praxis-agent 0.46.1 → 0.46.4

package/README.md

@@ -153,6 +153,9 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   structured JSON/JSONL, context compaction, tool loops, and bounded execution.
 - **Built-in tools** — read, write, edit, glob, search, shell, notebook, PDF,
   image, web, scheduled prompts, workflows, and worktrees.
+- **Shell lifecycle** — foreground Bash allows up to 10 minutes and carries a
+  validated final working directory across calls in the same session without
+  leaking state across sessions or overriding an explicit `/cd`.
 - **Permission boundary** — local allow/ask/deny rules, safe and bare modes,
   searchable scoped-rule creation/removal, local/project/user atomic settings
   writes, tool-specific Bash/PowerShell/file/notebook/WebFetch/Skill approval
@@ -212,9 +215,13 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   installing it, rejects concurrent updates, and can roll back after an
   interruption or crash.
 
-Detailed feature status and executable evidence live in the
-[parity matrix](https://github.com/Forest-Isle/Praxis/blob/main/docs/PARITY_MATRIX.md),
-not in this entry-point README.
+Current qualification status and executable evidence live in the
+[Native Fixture Contracts](https://github.com/Forest-Isle/Praxis/blob/main/docs/NATIVE_FIXTURE_CONTRACTS.md)
+and its machine-readable
+[fixture manifest](https://github.com/Forest-Isle/Praxis/blob/main/test/fixtures/manifest.json).
+The [parity matrix](https://github.com/Forest-Isle/Praxis/blob/main/docs/PARITY_MATRIX.md)
+and [roadmap](https://github.com/Forest-Isle/Praxis/blob/main/docs/ROADMAP.md) are
+historical clean-room records.
 
 ## Native data plane
 
@@ -234,17 +241,17 @@ only; they do not change Praxis data ownership.
 
 ## Documentation
 
-| Need                                       | Document                                                                                         |
-| ------------------------------------------ | ------------------------------------------------------------------------------------------------ |
-| Install and run the first session          | [Getting Started](https://github.com/Forest-Isle/Praxis/blob/main/docs/GETTING_STARTED.md)       |
-| Common commands and environment variables  | [CLI Reference](https://github.com/Forest-Isle/Praxis/blob/main/docs/CLI_REFERENCE.md)           |
-| Find all user and maintainer documentation | [Documentation Index](https://github.com/Forest-Isle/Praxis/blob/main/docs/README.md)            |
-| Understand module and data-flow boundaries | [Architecture](https://github.com/Forest-Isle/Praxis/blob/main/docs/ARCHITECTURE.md)             |
-| Review security assumptions                | [Threat Model](https://github.com/Forest-Isle/Praxis/blob/main/docs/THREAT_MODEL.md)             |
-| Check Claude Code parity                   | [Parity Matrix](https://github.com/Forest-Isle/Praxis/blob/main/docs/PARITY_MATRIX.md)           |
-| Review interactive TUI design and evidence | [Quiet Operator Spec](https://github.com/Forest-Isle/Praxis/blob/main/docs/TUI_REDESIGN_SPEC.md) |
-| Build, test, and contribute                | [Contributing](https://github.com/Forest-Isle/Praxis/blob/main/CONTRIBUTING.md)                  |
-| Verify release and supply-chain controls   | [Release Contract](https://github.com/Forest-Isle/Praxis/blob/main/docs/RELEASE.md)              |
+| Need                                       | Document                                                                                                     |
+| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
+| Install and run the first session          | [Getting Started](https://github.com/Forest-Isle/Praxis/blob/main/docs/GETTING_STARTED.md)                   |
+| Common commands and environment variables  | [CLI Reference](https://github.com/Forest-Isle/Praxis/blob/main/docs/CLI_REFERENCE.md)                       |
+| Find all user and maintainer documentation | [Documentation Index](https://github.com/Forest-Isle/Praxis/blob/main/docs/README.md)                        |
+| Understand module and data-flow boundaries | [Architecture](https://github.com/Forest-Isle/Praxis/blob/main/docs/ARCHITECTURE.md)                         |
+| Review security assumptions                | [Threat Model](https://github.com/Forest-Isle/Praxis/blob/main/docs/THREAT_MODEL.md)                         |
+| Qualify native behavior and evidence       | [Native Fixture Contracts](https://github.com/Forest-Isle/Praxis/blob/main/docs/NATIVE_FIXTURE_CONTRACTS.md) |
+| Review interactive TUI design and evidence | [Quiet Operator Spec](https://github.com/Forest-Isle/Praxis/blob/main/docs/TUI_REDESIGN_SPEC.md)             |
+| Build, test, and contribute                | [Contributing](https://github.com/Forest-Isle/Praxis/blob/main/CONTRIBUTING.md)                              |
+| Verify release and supply-chain controls   | [Release Contract](https://github.com/Forest-Isle/Praxis/blob/main/docs/RELEASE.md)                          |
 
