pum-agent 0.2.0-beta.2 → 0.2.0-beta.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.0-beta.2",
+  "version": "0.2.0-beta.4",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/animation.tsx

@@ -313,9 +313,9 @@ export function useBlinkingText(opts: {
   return ref;
 }
 
-/** Keep both caret frames equivalent to the Markdown parser. */
-export function markdownCaretContent(text: string, visible: boolean): string {
-  return text + (visible ? CARET : CARET_PLACEHOLDER);
+/** Append a stable caret without scheduling Markdown-only source changes. */
+export function markdownCaretContent(text: string): string {
+  return text + CARET;
 }
 
 export type MarkdownCaretBinding = {
@@ -323,52 +323,19 @@ export type MarkdownCaretBinding = {
   content: string;
 };
 
-/** Keep a blinking caret at the end of incrementally rendered Markdown. */
+/** Keep a stable caret at the end of incrementally rendered Markdown. */
 export function useMarkdownCaret(
   text: string,
   active: boolean,
 ): MarkdownCaretBinding {
   const ref = useRef<MarkdownRenderable>(null);
-  const { subscribe, enabled } = useClock();
-  const latest = useRef(text);
-  const caretVisible = useRef(true);
-  latest.current = text;
-
-  const paint = useCallback(() => {
-    if (ref.current) {
-      ref.current.content = markdownCaretContent(latest.current, caretVisible.current);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (!active) return;
-    if (!enabled) {
-      caretVisible.current = true;
-      paint();
-      return;
-    }
-
-    let lastVisible = caretVisible.current;
-    const stop = subscribe((elapsedMs) => {
-      const nextVisible = elapsedMs % CARET_PERIOD_MS < CARET_PERIOD_MS * 0.6;
-      if (nextVisible === lastVisible) return;
-      lastVisible = nextVisible;
-      caretVisible.current = nextVisible;
-      paint();
-    });
-    paint();
-    return stop;
-  }, [active, enabled, paint, subscribe]);
-
-  useEffect(() => {
-    if (active) paint();
-  }, [text, active, paint]);
 
-  // React applies this value in the same commit as each transcript delta.
-  // The direct frame writes only change the width-stable caret glyph.
+  // A blink would assign MarkdownRenderable.content twice per period. Each
+  // assignment starts another incremental parse and asynchronous highlight.
+  // Slow terminals can draw the source markers between those highlight passes.
   return {
     ref,
-    content: active ? markdownCaretContent(text, caretVisible.current) : text,
+    content: active ? markdownCaretContent(text) : text,
   };
 }
 

package/src/app.tsx

@@ -19,6 +19,7 @@ import {
 } from "./settings-popup";
 import {
   CHECK_MODE_PROFILES,
+  checkPathsForProject,
   MAX_ACTIVE_SUBAGENTS,
   MIN_ACTIVE_SUBAGENTS,
   saveSettings,
@@ -72,6 +73,7 @@ import {
   setExplanationStrength,
 } from "./explanation-strength";
 import { setCheckModeConfig } from "./check-mode";
+import { applyCheckPathCommand, parseCheckPathCommand } from "./check-paths";
 import {
   captureClipboardImage,
   cleanupPendingImages,
@@ -908,13 +910,13 @@ export function App({
           break;
         case "tool_execution_end":
           patchTool(event.toolCallId, {
-            state: isRejectedToolResult(event.result)
+            state: isRejectedToolResult(event.result, event.toolCallId)
               ? "rejected"
               : event.isError
                 ? "error"
                 : "ok",
-            detail: isRejectedToolResult(event.result)
-              ? rejectedToolReason(event.result)
+            detail: isRejectedToolResult(event.result, event.toolCallId)
+              ? rejectedToolReason(event.result, event.toolCallId)
               : event.toolName === "edit" || event.toolName === "apply_patch"
                 ? editCounts(event.result)
                 : event.toolName === "questionnaire"
@@ -1027,8 +1029,12 @@ export function App({
     if (patch.explanationStrength !== undefined) {
       setExplanationStrength(patch.explanationStrength);
     }
-    if (patch.checkMode !== undefined || patch.checkModel !== undefined) {
-      setCheckModeConfig({ profile: next.checkMode, model: next.checkModel });
+    if (patch.checkMode !== undefined || patch.checkModel !== undefined || patch.checkPaths !== undefined) {
+      setCheckModeConfig({
+        profile: next.checkMode,
+        model: next.checkModel,
+        additionalPaths: checkPathsForProject(next, cwd),
+      });
     }
     if (patch.showThinking !== undefined) showThinkingRef.current = patch.showThinking;
     if (patch.maxActiveSubagents !== undefined) {
@@ -1248,9 +1254,10 @@ export function App({
     const clear = /^\/(?:clear|new)$/.test(trimmed);
     const historyCommand = trimmed === "/history";
     const loginCommand = trimmed === "/login";
+    const checkPathCommand = /^\/check-path(?:\s|$)/.test(trimmed);
     const triggersCommand = trimmed === "/triggers";
     const worktreeCommand = /^\/worktree(?:\s+([a-zA-Z0-9_-]+))?$/.exec(trimmed);
-    if (!compress && !clear && !historyCommand && !loginCommand && !triggersCommand && !worktreeCommand) return false;
+    if (!compress && !clear && !historyCommand && !loginCommand && !checkPathCommand && !triggersCommand && !worktreeCommand) return false;
     editingStashIndex.current = null;
 
