attach` to share the same server from the terminal; optional mDNS advertising as `loom.local` via [bonjour-service](https://www.npmjs.com/package/bonjour-service)
+- OpenCode-style agent harness: main orchestrator agent delegates to specialist subagents (`research`, `coder`, `reviewer`, `tester`, `web`, `explore`, `scout`) via the `task` tool, and a drive-to-completion loop keeps working while todos are still open
+- Headless browser tool (`browser`) — navigate, click, fill, read the DOM, and screenshot real pages from the `web` agent
 - Usage & billing tracking per session + lifetime
 
 ## Prerequisites
@@ -40,7 +51,7 @@ An AI-powered coding agent for the terminal with multi-provider support and a fu
 
 Install from npm (global — installs the `loom` command):
 ```bash
-npm install -g loom-code
+npm install -g loom-agent
 ```
 
 Or run from source:
@@ -93,35 +104,8 @@ loom --version
 loom --help
 loom --basic                      # skip TUI, use line-mode REPL
 loom acp                          # ACP subprocess mode for editor integrations
-loom web                          # browser interface (HTTP server, opens browser)
-loom attach http://localhost:4096 # attach the terminal to a running loom web
 ```
 
-## Web
-
-Loom runs in your browser with `loom web` — a zero-dependency HTTP server that
-serves a single-page UI and drives the same core session loop as the TUI. Same
-providers/models, tools, MCP servers, and saved sessions; chat streams live in
-the browser, and a shared terminal client can attach to the same server.
-
-```bash
-loom web                           # 127.0.0.1, random port, opens the browser
-loom web --port 4096               # fixed port
-loom web --hostname 0.0.0.0        # reachable on the LAN
-loom web --mdns                    # advertise as loom.local (implies 0.0.0.0)
-loom web --mdns-domain proj.local  # custom mDNS domain
-loom web --cors https://example.com
-LOOM_SERVER_PASSWORD=secret loom web   # password-protect (user: LOOM_SERVER_USERNAME, default "loom")
-
-# Attach the terminal (shares the server's sessions/state):
-loom attach http://localhost:4096
-```
-
-Config-file equivalent (`~/.loom/config.json`): `{ "server": { "port": 4096,
-"hostname": "0.0.0.0", "mdns": true, "cors": ["https://example.com"] } }` — CLI
-flags take precedence. Full flags, the JSON API, and `loom attach` options are
-documented in **[docs/web.md](docs/web.md)**.
-
 ## Editor integration (ACP)
 
 Loom implements the [Agent Client Protocol (ACP)](https://agentclientprotocol.com)

package/bin/loom-bun.js

@@ -1,68 +1,96 @@
-#!/usr/bin/env bun
-// npm invokes bin targets through Node on Windows, so re-launch under Bun
-// when this file was not started by Bun itself.
-const path = require("path");
-const fs = require("fs");
-const { spawnSync } = require("child_process");
-
-// The Solid JSX transform must register in Bun's preload phase, so the
-// preloads are passed as ABSOLUTE paths. That lets Bun start directly in the
-// user's project directory — the old "spawn at the package root, then chdir
-// to the project inside tui-open.tsx" dance froze the TUI after the first
-// frame (splash paints once, then no repaints and no keyboard input; proven
-// by A/B-launching the identical entry with and without the mid-flight
-// process.chdir). No chdir ever happens now: LOOM_START_CWD always equals
-// the starting directory, so the restore in tui-open.tsx is a no-op kept
-// only as a safety net.
-const pkgRoot = path.join(__dirname, "..");
-const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
-if (!underBun) {
-  const result = spawnSync(
-    process.platform === "win32" ? "bun.exe" : "bun",
-    [
-      "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
-      __filename,
-      ...process.argv.slice(2),
-    ],
-    {
-      stdio: "inherit",
-      cwd: process.env.LOOM_START_CWD || process.cwd(),
-      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
-      windowsHide: false,
-    }
-  );
-  if (result.error) {
-    console.error("[loom] Bun is required for the full CLI. Install it from https://bun.sh/");
-    process.exit(1);
-  }
-  process.exit(result.status == null ? 1 : result.status);
-}
-process.title = "loom-code";
-(async () => {
-  try {
-    // The npm bin entry bypasses src/index.js, so load dotenv here for both
-    // the package environment and the project from which `loom` was run.