 ## Project boundary
 
@@ -286,10 +293,13 @@ injected regression protection, plus Quiet Operator input echo `<50 ms` and
 normal/low-capability full-frame p95 budgets of `<16.7/<33 ms`.
 `npm run check` also enforces the corresponding source dependency direction.
 `npm run test:coverage` measures all production code under `src/**` with V8 and
-enforces global floors of 79% statements, 70% branches, 85% functions, and 81% lines.
-`npm run test:core-completion` runs the 56-story #402 audit and reports
-implemented, qualified, blocked, deferred, and out-of-scope states separately;
-it never treats missing live prerequisites as a pass.
+enforces global floors of 79% statements, 70% branches, 85% functions, and 81% lines,
+and rejects any production runtime module with zero covered statements (while allowing
+type-only modules). `npm run test:fixtures` executes the 67-behavior native contract; 59 behaviors
+are qualified and 8 are explicitly excluded. `npm run verify:fixture-contracts`
+performs the structural check and is part of `npm run check`.
+`npm run test:core-completion` is retained as a compatibility alias for
+`npm run test:fixtures`.
 
 Contributions use Conventional Commit pull-request titles and the protected
 squash-merge workflow. Read

package/dist/application/session-service.d.ts

@@ -123,6 +123,11 @@ export interface SessionRunResult {
     costUsd?: number;
     modelUsage?: Readonly<Record<string, ModelUsage>>;
 }
+export interface CwdInspection {
+    readonly canonicalTarget: string;
+    readonly canonicalCurrentCwd: string;
+    readonly sameDirectory: boolean;
+}
 export interface SideQuestionResult {
     sessionId: string;
     text: string;
@@ -290,7 +295,8 @@ export declare class ClaudeSessionService {
     metadata(sessionId: string): Promise<ClaudeSessionMetadata>;
     rename(sessionId: string, name: string): Promise<void>;
     tag(sessionId: string, tag: string): Promise<void>;
-    changeCwd(sessionId: string | undefined, requestedCwd: string): Promise<string>;
+    changeCwd(sessionId: string | undefined, requestedCwd: string, expectedCanonicalTarget?: string): Promise<string>;
+    inspectCwd(requestedCwd: string): Promise<CwdInspection>;
     recordCdUsage(sessionId: string): Promise<void>;
     approveRecentlyDenied(sessionId: string, display: string): Promise<void>;
     retryRecentlyDenied(sessionId: string, display: string, signal?: AbortSignal): Promise<SessionRunResult>;