     if (historyCommand) {
@@ -1279,7 +1286,20 @@ export function App({
     }
 
     setWorking(true);
-    if (worktreeCommand) {
+    if (checkPathCommand) {
+      Promise.resolve()
+        .then(() => parseCheckPathCommand(trimmed))
+        .then((command) => {
+          if (!command) throw new Error("invalid /check-path command");
+          return applyCheckPathCommand(settings, cwd, command);
+        })
+        .then((result) => {
+          update({ checkPaths: result.settings.checkPaths });
+          append({ kind: "text", role: "system", text: result.message });
+        })
+        .catch((err) => append({ kind: "text", role: "error", text: String(err) }))
+        .finally(() => setWorking(false));
+    } else if (worktreeCommand) {
       runWorktreeCommand({
         name: worktreeCommand[1],
         manager: subagentManager,
@@ -1514,6 +1534,11 @@ export function App({
       settingsPageRef.current = "checkModels";
       setPage("checkModels");
     } },
+    checkPaths: { enter: () => append({
+      kind: "text",
+      role: "system",
+      text: "use /check-path [list|add <directory>|remove <directory>|clear]",
+    }) },
     clearCheckApprovals: { enter: () => {
       const removed = checkApprovalStore?.clearProject(cwd) ?? 0;
       append({ kind: "text", role: "system", text: removed > 0
@@ -1551,6 +1576,7 @@ export function App({
     explanationStrength: `‹ ${settings.explanationStrength} ›`,
     checkMode: `‹ ${settings.checkMode} ›`,
     checkModel: `${settings.checkModel} ›`,
+    checkPaths: `${checkPathsForProject(settings, cwd).length} additional · /check-path ›`,
     clearCheckApprovals: "clear ›",
     thinkingLevel: `‹ ${thinkingLevel} ›`,
     showThinking: `‹ ${settings.showThinking ? "on" : "off"} ›`,

package/src/check-mode.ts

@@ -30,9 +30,32 @@ export const CHECK_MODE_CACHE_LIMIT = 256;
 export type CheckModeConfig = {
   profile: CheckModeProfile;
   model: string;
+  additionalPaths?: readonly string[];
 };
 
 const REJECTED_TOOL_DETAIL = "pumRejected";
+const pendingRejectedTools = new Map<string, string>();
+
+function toolResultText(result: unknown): string | undefined {
+  const content = (result as { content?: unknown } | null)?.content;
+  if (!Array.isArray(content)) return undefined;
+  const text = content
+    .filter((block): block is { type: "text"; text: string } => (
+      Boolean(block) && typeof block === "object"
+      && (block as { type?: unknown }).type === "text"
+      && typeof (block as { text?: unknown }).text === "string"
+    ))
+    .map((block) => block.text)
+    .join("")
+    .trim();
+  return text || undefined;
+}
+
+function pendingRejectedToolReason(toolCallId: string | undefined, result: unknown): string | undefined {
+  if (!toolCallId) return undefined;
+  const reason = pendingRejectedTools.get(toolCallId);
+  return reason && toolResultText(result) === reason ? reason : undefined;
+}
 
 export function rejectedToolDetails(details: unknown, reason?: string): unknown {
   const marker = { [REJECTED_TOOL_DETAIL]: true, ...(reason ? { pumRejectionReason: reason } : {}) };
@@ -40,29 +63,32 @@ export function rejectedToolDetails(details: unknown, reason?: string): unknown
   return marker;
 }
 
-export function isRejectedToolResult(result: unknown): boolean {
+export function isRejectedToolResult(result: unknown, toolCallId?: string): boolean {
   const details = (result as { details?: unknown } | null)?.details;
-  return Boolean(details && typeof details === "object"
-    && (details as Record<string, unknown>)[REJECTED_TOOL_DETAIL] === true);
+  if (details && typeof details === "object"
+    && (details as Record<string, unknown>)[REJECTED_TOOL_DETAIL] === true) return true;
+  return pendingRejectedToolReason(toolCallId, result) !== undefined;
 }
 
-export function rejectedToolReason(result: unknown): string | undefined {
+export function rejectedToolReason(result: unknown, toolCallId?: string): string | undefined {
   const details = (result as { details?: unknown } | null)?.details;
-  if (!details || typeof details !== "object") return undefined;
-  const reason = (details as Record<string, unknown>).pumRejectionReason;
-  return typeof reason === "string" && reason.trim() ? reason : undefined;
+  if (details && typeof details === "object") {
+    const reason = (details as Record<string, unknown>).pumRejectionReason;
+    if (typeof reason === "string" && reason.trim()) return reason;
+  }
+  return pendingRejectedToolReason(toolCallId, result);
 }
 