-    const dotenv = require("dotenv");
-    dotenv.config({ path: path.join(__dirname, "..", ".env") });
-    const startCwd = process.env.LOOM_START_CWD || process.cwd();
-    const projectEnv = path.join(startCwd, ".env");
-    if (fs.existsSync(projectEnv)) dotenv.config({ path: projectEnv, override: false });
-    // The npm global shim can start Bun outside the package directory, so do
-    // not depend on bunfig.toml discovery for Windows console setup.
-    await import("../src/tui-preload.js");
-    const args = process.argv.slice(2);
-    const coreMode = args.includes("--basic") || args.includes("-p") || args.includes("--print")
-      || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v")
-      || ["acp", "web", "attach", "graph"].includes(args[0]);
-    if (!coreMode) {
-      await import("@opentui/solid/preload");
-      await import("../src/tui-open.tsx");
-      return;
-    }
-    const { main } = require("../src/core/cli.js");
-    await main();
-  } catch (err) {
-    console.error(err && err.message ? err.message : String(err));
-    process.exit(1);
-  }
+#!/usr/bin/env bun
+// npm invokes bin targets through Node on Windows, so re-launch under Bun
+// when this file was not started by Bun itself.
+const path = require("path");
+const fs = require("fs");
+const { spawnSync } = require("child_process");
+
+// The Solid JSX transform must register in Bun's preload phase, so the
+// preloads are passed as ABSOLUTE paths. That lets Bun start directly in the
+// user's project directory — the old "spawn at the package root, then chdir
+// to the project inside tui-open.tsx" dance froze the TUI after the first
+// frame (splash paints once, then no repaints and no keyboard input; proven
+// by A/B-launching the identical entry with and without the mid-flight
+// process.chdir). No chdir ever happens now: LOOM_START_CWD always equals
+// the starting directory, so the restore in tui-open.tsx is a no-op kept
+// only as a safety net.
+const pkgRoot = path.join(__dirname, "..");
+const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
+if (!underBun) {
+  // Prefer the bundled @oven bun binary (shipped as an optional dep), then
+  // whatever bun is on PATH. Without either, still respawn so the inner
+  // failure message can guide the user.
+  const OVEN = {
+    "win32-x64": "bun-windows-x64",
+    "win32-arm64": "bun-windows-aarch64",
+    "darwin-x64": "bun-darwin-x64",
+    "darwin-arm64": "bun-darwin-aarch64",
+    "linux-x64": "bun-linux-x64",
+    "linux-arm64": "bun-linux-aarch64",
+  };
+  let bunCmd = process.platform === "win32" ? "bun.exe" : "bun";
+  const short = OVEN[process.platform + "-" + process.arch];
+  const exe = process.platform === "win32" ? "bun.exe" : "bun";
+  const ovenCandidates = short ? [
+    path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe),
+    path.join(pkgRoot, "..", "@oven", short, "bin", exe),
+  ] : [];
+  for (const c of ovenCandidates) {
+    if (fs.existsSync(c)) { bunCmd = c; break; }
+  }
+  const result = spawnSync(
+    bunCmd,
+    [
+      "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
+      __filename,
+      ...process.argv.slice(2),
+    ],
+    {
+      stdio: "inherit",
+      cwd: process.env.LOOM_START_CWD || process.cwd(),
+      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
+      windowsHide: false,
+    }
+  );
+  if (result.error) {
+    console.error("[loom] Bun is required for the full CLI. Install it from https://bun.sh/");
+    process.exit(1);
+  }
+  process.exit(result.status == null ? 1 : result.status);
+}
+process.title = "loom-code";
+(async () => {
+  try {
+    // The npm bin entry bypasses src/index.js, so load dotenv here for both
+    // the package environment and the project from which `loom` was run.