package/dist/application/session-service.js

@@ -1806,17 +1806,23 @@ export class ClaudeSessionService {
         const normalized = tag.trim();
         await this.appendNativeCommand(sessionId, `/tag ${normalized}`);
     }
-    async changeCwd(sessionId, requestedCwd) {
+    async changeCwd(sessionId, requestedCwd, expectedCanonicalTarget) {
         this.assertWritable();
         const previousCwd = this.activeCwd();
-        const expandedCwd = requestedCwd === '~'
-            ? homedir()
-            : requestedCwd.startsWith('~/')
-                ? join(homedir(), requestedCwd.slice(2))
-                : requestedCwd;
-        const cwd = await realpath(isAbsolute(expandedCwd) ? expandedCwd : join(previousCwd, expandedCwd));
-        if (!(await stat(cwd)).isDirectory()) {
-            throw new Error(`Not a directory: ${requestedCwd}`);
+        let inspection;
+        try {
+            inspection = await this.inspectCwd(requestedCwd);
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                error.message.includes(' is not a directory.'))
+                throw new Error(`Not a directory: ${requestedCwd}; ${error.message}`);
+            throw error;
+        }
+        const cwd = inspection.canonicalTarget;
+        if (expectedCanonicalTarget !== undefined &&
+            cwd !== expectedCanonicalTarget) {
+            throw new Error(`Directory changed after approval: expected ${expectedCanonicalTarget}, resolved to ${cwd}. Review the target and try again.`);
         }
         if (sessionId && this.options.sessionPersistence !== false) {
             const sourcePaths = this.pathsForCwd(sessionId, this.sessionCwds.get(sessionId) ?? previousCwd);
@@ -1896,6 +1902,33 @@ export class ClaudeSessionService {
         }
         return cwd;
     }
+    async inspectCwd(requestedCwd) {
+        const current = await realpath(this.activeCwd());
+        const expanded = requestedCwd === '~'
+            ? homedir()
+            : requestedCwd.startsWith('~/')
+                ? join(homedir(), requestedCwd.slice(2))
+                : requestedCwd;
+        const resolved = isAbsolute(expanded) ? expanded : join(current, expanded);
+        let target;
+        try {
+            target = await realpath(resolved);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                throw new Error(`Could not find a directory at ${resolved}.`);
+            throw error;
+        }
+        const info = await stat(target);
+        if (!info.isDirectory()) {
+            throw new Error(`${target} is not a directory. Did you mean ${dirname(target)}?`);
+        }
+        return {
+            canonicalTarget: target,
+            canonicalCurrentCwd: current,
+            sameDirectory: target === current,
+        };
+    }
     async recordCdUsage(sessionId) {
         this.assertWritable();
         const transcript = new NativeSessionTranscript({

package/dist/cli/interactive.d.ts

@@ -1,4 +1,4 @@
-import type { ForkResult, ManualCompactResult, ManualCompactSelection, RewindPoint, SessionForkCheckpoint, SessionRunResult, SessionSummary, SideQuestionForkResult, SideQuestionResult } from '../application/session-service.js';
+import type { CwdInspection, ForkResult, ManualCompactResult, ManualCompactSelection, RewindPoint, SessionForkCheckpoint, SessionRunResult, SessionSummary, SideQuestionForkResult, SideQuestionResult } from '../application/session-service.js';
 import type { ClaudeSessionCostSnapshot } from '../application/session-cost-tracker.js';
 import type { ModelImage, ModelToolCall, PermissionApproval, PermissionDecision, RuntimeEventSink } from '../core/runtime.js';
 import type { ActiveTurnInputCommandResult } from '../core/active-turn-input.js';
@@ -46,7 +46,8 @@ interface InteractiveSessionCommands {
     compact?(sessionId: string, signal?: AbortSignal, selection?: ManualCompactSelection): Promise<ManualCompactResult>;
     rewindFiles?(sessionId: string, userMessageId: string): Promise<void>;
     rewindPoints?(sessionId: string): Promise<RewindPoint[]>;
-    changeCwd?(sessionId: string | undefined, cwd: string): Promise<string>;
+    changeCwd?(sessionId: string | undefined, cwd: string, expectedCanonicalTarget?: string): Promise<string>;
+    inspectCwd?(cwd: string): Promise<CwdInspection>;
     notify?(sessionId: string | undefined, message: string, notificationType: string, title?: string): void;
     recordCdUsage?(sessionId: string): Promise<void>;
     approveRecentlyDenied?(sessionId: string, display: string): Promise<void>;