-let current: CheckModeConfig = { profile: "off", model: DEFAULT_CHECK_MODEL };
+let current: Required<CheckModeConfig> = { profile: "off", model: DEFAULT_CHECK_MODEL, additionalPaths: [] };
 
 export function setCheckModeConfig(config: CheckModeConfig | { enabled: boolean; model: string }): void {
   current = "profile" in config
-    ? { ...config }
-    : { profile: config.enabled ? "strict" : "off", model: config.model };
+    ? { ...config, additionalPaths: [...(config.additionalPaths ?? [])] }
+    : { profile: config.enabled ? "strict" : "off", model: config.model, additionalPaths: [] };
 }
 
 export function getCheckModeConfig(): CheckModeConfig {
-  return { ...current };
+  return { ...current, additionalPaths: [...current.additionalPaths] };
 }
 
 function modelRef(model: Model<any>): string {
@@ -216,6 +242,7 @@ export async function prepareCheck(
   cwd: string,
   profile: Exclude<CheckModeProfile, "off">,
   context: UntrustedContext = {},
+  additionalPaths: readonly string[] = [],
 ): Promise<{ prepared?: PreparedCheck; block?: string; balancedAllow?: string }> {
   let canonicalInput: string;
   try {
@@ -234,12 +261,13 @@ export async function prepareCheck(
         args: input.args,
         cwd: input.cwd,
         projectCwd: cwd,
+        allowedPaths: additionalPaths,
         profile,
       });
     } else {
       const command = input && typeof input === "object" ? (input as { command?: unknown }).command : undefined;
       if (typeof command !== "string") return { block: "Bash safety check requires a complete command string or process proposal" };
-      policy = analyzeCheckPolicy({ command, cwd, profile });
+      policy = analyzeCheckPolicy({ command, cwd, profile, allowedPaths: additionalPaths });
     }
     bash = policy.analysis;
     if (!bash.complete || bash.truncated || !bash.syntaxBalanced) {
@@ -248,7 +276,7 @@ export async function prepareCheck(
     if (policy.decision === "block") return { block: `Check mode hard block: ${policy.reason}` };
   } else {
     try {
-      mutation = await previewMutation(toolName, cwd, input);
+      mutation = await previewMutation(toolName, cwd, input, additionalPaths);
     } catch (error) {
       return { block: `Check mode blocked invalid or stale ${toolName} input: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -281,6 +309,7 @@ export async function prepareCheck(
     version: 2,
     complete: true,
     cwd,
+    allowedDirectoryRoots: [cwd, ...additionalPaths],
     tool: toolName,
     input,
     deterministicPolicy: policy ? {
@@ -330,6 +359,7 @@ export async function prepareCheck(
       version: 2,
       complete: true,
       cwd,
+      allowedDirectoryRoots: [cwd, ...additionalPaths],
       tool: toolName,
       reviewCoverage: {
         mode: "complete-metadata-digest",
@@ -526,8 +556,10 @@ async function withHardTimeout<T>(operation: (signal: AbortSignal) => Promise<T>
   }
 }
 
-function normalizeConfig(config: ToolCheck["config"]): CheckModeConfig {
-  return "profile" in config ? config : { profile: config.enabled ? "strict" : "off", model: config.model };
+function normalizeConfig(config: ToolCheck["config"]): Required<CheckModeConfig> {
+  return "profile" in config
+    ? { ...config, additionalPaths: [...(config.additionalPaths ?? [])] }
+    : { profile: config.enabled ? "strict" : "off", model: config.model, additionalPaths: [] };
 }
 
 const NPM_BOOLEAN_RELEASE_FLAGS = new Set([
@@ -619,7 +651,14 @@ export async function evaluateToolCall(runtime: CheckerRuntime, cache: BashSafet
   if (config.profile === "off") return { decision: "allow", reason: "Check mode is off", category: "off" };
   if (call.signal?.aborted) return { decision: "block", reason: "Safety check aborted", category: "abort" };
   const profile = config.profile as Exclude<CheckModeProfile, "off">;
-  const preparedResult = await prepareCheck(call.toolName, call.input, call.cwd, profile, call.context);
+  const preparedResult = await prepareCheck(
+    call.toolName,
+    call.input,
+    call.cwd,
+    profile,
+    call.context,
+    config.additionalPaths,
+  );
   if (!preparedResult.prepared) return { decision: "block", reason: preparedResult.block ?? "Safety preparation failed", category: "hard-block" };
   const prepared = preparedResult.prepared;
   if (profile === "ask" && call.isApproved?.(prepared)) {
@@ -936,15 +975,32 @@ export function createCheckModeExtension(
 
         const visibleReason = redactApprovalPreview(evaluation.reason);
         rejected.set(event.toolCallId, visibleReason);
+        pendingRejectedTools.set(event.toolCallId, visibleReason);
         return { block: true, reason: visibleReason };
       });
 
       pi.on("tool_result", (event) => {
         const reason = rejected.get(event.toolCallId);
         if (!reason) return;
-        rejected.delete(event.toolCallId);
         return { details: rejectedToolDetails(event.details, reason) };
       });
+
+      // pi 0.84 does not call tool_result for calls blocked by beforeToolCall.
+      // Mark the finalized message so session replay keeps the rejected state.
+      pi.on("message_end", (event) => {
+        const message = event.message as any;
+        if (message?.role !== "toolResult" || typeof message.toolCallId !== "string") return;
+        const reason = rejected.get(message.toolCallId);
+        if (!reason) return;
+        rejected.delete(message.toolCallId);
+        pendingRejectedTools.delete(message.toolCallId);
+        return {
+          message: {
+            ...message,
+            details: rejectedToolDetails(message.details, reason),
+          },
+        };
+      });
     },
   };
 }

package/src/check-mutation.ts

@@ -71,14 +71,21 @@ function insideRoot(root: string, path: string): boolean {
   return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
 }
 