+    const dotenv = require("dotenv");
+    dotenv.config({ path: path.join(__dirname, "..", ".env") });
+    const startCwd = process.env.LOOM_START_CWD || process.cwd();
+    const projectEnv = path.join(startCwd, ".env");
+    if (fs.existsSync(projectEnv)) dotenv.config({ path: projectEnv, override: false });
+    // The npm global shim can start Bun outside the package directory, so do
+    // not depend on bunfig.toml discovery for Windows console setup.
+    await import("../src/tui-preload.js");
+    const args = process.argv.slice(2);
+    const coreMode = args.includes("--basic") || args.includes("-p") || args.includes("--print")
+      || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v")
+      || ["acp", "graph"].includes(args[0]);
+    if (!coreMode) {
+      await import("@opentui/solid/preload");
+      await import("../src/tui-open.tsx");
+      return;
+    }
+    // Subcommands that must never reach the interactive CLI/TUI: cli.main()
+    // has no handler for them and would fall through to launching the full
+    // screen app instead of running the requested command.
+    if (args[0] === "acp") {
+      require("../src/acp/acp-server.js").main();
+      return;
+    }
+    const { main } = require("../src/core/cli.js");
+    await main();
+  } catch (err) {
+    console.error(err && err.message ? err.message : String(err));
+    process.exit(1);
+  }
 })();

package/bin/loom-tui.js

@@ -10,8 +10,28 @@ const { spawnSync } = require("child_process");
 const pkgRoot = path.join(__dirname, "..");
 const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
 if (!underBun) {
+  // Prefer the bundled @oven bun binary (shipped as an optional dep), then
+  // whatever bun is on PATH — same scheme as bin/loom-bun.js.
+  const OVEN = {
+    "win32-x64": "bun-windows-x64",
+    "win32-arm64": "bun-windows-aarch64",
+    "darwin-x64": "bun-darwin-x64",
+    "darwin-arm64": "bun-darwin-aarch64",
+    "linux-x64": "bun-linux-x64",
+    "linux-arm64": "bun-linux-aarch64",
+  };
+  let bunCmd = process.platform === "win32" ? "bun.exe" : "bun";
+  const short = OVEN[process.platform + "-" + process.arch];
+  const exe = process.platform === "win32" ? "bun.exe" : "bun";
+  const ovenCandidates = short ? [
+    path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe),
+    path.join(pkgRoot, "..", "@oven", short, "bin", exe),
+  ] : [];
+  for (const c of ovenCandidates) {
+    if (fs.existsSync(c)) { bunCmd = c; break; }
+  }
   const result = spawnSync(
-    process.platform === "win32" ? "bun.exe" : "bun",
+    bunCmd,
     [
       "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
       __filename,

package/bin/loom.js

@@ -24,16 +24,6 @@ process.on('unhandledRejection', (reason) => {
     require('../src/acp/acp-server').main();
     return;
   }
-  if (sub === 'web') {
-    // Browser interface: HTTP server on 127.0.0.1, opens the browser.
-    require('../src/web/web-server').main();
-    return;
-  }
-  if (sub === 'attach') {
-    // Terminal client for a running `loom web` server.