package/dist/cli/interactive.js

@@ -610,6 +610,35 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
     const planApprovalRef = useRef(null);
     const [planApprovalSelection, setPlanApprovalSelection] = useState(0);
     const [planApprovalFeedbackMode, setPlanApprovalFeedbackMode] = useState(false);
+    const [cdTrust, setCdTrust] = useState(null);
+    const [cdTrustSelection, setCdTrustSelection] = useState(0);
+    const cdTrustRef = useRef(null);
+    const trustedCwdsBySessionRef = useRef(new Map());
+    const trustedCwdSessionRef = useRef(sessionId);
+    useEffect(() => {
+        const previousSessionId = trustedCwdSessionRef.current;
+        if (previousSessionId === sessionId)
+            return;
+        if (previousSessionId === null && sessionId !== null) {
+            const pendingSessionTrust = trustedCwdsBySessionRef.current.get(null);
+            if (pendingSessionTrust)
+                trustedCwdsBySessionRef.current.set(sessionId, pendingSessionTrust);
+            trustedCwdsBySessionRef.current.delete(null);
+        }
+        else if (sessionId === null) {
+            trustedCwdsBySessionRef.current.delete(null);
+        }
+        trustedCwdSessionRef.current = sessionId;
+    }, [sessionId]);
+    const trustedCwds = () => {
+        const key = sessionIdRef.current;
+        const existing = trustedCwdsBySessionRef.current.get(key);
+        if (existing)
+            return existing;
+        const created = new Set();
+        trustedCwdsBySessionRef.current.set(key, created);
+        return created;
+    };
     const serviceRef = useRef(null);
     const serviceCreationRef = useRef(undefined);
     const onCleanupRef = useRef(onCleanup);
@@ -868,6 +897,13 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
             answer: input,
         })
         : null, [question, input]);
+    const cdTrustSurface = useMemo(() => cdTrust
+        ? projectTuiDecisionSurface({
+            kind: 'cd-trust',
+            canonicalPath: cdTrust.canonicalPath,
+            selectedIndex: cdTrustSelection,
+        })
+        : null, [cdTrust, cdTrustSelection]);
     const elicitationSurface = useMemo(() => elicitation === null
         ? null
         : projectTuiElicitationSurface({
@@ -1129,16 +1165,18 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
                 }
                 : planApproval !== null && planDecisionSurface !== null
                     ? { priority: planDecisionSurface }
-                    : question !== null && questionDecisionSurface !== null
-                        ? { priority: questionDecisionSurface }
-                        : elicitation !== null && elicitationSurface !== null
-                            ? {
-                                priority: {
-                                    kind: 'elicitation',
-                                    surface: elicitationSurface,
-                                },
-                            }
-                            : {}),
+                    : cdTrust !== null && cdTrustSurface !== null
+                        ? { priority: cdTrustSurface }
+                        : question !== null && questionDecisionSurface !== null
+                            ? { priority: questionDecisionSurface }
+                            : elicitation !== null && elicitationSurface !== null
+                                ? {
+                                    priority: {
+                                        kind: 'elicitation',
+                                        surface: elicitationSurface,
+                                    },
+                                }
+                                : {}),
         ...(secondarySurface === undefined
             ? {}
             : { secondary: secondarySurface }),
@@ -1156,6 +1194,8 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
         permission,
         permissionPrioritySurface,
         planApproval,
+        cdTrust,
+        cdTrustSurface,
         question,
         planDecisionSurface,
         questionDecisionSurface,
@@ -2739,23 +2779,58 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
         onTurnChange?.(loading);
         void loading.finally(() => onTurnChange?.(null));
     };
-    const changeWorkingDirectory = (requestedCwd) => {
+    const changeWorkingDirectory = (requestedCwd, authorization = {
+        kind: 'unapproved',
+    }) => {
         const changing = (async () => {
-            setBusy(true);
-            setStatus('changing directory');
             try {
                 const commands = await service();
                 if (!commands.changeCwd) {
                     throw new Error('This interactive service cannot change working directories.');
                 }
-                const cwd = await commands.changeCwd(sessionId ?? undefined, requestedCwd);
+                if (!commands.inspectCwd) {
+                    throw new Error('This interactive service cannot inspect or change working directories.');
+                }
+                const inspection = await commands.inspectCwd(requestedCwd);
+                if (authorization.kind === 'approved' &&
+                    inspection.canonicalTarget !== authorization.canonicalTarget) {
+                    throw new Error(`Directory changed after approval: expected ${authorization.canonicalTarget}, resolved to ${inspection.canonicalTarget}. Review the target and try again.`);
+                }
+                const activeSessionTrust = trustedCwds();
+                activeSessionTrust.add(inspection.canonicalCurrentCwd);
+                if (inspection.sameDirectory) {
+                    append({
+                        kind: 'local-result',
+                        text: `Already in ${inspection.canonicalTarget}.`,
+                    });
+                    return;
+                }
+                if (authorization.kind === 'unapproved' &&
+                    !activeSessionTrust.has(inspection.canonicalTarget)) {
+                    const pending = {
+                        canonicalPath: inspection.canonicalTarget,
+                    };
+                    cdTrustRef.current = pending;
+                    setCdTrust(pending);
+                    return;
+                }
+                setBusy(true);
+                setStatus('changing directory');
+                const cwd = await commands.changeCwd(sessionId ?? undefined, inspection.canonicalTarget, inspection.canonicalTarget);
+                activeSessionTrust.add(cwd);
                 runtimeCwdRef.current = cwd;
                 setRuntimeCwd(cwd);
                 await retireService();
                 append({ kind: 'local-result', text: `Moved to ${cwd}` });
             }
             catch (error) {
-                warn(error);
+                const message = error instanceof Error ? error.message : String(error);
+                if (authorization.kind === 'approved')
+                    trustedCwds().delete(authorization.canonicalTarget);
+                if (/^(Could not find a directory at .*\.|.* is not a directory\. Did you mean .+\?)$/u.test(message))
+                    append({ kind: 'local-result', text: message });
+                else
+                    warn(error);
             }
             finally {
                 setBusy(false);
@@ -3688,6 +3763,11 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
                         case 'command-palette':
                             setCommandPaletteOpen(false);
                             break;
+                        case 'cd-trust':
+                            cdTrustRef.current = null;
+                            setCdTrust(null);
+                            setCdTrustSelection(0);
+                            break;
                         default: {
                             const unhandledTarget = effect.target;
                             return unhandledTarget;
@@ -3738,7 +3818,7 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
                                 : ['Select']
             : commandPaletteVisible || filePickerVisible
                 ? ['Autocomplete', 'Chat']
-                : permission || planApproval
+                : permission || planApproval || cdTrust
                     ? ['Confirmation']
                     : selectingSession
                         ? ['Select']
@@ -3809,6 +3889,7 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
             pendingPrefix: hasPendingPrefix,
             permission: Boolean(permission),
             planApproval: Boolean(planApproval),
+            cdTrust: Boolean(cdTrust),
             question: Boolean(question),
             elicitation: elicitation
                 ? elicitationUrlWaiting
@@ -4063,6 +4144,35 @@ export function InteractiveApp({ dataPlane = resolveDataPlane(), configRoot: sup
             }
             return;
         }
+        if (cdTrust) {
+            const resolveCdTrust = (selectedIndex) => {
+                const pending = cdTrustRef.current;
+                cdTrustRef.current = null;
+                setCdTrust(null);
+                setCdTrustSelection(0);
+                if (!pending || selectedIndex !== 1)
+                    return;
+                changeWorkingDirectory(pending.canonicalPath, {
+                    kind: 'approved',
+                    canonicalTarget: pending.canonicalPath,
+                });
+            };
+            if (key.upArrow) {
+                setCdTrustSelection((current) => Math.max(0, current - 1));
+            }
+            else if (key.downArrow) {
+                setCdTrustSelection((current) => Math.min(1, current + 1));
+            }
+            else if (lower === 'y')
+                resolveCdTrust(1);
+            else if (lower === 'n')
+                resolveCdTrust(0);
+            else if (/^[12]$/u.test(value))
+                resolveCdTrust(Number(value) - 1);
+            else if (key.return)
+                resolveCdTrust(cdTrustSelection);
+            return;
+        }
         if (planApproval) {
             const elevatedMode = runtimeSettingsRef.current
                 .useAutoModeDuringPlan