-async function validateEditPath(cwd: string, inputPath: string): Promise<{ root: string; absolute: string; display: string; mode: number }> {
+async function validateEditPath(
+  cwd: string,
+  inputPath: string,
+  allowedPaths: readonly string[],
+): Promise<{ root: string; absolute: string; display: string; mode: number }> {
   if (!inputPath || inputPath.includes("\0")) throw new Error("Edit path is invalid");
   if (windowsAbsolute(inputPath) && process.platform !== "win32") {
     throw new Error(`Edit path is outside the project: ${inputPath}`);
   }
-  const root = await realpath(cwd);
-  const absolute = resolve(root, inputPath);
-  if (!insideRoot(root, absolute)) throw new Error(`Edit path is outside the project: ${inputPath}`);
+  const projectRoot = await realpath(cwd);
+  const roots = await Promise.all([projectRoot, ...allowedPaths].map((path) => realpath(path)));
+  const absolute = resolve(projectRoot, inputPath);
+  const root = roots.sort((first, second) => second.length - first.length)
+    .find((candidate) => candidate === absolute || insideRoot(candidate, absolute));
+  if (!root) throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
 
   let component = root;
   const rel = relative(root, absolute);
@@ -91,7 +98,10 @@ async function validateEditPath(cwd: string, inputPath: string): Promise<{ root:
   if (!insideRoot(root, canonical)) throw new Error(`Edit path resolves outside the project: ${inputPath}`);
   const metadata = await lstat(absolute);
   if (!metadata.isFile()) throw new Error(`Edit path is not a file: ${inputPath}`);
-  return { root, absolute, display: relative(root, absolute).split(sep).join("/"), mode: metadata.mode };
+  const display = projectRoot === absolute || insideRoot(projectRoot, absolute)
+    ? relative(projectRoot, absolute).split(sep).join("/")
+    : absolute;
+  return { root, absolute, display, mode: metadata.mode };
 }
 
 function occurrences(content: string, needle: string): number[] {
@@ -144,7 +154,7 @@ function completeContentMetadata(patch: string): Pick<MutationPreview, "contentC
   };
 }
 
-async function previewEdit(cwd: string, input: unknown): Promise<MutationPreview> {
+async function previewEdit(cwd: string, input: unknown, allowedPaths: readonly string[]): Promise<MutationPreview> {
   if (!input || typeof input !== "object") throw new Error("Edit input is invalid");
   const value = input as { path?: unknown; edits?: unknown; oldText?: unknown; newText?: unknown };
   if (typeof value.path !== "string") throw new Error("Edit path is invalid");
@@ -162,7 +172,7 @@ async function previewEdit(cwd: string, input: unknown): Promise<MutationPreview
     && typeof (edit as any).newText === "string",
   )) throw new Error("Edit replacements are invalid");
 
-  const validated = await validateEditPath(cwd, value.path);
+  const validated = await validateEditPath(cwd, value.path, allowedPaths);
   const buffer = await readFile(validated.absolute);
   let content: string;
   try {
@@ -204,8 +214,9 @@ export async function previewMutation(
   toolName: CheckedToolName,
   cwd: string,
   input: unknown,
+  allowedPaths: readonly string[] = [],
 ): Promise<MutationPreview | undefined> {
-  if (toolName === "edit") return previewEdit(cwd, input);
+  if (toolName === "edit") return previewEdit(cwd, input, allowedPaths);
   if (toolName !== "apply_patch") return undefined;
   if (!input || typeof input !== "object" || typeof (input as { patch?: unknown }).patch !== "string") {
     throw new Error("Apply patch input is invalid");