-    require('../src/web/attach').main();
-    return;
-  }
   try {
     await updateCheck();
     await main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loom-agent",
-  "version": "1.2.33",
+  "version": "1.2.37",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/toshalkumbhar8979-design/loomcode.git"
@@ -24,7 +24,7 @@
     "dev": "node --watch src/index.js",
     "setup": "node src/setup.js",
     "test": "bun run src/tui/test-interactive.tsx && bun run test:unit && bun run lint:core",
-    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/web/web-server.test.js src/tui/keybinds.test.ts",
+    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/tools/security.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/tui/keybinds.test.ts",
     "lint:core": "node node_modules/typescript/bin/tsc -p tsconfig.core.json",
     "smoke:acp": "node scripts/acp-smoke.js",
     "tui": "bun bin/loom-tui.js",
@@ -38,11 +38,12 @@
     "@opentui/core": "0.5.3",
     "@opentui/solid": "0.5.3",
     "@shikijs/themes": "4.4.3",
-    "bonjour-service": "^1.4.4",
+    "@supabase/supabase-js": "^2.45.0",
     "boxen": "^8.0.0",
     "chalk": "^5.3.0",
     "cli-spinners": "^3.2.0",
     "commander": "^12.1.0",
+    "convex": "^1.14.0",
     "dayjs": "^1.11.0",
     "diff": "^7.0.0",
     "dotenv": "^16.4.0",
@@ -50,6 +51,7 @@
     "inquirer": "^12.1.0",
     "openai": "^5.23.2",
     "ora": "^8.0.0",
+    "playwright-core": "^1.64.1",
     "shell-quote": "^1.8.1",
     "solid-js": "1.9.12",
     "strip-ansi": "^7.1.0",
@@ -62,7 +64,13 @@
     "@opentui/core-darwin-x64": "0.5.3",
     "@opentui/core-linux-arm64": "0.5.3",
     "@opentui/core-linux-x64": "0.5.3",
-    "@opentui/core-win32-x64": "0.5.3"
+    "@opentui/core-win32-x64": "0.5.3",
+    "@oven/bun-darwin-aarch64": "1.3.14",
+    "@oven/bun-darwin-x64": "1.3.14",
+    "@oven/bun-linux-aarch64": "1.3.14",
+    "@oven/bun-linux-x64": "1.3.14",
+    "@oven/bun-windows-aarch64": "1.3.14",
+    "@oven/bun-windows-x64": "1.3.14"
   },
   "overrides": {
     "glob": "^13.0.6"
@@ -91,10 +99,7 @@
     "LOOM.md",
     "docs/acp.md",
     "scripts/acp-smoke.js",
-    "scripts/postinstall.js",
-    "docs/web.md",
-    "src/web/index.html",
-    "src/web/graph-view.html"
+    "scripts/postinstall.js"
   ],
   "keywords": [
     "ai",
@@ -115,6 +120,6 @@
     "doc": "docs"
   },
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "type": "commonjs"
 }

package/scripts/postinstall.js

@@ -9,6 +9,40 @@ const path = require("path");
 
 const pkgRoot = path.resolve(__dirname, "..");
 
+// Bun, bundled: loom-agent lists the @oven/bun-<platform> binaries as
+// optionalDependencies, so `npm i -g loom-agent` brings the REAL bun binary
+// (pinned, matching the repo's bun) along even when the user has no bun
+// installed. npm skips non-matching platforms via each package's os/cpu
+// fields, and this resolution never needs install scripts (npm
+// allow-scripts policies can't break it). Resolved here once at install
+// time and baked into the shims as the preferred runtime; the shims still
+// fall back to whatever `bun` is on PATH, and — if NO bun exists at all —
+// to `node bin/loom.js` (line-mode REPL) instead of dying with
+// "'bun' is not recognized".