package/dist/cli/tui/decision-surface-model.d.ts

@@ -32,6 +32,10 @@ export type TuiDecisionSurfaceInput = {
     readonly questions: readonly ClaudeQuestion[];
     readonly questionIndex: number;
     readonly answer: string;
+} | {
+    readonly kind: 'cd-trust';
+    readonly canonicalPath: string;
+    readonly selectedIndex: number;
 };
 export interface TuiPlanApprovalSurfaceModel {
     readonly kind: 'plan-approval';
@@ -66,6 +70,19 @@ export interface TuiQuestionSurfaceModel {
     readonly cancellation: TuiDecisionSurfaceCancellation;
     readonly emptyState?: string;
 }
-export type TuiDecisionSurfaceModel = TuiPlanApprovalSurfaceModel | TuiQuestionSurfaceModel;
+export interface TuiCdTrustSurfaceModel {
+    readonly kind: 'cd-trust';
+    readonly heading: 'Moving to a new directory:';
+    readonly canonicalPath: string;
+    readonly explanation: "This session hasn't worked here before. Is this a directory you created or one you trust?";
+    readonly scope: 'Praxis can read, edit, and execute files in this directory.';
+    readonly securityGuide: 'Security guide: https://code.claude.com/docs/en/security';
+    readonly options: readonly TuiDecisionSurfaceOption[];
+    readonly selectedIndex: number;
+    readonly range: TuiDecisionSurfaceRange;
+    readonly actions: readonly TuiDecisionSurfaceAction[];
+    readonly cancellation: TuiDecisionSurfaceCancellation;
+}
+export type TuiDecisionSurfaceModel = TuiPlanApprovalSurfaceModel | TuiQuestionSurfaceModel | TuiCdTrustSurfaceModel;
 export declare function projectTuiDecisionSurface(input: TuiDecisionSurfaceInput): TuiDecisionSurfaceModel;
 //# sourceMappingURL=decision-surface-model.d.ts.map