package/src/check-paths.ts

@@ -0,0 +1,128 @@
+import { lstat, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { AGENT_DIR } from "./config";
+import { isCredentialSensitivePath } from "./check-policy";
+import {
+  checkPathsForProject,
+  MAX_CHECK_PATHS_PER_PROJECT,
+  type PumSettings,
+  withCheckPathsForProject,
+} from "./settings";
+
+export type CheckPathCommand =
+  | { action: "list" }
+  | { action: "clear" }
+  | { action: "add" | "remove"; path: string };
+
+function unquote(value: string): string {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2) {
+    const first = trimmed[0];
+    if ((first === "\"" || first === "'") && trimmed.at(-1) === first) {
+      return trimmed.slice(1, -1);
+    }
+  }
+  return trimmed;
+}
+
+export function parseCheckPathCommand(input: string): CheckPathCommand | undefined {
+  const match = /^\/check-path(?:\s+(.*))?$/s.exec(input.trim());
+  if (!match) return undefined;
+  const argumentsText = match[1]?.trim() ?? "";
+  if (!argumentsText || argumentsText === "list") return { action: "list" };
+  if (argumentsText === "clear") return { action: "clear" };
+  const action = /^(add|remove)\s+([\s\S]+)$/.exec(argumentsText);
+  if (!action) throw new Error("usage: /check-path [list|add <directory>|remove <directory>|clear]");
+  const path = unquote(action[2]!);
+  if (!path || path.includes("\0")) throw new Error("Check path is invalid");
+  return { action: action[1] as "add" | "remove", path };
+}
+
+function insideOrSame(parent: string, candidate: string): boolean {
+  const rel = relative(parent, candidate);
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+async function canonicalDirectory(input: string, cwd: string): Promise<string> {
+  const absolute = resolve(cwd, input);
+  const canonical = await realpath(absolute);
+  const metadata = await lstat(canonical);
+  if (!metadata.isDirectory()) throw new Error(`Check path is not a directory: ${input}`);
+  if (dirname(canonical) === canonical) throw new Error("Check path cannot be a filesystem root");
+  if (isCredentialSensitivePath(canonical)) {
+    throw new Error("Check path cannot be a credential-sensitive directory");
+  }
+  const [agentDirectory, homeDirectory] = await Promise.all([
+    realpath(AGENT_DIR).catch(() => resolve(AGENT_DIR)),
+    realpath(homedir()).catch(() => resolve(homedir())),
+  ]);
+  if (insideOrSame(canonical, agentDirectory) || insideOrSame(agentDirectory, canonical)) {
+    throw new Error("Check path cannot contain or enter PUM's configuration directory");
+  }
+  if (insideOrSame(canonical, homeDirectory)) {
+    throw new Error("Check path cannot contain the home directory");
+  }
+  return canonical;
+}
+
+async function removalIdentity(input: string, cwd: string): Promise<string> {
+  const absolute = resolve(cwd, input);
+  return realpath(absolute).catch(() => absolute);
+}
+
+export async function applyCheckPathCommand(
+  settings: PumSettings,
+  cwd: string,
+  command: CheckPathCommand,
+): Promise<{ settings: PumSettings; paths: string[]; message: string }> {
+  const paths = checkPathsForProject(settings, cwd);
+  if (command.action === "list") {
+    return {
+      settings,
+      paths,
+      message: paths.length > 0
+        ? `Check mode additional paths:\n${paths.map((path) => `- ${path}`).join("\n")}`
+        : "Check mode has no additional paths for this project",
+    };
+  }
+  if (command.action === "clear") {
+    const next = withCheckPathsForProject(settings, cwd, []);
+    return {
+      settings: next,
+      paths: [],
+      message: paths.length > 0
+        ? `cleared ${paths.length} Check mode additional path${paths.length === 1 ? "" : "s"}`
+        : "Check mode has no additional paths to clear",
+    };
+  }
+
+  const canonical = command.action === "add"
+    ? await canonicalDirectory(command.path, cwd)
+    : await removalIdentity(command.path, cwd);
+  const project = await realpath(cwd);
+  if (command.action === "add") {
+    if (canonical === project || insideOrSame(project, canonical)) {
+      throw new Error("The directory is already inside the project boundary");
+    }
+    if (paths.includes(canonical)) throw new Error(`Check path is already allowed: ${canonical}`);
+    if (paths.length >= MAX_CHECK_PATHS_PER_PROJECT) {
+      throw new Error(`Check mode allows at most ${MAX_CHECK_PATHS_PER_PROJECT} additional paths per project`);
+    }
+    const nextPaths = [...paths, canonical];
+    return {
+      settings: withCheckPathsForProject(settings, cwd, nextPaths),
+      paths: nextPaths,
+      message: `allowed Check mode path: ${canonical}`,
+    };
+  }
+
+  const index = paths.indexOf(canonical);
+  if (index < 0) throw new Error(`Check path is not configured: ${canonical}`);
+  const nextPaths = paths.filter((_path, candidate) => candidate !== index);
+  return {
+    settings: withCheckPathsForProject(settings, cwd, nextPaths),
+    paths: nextPaths,
+    message: `removed Check mode path: ${canonical}`,
+  };
+}

package/src/check-policy.ts

@@ -104,6 +104,8 @@ export type CheckPolicyFileSystem = {
 export type AnalyzeCheckPolicyOptions = {
   command: string;
   cwd: string;
+  /** Canonical directory roots explicitly added for this launch project. */
+  allowedPaths?: readonly string[];
   profile?: CheckPolicyProfile;
   limits?: Partial<CheckPolicyLimits>;
   fileSystem?: CheckPolicyFileSystem;
@@ -125,6 +127,8 @@ export type ProcessCheckProposal = {
 
 export type AnalyzeExecutablePolicyOptions = Pick<ProcessCheckProposal, "executable" | "args" | "cwd"> & {
   projectCwd?: string;
+  /** Canonical directory roots explicitly added for this launch project. */
+  allowedPaths?: readonly string[];
   profile?: CheckPolicyProfile;
   limits?: Partial<CheckPolicyLimits>;
   fileSystem?: CheckPolicyFileSystem;
@@ -160,6 +164,7 @@ const PATH_OPERAND_COMMANDS = new Set([
   "readlink", "rm", "rmdir", "unlink", "shred", "mv", "cp", "install", "mkdir", "touch", "truncate",
   "chmod", "chown", "chgrp", "setfacl", "tee", "sed", "perl",
   "node", "bun", "deno", "python", "python3", "ruby", "perl", "php", "java",
+  "cd", "chdir", "set-location",
 ]);
 const PRIVILEGE_COMMANDS = new Set(["sudo", "doas", "su", "pkexec", "runas"]);
 const PERSISTENCE_COMMANDS = new Set(["crontab", "at", "schtasks", "launchctl"]);
@@ -517,23 +522,40 @@ function looksLikePath(value: string): boolean {
     || value.includes("/") || value.includes("\\");
 }
 