+function ovenBunPath() {
+    const PKGS = {
+        "win32-x64": "bun-windows-x64",
+        "win32-arm64": "bun-windows-aarch64",
+        "darwin-x64": "bun-darwin-x64",
+        "darwin-arm64": "bun-darwin-aarch64",
+        "linux-x64": "bun-linux-x64",
+        "linux-arm64": "bun-linux-aarch64",
+    };
+    const short = PKGS[process.platform + "-" + process.arch];
+    if (!short) return "";
+    const exe = process.platform === "win32" ? "bun.exe" : "bun";
+    const candidates = [
+        path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe), // nested (npm default)
+        path.join(pkgRoot, "..", "@oven", short, "bin", exe),           // hoisted
+    ];
+    for (var i = 0; i < candidates.length; i++) {
+        try { if (fs.existsSync(candidates[i])) return candidates[i]; } catch {}
+    }
+    return "";
+}
+
+var ovenPath = "";
+
 function shimDirs() {
     const dirs = new Set();
     if (path.basename(path.resolve(pkgRoot, "..")) !== "node_modules") return [];
@@ -29,8 +63,11 @@ function cmdShim(pkg, script) {
         "@ECHO off",
         "SETLOCAL",
         'SET "LOOM_START_CWD=%CD%"',
-        'IF EXIST "%~dp0bun.exe" (SET "_prog=%~dp0bun.exe") ELSE (SET "_prog=bun")',
+        'IF EXIST "' + ovenPath + '" (SET "_prog=' + ovenPath + '") ELSE (SET "_prog=bun")',
         '"%_prog%" --preload "%~dp0' + pkgEscaped + '\\src\\tui-preload.js" "%~dp0' + pkgEscaped + '\\bin\\' + script + '" %*',
+        "IF %ERRORLEVEL% NEQ 9009 EXIT /b %ERRORLEVEL%",
+        "REM bun not found (errorlevel 9009): fall back to the Node REPL",
+        "node \"%~dp0" + pkgEscaped + "\\bin\\loom.js\" %*",
         "EXIT /b %ERRORLEVEL%",
         ""
     ].join("\r\n");
@@ -39,10 +76,13 @@ function cmdShim(pkg, script) {
 function psShim(pkg, script) {
     return [
         "#!/usr/bin/env pwsh",
-        "# rewritten by loom-agent postinstall (no-cwd-change TUI launch)",
+        "# rewritten by loom-agent postinstall (bundled bun + node fallback)",
         "$env:LOOM_START_CWD = (Get-Location).Path",
         "$pkg = Join-Path $PSScriptRoot '" + pkg + "'",
-        "& bun --preload (Join-Path $pkg 'src/tui-preload.js') (Join-Path $pkg 'bin/" + script + "') @args",
+        "$bun = '" + ovenPath + "'",
+        "if (-not ($bun -and (Test-Path $bun))) { $bun = 'bun' }",
+        "& $bun --preload (Join-Path $pkg 'src/tui-preload.js') (Join-Path $pkg 'bin/" + script + "') @args",
+        "if ($LASTEXITCODE -eq 9009) { node (Join-Path $pkg 'bin/loom.js') @args; exit $LASTEXITCODE }",
         "exit $LASTEXITCODE",
         ""
     ].join("\n");
@@ -51,16 +91,28 @@ function psShim(pkg, script) {
 function shShim(pkg, script) {
     return [
         "#!/bin/sh",
-        "# rewritten by loom-agent postinstall (no-cwd-change TUI launch)",
+        "# rewritten by loom-agent postinstall (bundled bun + node fallback)",
         'LOOM_START_CWD="$(pwd)"',
         "export LOOM_START_CWD",
         'PKG="$(dirname "$0")/' + pkg + '"',
-        'exec bun --preload "$PKG/src/tui-preload.js" "$PKG/bin/' + script + '" "$@"',
+        'BUN="' + ovenPath + '"',
+        '[ -x "$BUN" ] || BUN="$(command -v bun || true)"',
+        'if [ -n "$BUN" ]; then',
+        '  exec "$BUN" --preload "$PKG/src/tui-preload.js" "$PKG/bin/' + script + '" "$@"',
+        "fi",
+        'echo "[loom] full TUI needs bun - install with: npm i -g bun (https://bun.sh)" >&2',
+        'exec node "$PKG/bin/loom.js" "$@"',
         ""
     ].join("\n");
 }
 
 try {
+    ovenPath = ovenBunPath();
+    if (ovenPath) {
+        console.log("[loom-agent] bundled bun found: " + ovenPath);
+    } else {
+        console.log("[loom-agent] bundled bun not present for " + process.platform + "-" + process.arch + " (optional dep skipped?) - shims will use bun from PATH, or fall back to the Node REPL");
+    }
     for (var i = 0; i < shimDirs().length; i++) {
         var dir = shimDirs()[i];
         var relPkg = path.relative(dir, pkgRoot).split(path.sep).join("/");