package/dist/cli/tui/decision-surface-model.js

@@ -100,6 +100,32 @@ export function projectTuiDecisionSurface(input) {
             cancellation,
         };
     }
+    if (input.kind === 'cd-trust') {
+        const selectedIndex = normalizeIndex(input.selectedIndex, 2);
+        const options = projectedOptions([{ label: 'No, stay put' }, { label: 'Yes, move here' }], selectedIndex);
+        return {
+            kind: 'cd-trust',
+            heading: 'Moving to a new directory:',
+            canonicalPath: input.canonicalPath,
+            explanation: "This session hasn't worked here before. Is this a directory you created or one you trust?",
+            scope: 'Praxis can read, edit, and execute files in this directory.',
+            securityGuide: 'Security guide: https://code.claude.com/docs/en/security',
+            options,
+            selectedIndex,
+            range: range(options.length),
+            actions: [
+                {
+                    visualLabel: 'Enter to confirm',
+                    screenReaderLabel: 'Enter to confirm',
+                },
+                { screenReaderLabel: 'Use up and down arrows to change selection' },
+                { screenReaderLabel: 'Press 1 or 2 to choose directly' },
+                { screenReaderLabel: 'Press y to move here' },
+                { screenReaderLabel: 'Press n to stay put' },
+            ],
+            cancellation,
+        };
+    }
     const count = input.questions.length;
     const questionIndex = normalizeIndex(input.questionIndex, count);
     if (count === 0)

package/dist/cli/tui/decision-surface.js

@@ -31,8 +31,11 @@ function PlanSurface({ model, screenReader, }) {
 function QuestionSurface({ model, screenReader, }) {
     return (_jsxs(DialogFrame, { title: model.heading, screenReader: screenReader, children: [_jsx(Text, { children: model.progress }), model.emptyState ? _jsx(Text, { dimColor: true, children: model.emptyState }) : null, model.options.map((option) => (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: [option.index, ". ", option.label, option.description ? ` — ${option.description}` : ''] }), option.preview ? _jsx(Text, { dimColor: true, children: option.preview }) : null] }, `${option.index}-${option.label}`))), _jsxs(Text, { children: [screenReader ? 'Current answer: ' : '› ', model.answer || (screenReader ? '(empty)' : '')] }), _jsx(Footer, { ...model, screenReader: screenReader })] }));
 }
+function CdTrustSurface({ model, screenReader, }) {
+    return (_jsxs(DialogFrame, { title: model.heading, screenReader: screenReader, children: [_jsx(Text, { children: model.canonicalPath }), _jsx(Text, { dimColor: true, children: model.explanation }), _jsx(Text, { dimColor: true, children: model.scope }), _jsx(Text, { dimColor: true, children: model.securityGuide }), model.options.map((option) => (_jsx(Option, { option: option, screenReader: screenReader }, option.index))), _jsx(Footer, { ...model, screenReader: screenReader })] }));
+}
 export function DecisionSurface({ model, width, screenReader, }) {
-    const content = model.kind === 'plan-approval' ? (_jsx(PlanSurface, { model: model, screenReader: screenReader })) : (_jsx(QuestionSurface, { model: model, screenReader: screenReader }));
+    const content = model.kind === 'plan-approval' ? (_jsx(PlanSurface, { model: model, screenReader: screenReader })) : model.kind === 'question' ? (_jsx(QuestionSurface, { model: model, screenReader: screenReader })) : (_jsx(CdTrustSurface, { model: model, screenReader: screenReader }));
     const normalizedWidth = Number.isFinite(width)
         ? Math.min(100, Math.max(1, Math.trunc(width)))
         : 100;