-function normalizedAbsolute(value: string, cwd: string, projectCwd = cwd): { absolute: string; root: string; inside: boolean } {
+function normalizedAbsolute(
+  value: string,
+  cwd: string,
+  projectCwd = cwd,
+  allowedPaths: readonly string[] = [],
+): { absolute: string; root: string; inside: boolean; additional: boolean } {
   const flavor = pathFlavor(value, cwd);
-  const root = flavor.resolve(projectCwd);
+  const roots = [projectCwd, ...allowedPaths]
+    .map((root) => flavor.resolve(root))
+    .sort((first, second) => second.length - first.length);
   const expanded = value === "~" || value.startsWith("~/") || value.startsWith("~\\") ? value : value;
   const absolute = flavor.resolve(cwd, expanded);
+  const root = roots.find((candidate) => {
+    const relative = flavor.relative(candidate, absolute);
+    return relative === "" || (!relative.startsWith("..") && !flavor.isAbsolute(relative));
+  }) ?? flavor.resolve(projectCwd);
   const relative = flavor.relative(root, absolute);
   const inside = relative === "" || (!relative.startsWith("..") && !flavor.isAbsolute(relative));
-  return { absolute, root, inside };
+  return {
+    absolute,
+    root,
+    inside,
+    additional: flavor.relative(flavor.resolve(projectCwd), root) !== "",
+  };
 }
 
-function isProjectRoot(value: string, cwd: string): boolean {
+function isAllowedRoot(value: string, cwd: string, projectCwd: string, allowedPaths: readonly string[]): boolean {
   const flavor = pathFlavor(value, cwd);
-  const resolved = normalizedAbsolute(value, cwd);
-  return flavor.relative(resolved.root, resolved.absolute) === "";
+  const absolute = flavor.resolve(cwd, value);
+  return [projectCwd, ...allowedPaths]
+    .some((root) => flavor.relative(flavor.resolve(root), absolute) === "");
 }
 
-function credentialPath(value: string): boolean {
+export function isCredentialSensitivePath(value: string): boolean {
   const lower = value.toLowerCase().replaceAll("\\", "/");
   const segments = lower.split("/").filter(Boolean);
   if (segments.some((segment) => CREDENTIAL_SEGMENTS.has(segment))) return true;
@@ -589,6 +611,22 @@ function symlinkEscapes(path: string, root: string, fs: CheckPolicyFileSystem):
   }
 }
 
+function additionalRootProblem(
+  root: string,
+  fs: CheckPolicyFileSystem,
+): "missing" | "link" | undefined {
+  try {
+    if (!fs.exists(root)) return "missing";
+    if (fs.isSymbolicLink(root)) return "link";
+    const flavor = pathFlavor(root, root);
+    return flavor.relative(flavor.resolve(root), flavor.resolve(fs.realpath(root))) === ""
+      ? undefined
+      : "link";
+  } catch {
+    return "link";
+  }
+}
+
 function addFinding(findings: CheckPolicyFinding[], finding: CheckPolicyFinding): void {
   if (!findings.some((item) => item.code === finding.code && item.stage === finding.stage && item.path === finding.path)) findings.push(finding);
 }
@@ -599,6 +637,7 @@ function inspectHardBlocks(
   fs: CheckPolicyFileSystem,
   depth = 0,
   projectCwd = cwd,
+  allowedPaths: readonly string[] = [],
 ): CheckPolicyFinding[] {
   const findings: CheckPolicyFinding[] = [];
   if (!analysis.complete) {
@@ -606,6 +645,7 @@ function inspectHardBlocks(
     return findings;
   }
 
+  let activeCwd = cwd;
   for (const stage of analysis.stages) {
     const argv = effectiveArgv(stage.argv);
     const name = commandName(argv[0]);
@@ -643,27 +683,51 @@ function inspectHardBlocks(
       const recursive = argv.slice(1).some((arg) => arg === "--recursive" || /^-[^-]*r/i.test(arg));
       const force = argv.slice(1).some((arg) => arg === "--force" || /^-[^-]*f/i.test(arg));
       const broad = operands.some((arg) => [".", "..", "*", "./*", ".\\*", "/", "\\"].includes(arg)
-        || /[*?\[]/.test(arg) || isProjectRoot(arg, projectCwd))
+        || /[*?\[]/.test(arg) || isAllowedRoot(arg, activeCwd, projectCwd, allowedPaths))
         || (recursive && force && operands.length !== 1);
       if (broad) addFinding(findings, { code: "broad-deletion", severity: "hard-block", message: "deletion target is broad or recursive across multiple paths", stage: stage.index });
     }
 
     const effectiveStage = argv === stage.argv ? stage : { ...stage, argv };
     for (const value of pathOperands(effectiveStage)) {
-      if (credentialPath(value)) addFinding(findings, { code: "credential-access", severity: "hard-block", message: "command accesses a credential or secret path", stage: stage.index, path: value });
-      if (isExactPosixNullDevice(value, cwd)) continue;
+      if (isCredentialSensitivePath(value)) addFinding(findings, { code: "credential-access", severity: "hard-block", message: "command accesses a credential or secret path", stage: stage.index, path: value });
+      if (isExactPosixNullDevice(value, activeCwd)) continue;
       if (value.startsWith("~")) {
         addFinding(findings, { code: "outside-project", severity: "hard-block", message: "home-relative path is outside the project boundary", stage: stage.index, path: value });
         continue;
       }
-      const resolved = normalizedAbsolute(value, cwd, projectCwd);
+      const resolved = normalizedAbsolute(value, activeCwd, projectCwd, allowedPaths);
+      const rootProblem = resolved.additional ? additionalRootProblem(resolved.root, fs) : undefined;
       if (!resolved.inside) {
         addFinding(findings, { code: "outside-project", severity: "hard-block", message: "path resolves outside the project boundary", stage: stage.index, path: value });
+      } else if (rootProblem === "missing") {
+        addFinding(findings, { code: "outside-project", severity: "hard-block", message: "additional Check mode path no longer exists", stage: stage.index, path: value });
+      } else if (rootProblem === "link") {
+        addFinding(findings, { code: "escaping-symlink", severity: "hard-block", message: "additional Check mode path became a symlink or junction", stage: stage.index, path: value });
       } else if (symlinkEscapes(resolved.absolute, resolved.root, fs)) {
         addFinding(findings, { code: "escaping-symlink", severity: "hard-block", message: "path follows a symlink outside the project boundary or cannot be verified", stage: stage.index, path: value });
       }
     }
 
+    if (["cd", "chdir", "set-location"].includes(name)) {
+      const targets = pathOperands(effectiveStage);
+      const target = targets.length === 1
+        ? normalizedAbsolute(targets[0]!, activeCwd, projectCwd, allowedPaths)
+        : undefined;
+      if ((stage.operatorAfter === ";" || stage.operatorAfter === "newline")
+        && stage.index < analysis.stages.length - 1) {
+        addFinding(findings, {
+          code: "outside-project",
+          severity: "hard-block",
+          message: "an unconditional directory change before another command cannot be bounded safely",
+          stage: stage.index,
+          path: targets[0],
+        });
+      } else if (stage.operatorAfter === "&&" && target?.inside) {
+        activeCwd = target.absolute;
+      }
+    }
+
     if (depth < 2) {
       const nestedCommands = stage.substitutions.map((item) => item.text);
       const lowerName = name.toLowerCase();
@@ -672,7 +736,7 @@ function inspectHardBlocks(
         : SHELL_INTERPRETERS.has(name) ? argv.findIndex((arg) => arg === "-c") : -1;
       if (commandFlag >= 0 && argv[commandFlag + 1]) nestedCommands.push(argv[commandFlag + 1]!);
       for (const nestedCommand of nestedCommands) {
-        const nestedFindings = inspectHardBlocks(analyzeBashCommand(nestedCommand), cwd, fs, depth + 1, projectCwd);
+        const nestedFindings = inspectHardBlocks(analyzeBashCommand(nestedCommand), cwd, fs, depth + 1, projectCwd, allowedPaths);
         for (const finding of nestedFindings) {
           addFinding(findings, { ...finding, stage: stage.index, message: `nested command: ${finding.message}` });
         }
@@ -795,7 +859,14 @@ export function analyzeCheckPolicy(options: AnalyzeCheckPolicyOptions): CheckPol
   const profile = options.profile ?? "balanced";
   const limits = options.limits ?? (profile === "balanced" ? balancedCompleteShellLimits(options.command) : undefined);
   const analysis = analyzeBashCommand(options.command, limits);
-  const findings = inspectHardBlocks(analysis, options.cwd, options.fileSystem ?? nodeFileSystem);
+  const findings = inspectHardBlocks(
+    analysis,
+    options.cwd,
+    options.fileSystem ?? nodeFileSystem,
+    0,
+    options.cwd,
+    options.allowedPaths,
+  );
   if (findings.some((item) => item.severity === "hard-block")) {
     return { profile, decision: "block", reason: findings[0]!.message, findings, analysis };
   }
@@ -881,8 +952,11 @@ export function analyzeExecutablePolicy(options: AnalyzeExecutablePolicyOptions)
   };
   const projectCwd = options.projectCwd ?? options.cwd;
   const fs = options.fileSystem ?? nodeFileSystem;
-  const findings = inspectHardBlocks(analysis, options.cwd, fs, 0, projectCwd);
-  const executionDirectory = normalizedAbsolute(options.cwd, projectCwd, projectCwd);
+  const findings = inspectHardBlocks(analysis, options.cwd, fs, 0, projectCwd, options.allowedPaths);
+  const executionDirectory = normalizedAbsolute(options.cwd, projectCwd, projectCwd, options.allowedPaths);
+  const executionRootProblem = executionDirectory.additional
+    ? additionalRootProblem(executionDirectory.root, fs)
+    : undefined;
   if (!executionDirectory.inside) {
     addFinding(findings, {
       code: "outside-project",
@@ -890,6 +964,20 @@ export function analyzeExecutablePolicy(options: AnalyzeExecutablePolicyOptions)
       message: "execution cwd resolves outside the project boundary",
       path: options.cwd,
     });
+  } else if (executionRootProblem === "missing") {
+    addFinding(findings, {
+      code: "outside-project",
+      severity: "hard-block",
+      message: "additional Check mode path no longer exists",
+      path: options.cwd,
+    });
+  } else if (executionRootProblem === "link") {
+    addFinding(findings, {
+      code: "escaping-symlink",
+      severity: "hard-block",
+      message: "additional Check mode path became a symlink or junction",
+      path: options.cwd,
+    });
   } else if (symlinkEscapes(executionDirectory.absolute, executionDirectory.root, fs)) {
     addFinding(findings, {
       code: "escaping-symlink",