package/dist/cli/tui/open-url.d.ts

@@ -1,2 +1,12 @@
-export declare function openTuiUrl(url: string): Promise<void>;
+type OpenUrlOptions = {
+    timeout: number;
+    shell: false;
+};
+type OpenUrlExecutor = (command: string, args: string[], options: OpenUrlOptions, callback: (error?: Error | null) => void) => unknown;
+type OpenUrlDependencies = {
+    platform?: NodeJS.Platform;
+    execFile?: OpenUrlExecutor;
+};
+export declare function openTuiUrl(url: string, dependencies?: OpenUrlDependencies): Promise<void>;
+export {};
 //# sourceMappingURL=open-url.d.ts.map

package/dist/cli/tui/open-url.js

@@ -1,13 +1,33 @@
 import { execFile } from 'node:child_process';
-export async function openTuiUrl(url) {
-    const command = process.platform === 'darwin'
+const defaultExecFile = (command, args, options, callback) => execFile(command, args, options, callback);
+export async function openTuiUrl(url, dependencies = {}) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch {
+        throw new Error('TUI URL must be an absolute HTTP(S) URL');
+    }
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:')
+        throw new Error('TUI URL must be an absolute HTTP(S) URL');
+    const canonicalUrl = parsedUrl.href;
+    const platform = dependencies.platform ?? process.platform;
+    const command = platform === 'darwin'
         ? 'open'
-        : process.platform === 'win32'
-            ? 'cmd'
+        : platform === 'win32'
+            ? 'rundll32.exe'
             : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    await new Promise((resolvePromise) => {
-        execFile(command, args, { timeout: 10_000 }, () => resolvePromise());
+    const args = platform === 'win32'
+        ? ['url.dll,FileProtocolHandler', canonicalUrl]
+        : [canonicalUrl];
+    const executor = dependencies.execFile ?? defaultExecFile;
+    await new Promise((resolvePromise, rejectPromise) => {
+        try {
+            executor(command, args, { timeout: 10_000, shell: false }, (error) => error == null ? resolvePromise() : rejectPromise(error));
+        }
+        catch (error) {
+            rejectPromise(error);
+        }
     });
 }
 //# sourceMappingURL=open-url.js.map

package/dist/cli/tui/quiet-choice-rows.js

@@ -176,6 +176,17 @@ function decision(surface, density, sr) {
             explicitFooter('quiet:plan:footer', '↑/↓ select  Enter confirm  Esc cancel', 'Use up and down arrows to select. Press Enter to confirm. Press Escape to cancel.'),
         ];
     }
+    if (surface.kind === 'cd-trust') {
+        out.push(row('quiet:cd-trust:path', surface.canonicalPath, 'body'));
+        out.push(row('quiet:cd-trust:explanation', surface.explanation, 'muted'));
+        out.push(row('quiet:cd-trust:scope', surface.scope, 'muted'));
+        out.push(row('quiet:cd-trust:security-guide', surface.securityGuide, 'muted'));
+        out.push(...optionsRows(surface.options, 'quiet:cd-trust:option', density, sr));
+        return [
+            ...out,
+            explicitFooter('quiet:cd-trust:footer', '↑/↓ select  Enter confirm  Esc cancel', 'Use up and down arrows to select. Press Enter to confirm. Press Escape to cancel.'),
+        ];
+    }
     if (surface.progress)
         out.push(row('quiet:question:progress', surface.progress, 'muted'));
     if (surface.question)
@@ -291,7 +302,9 @@ export function projectQuietChoiceRows(surface, options) {
             row('quiet:exit:heading', 'Exit Praxis?', 'heading'),
             explicitFooter('quiet:exit:footer', 'Enter confirm  Esc cancel', 'Press Enter to confirm. Press Escape to cancel.'),
         ];
-    if (surface.kind === 'plan-approval' || surface.kind === 'question')
+    if (surface.kind === 'plan-approval' ||
+        surface.kind === 'question' ||
+        surface.kind === 'cd-trust')
         return decision(surface, options.density, sr);
     if (surface.kind === 'session-picker' ||
         surface.kind === 'command-palette' ||

package/dist/cli/tui/sandbox-settings.d.ts

@@ -1,8 +1,16 @@
 import type { SandboxDependencyCheck } from '@anthropic-ai/sandbox-runtime';
 import type { JsonResource } from '../../core/resources.js';
+import { type ClaudeSandboxPlatform } from '../../sandbox/claude-sandbox-runtime.js';
 import { type ClaudeSandboxSettings } from '../../sandbox/claude-sandbox-settings.js';
 export type TuiSandboxMode = 'auto-allow' | 'regular' | 'disabled';
 export type TuiSandboxTab = 'mode' | 'dependencies' | 'overrides' | 'config';
+export interface TuiSandboxRuntime {
+    initialize(settings: ClaudeSandboxSettings): Promise<void>;
+    unavailableReason(settings: ClaudeSandboxSettings): string | undefined;
+    platformName(): ClaudeSandboxPlatform;
+    dependencyCheck(settings: ClaudeSandboxSettings): SandboxDependencyCheck;
+    isSupportedPlatform(): boolean;
+}
 export interface TuiSandboxSnapshot {
     settings: ClaudeSandboxSettings;
     dependencies: SandboxDependencyCheck;
@@ -22,11 +30,12 @@ export interface TuiSandboxStore {
     }>;
 }
 export declare function linuxGlobPatternWarnings(resources: readonly JsonResource[], platform: 'macos' | 'linux' | 'windows' | 'wsl'): string[];
-export declare function createTuiSandboxStore({ configRoot, cwd, homeDirectory, additionalDirectories, environment, }: {
+export declare function createTuiSandboxStore({ configRoot, cwd, homeDirectory, additionalDirectories, environment, runtime, }: {
     configRoot: string;
     cwd: string;
     homeDirectory: string;
     additionalDirectories?: readonly string[];
     environment?: NodeJS.ProcessEnv;
+    runtime?: TuiSandboxRuntime;
 }): TuiSandboxStore;
 //# sourceMappingURL=sandbox-settings.d.ts.map

package/dist/cli/tui/sandbox-settings.js

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { writeFileAtomically } from '../../platform/atomic-write.js';
 import { loadNativeSharedResources } from '../../persistence/native-resources.js';
-import { claudeSandboxRuntime } from '../../sandbox/claude-sandbox-runtime.js';
+import { claudeSandboxRuntime, } from '../../sandbox/claude-sandbox-runtime.js';
 import { nativeSandboxTempDirectory, loadClaudeSandboxSettings, } from '../../sandbox/claude-sandbox-settings.js';
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -75,7 +75,7 @@ export function linuxGlobPatternWarnings(resources, platform) {
     }
     return [...new Set(warnings)];
 }
-export function createTuiSandboxStore({ configRoot, cwd, homeDirectory, additionalDirectories = [], environment = process.env, }) {
+export function createTuiSandboxStore({ configRoot, cwd, homeDirectory, additionalDirectories = [], environment = process.env, runtime = claudeSandboxRuntime, }) {
     const localSettingsPath = join(cwd, '.praxis', 'settings.local.json');
     const load = async () => {
         const resources = (await loadNativeSharedResources({ root: configRoot, cwd })).settings;
@@ -87,13 +87,13 @@ export function createTuiSandboxStore({ configRoot, cwd, homeDirectory, addition
             additionalDirectories,
             tempDirectory: nativeSandboxTempDirectory(environment),
         });
-        await claudeSandboxRuntime.initialize(settings);
-        const unavailableReason = claudeSandboxRuntime.unavailableReason(settings);
-        const platform = claudeSandboxRuntime.platformName();
+        await runtime.initialize(settings);
+        const unavailableReason = runtime.unavailableReason(settings);
+        const platform = runtime.platformName();
         return {
             settings,
-            dependencies: claudeSandboxRuntime.dependencyCheck(settings),
-            supported: claudeSandboxRuntime.isSupportedPlatform(),
+            dependencies: runtime.dependencyCheck(settings),
+            supported: runtime.isSupportedPlatform(),
             platform,
             globPatternWarnings: linuxGlobPatternWarnings(resources, platform),
             ...(unavailableReason ? { unavailableReason } : {}),

package/dist/cli/tui/tui-focus-stack.d.ts

@@ -7,6 +7,7 @@ export interface TuiFocusProjectionInput {
     readonly pendingPrefix: boolean;
     readonly permission: boolean;
     readonly planApproval: boolean;
+    readonly cdTrust?: boolean;
     readonly question: boolean;
     readonly elicitation: 'plain' | 'url-waiting' | 'expanded-options' | false;
     readonly selectingSession: boolean;