package/src/commands.ts

@@ -25,6 +25,10 @@ export const COMMANDS: Command[] = [
     name: "/login",
     description: "Add or update a provider login",
   },
+  {
+    name: "/check-path",
+    description: "Manage additional Check mode directory roots",
+  },
   {
     name: "/triggers",
     description: "Manage external triggers",

package/src/help-popup.tsx

@@ -55,6 +55,7 @@ export const HELP_GROUPS: HelpGroup[] = [
       ["/clear", "Start a fresh session"],
       ["/history", "Browse saved sessions"],
       ["/login", "Add or update a provider"],
+      ["/check-path", "Manage extra Check mode paths"],
       ["/triggers", "Manage external triggers"],
       ["/worktree", "Create a managed worktree"],
       ["Tab", "Complete a command preview"],

package/src/main.tsx

@@ -11,7 +11,7 @@ import { mkdirSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { App } from "./app";
 import { AGENT_DIR, AUTH_PATH, MODELS_PATH, sessionDir } from "./config";
-import { loadSettings } from "./settings";
+import { checkPathsForProject, loadSettings } from "./settings";
 import { installWebSearch, webSearch } from "./web-search";
 import { setWritingStyle, writingStyleExtension } from "./writing-style";
 import {
@@ -59,7 +59,11 @@ export async function start(options: StartupOptions): Promise<void> {
   const spawnPreviewManager = new SpawnPreviewManager();
   const sessionHistoryIndex = new SessionHistoryIndex();
   const messageCacheController = new MessageCacheController(process.cwd());
-  setCheckModeConfig({ profile: settings.checkMode, model: settings.checkModel });
+  setCheckModeConfig({
+    profile: settings.checkMode,
+    model: settings.checkModel,
+    additionalPaths: checkPathsForProject(settings, process.cwd()),
+  });
   const checkApprovalCoordinator = new CheckApprovalCoordinator();
   const checkApprovalStore = new CheckApprovalStore();
   const mainCheckModeExtension = createCheckModeExtension(modelRuntime, undefined, {

package/src/settings-popup.tsx

@@ -15,6 +15,7 @@ export type SettingRowId =
   | "explanationStrength"
   | "checkMode"
   | "checkModel"
+  | "checkPaths"
   | "clearCheckApprovals"
   | "thinkingLevel"
   | "showThinking"
@@ -44,6 +45,7 @@ export const SETTINGS_ROWS: readonly SettingRow[] = [
   { id: "webSearch", label: "Web search", category: "Agent", keywords: "internet hosted codex provider", description: "Allow hosted web search on supported Codex providers. Other providers are unchanged." },
   { id: "checkMode", label: "Check mode", category: "Safety", keywords: "profile strict balanced ask verify tools hard block approval bash edit patch", description: "Choose off, strict, balanced, or ask. Hard security rules apply to every active profile." },
   { id: "checkModel", label: "Check model", category: "Safety", keywords: "verifier tools safety structured verdict model", description: "Select the separate verifier model used for ambiguous Check mode calls." },
+  { id: "checkPaths", label: "Allowed paths", category: "Safety", keywords: "additional directories roots boundary command", description: "Use /check-path to manage extra directory roots allowed by Check mode for this project." },
   { id: "clearCheckApprovals", label: "Clear approvals", category: "Safety", keywords: "remove reset exact project approvals ask", description: "Remove exact Check mode approvals stored for this project." },
 ];
 

package/src/settings.ts

@@ -2,6 +2,7 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { AGENT_DIR } from "./config";
 import { DEFAULT_CHECK_MODEL } from "./check-mode";
+import { projectStorageKey } from "./platform";
 import { isWritingStyle, type WritingStyle } from "./writing-style";
 import {
   isExplanationStrength,
@@ -15,6 +16,39 @@ export type CheckModeProfile = (typeof CHECK_MODE_PROFILES)[number];
 export const MIN_ACTIVE_SUBAGENTS = 1;
 export const MAX_ACTIVE_SUBAGENTS = 25;
 export const DEFAULT_MAX_ACTIVE_SUBAGENTS = 10;
+export const MAX_CHECK_PATHS_PER_PROJECT = 16;
+
+export type CheckPathsByProject = Record<string, string[]>;
+
+export function normalizeCheckPathsByProject(value: unknown): CheckPathsByProject {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const normalized: CheckPathsByProject = {};
+  for (const [project, paths] of Object.entries(value)) {
+    if (!project || !Array.isArray(paths)) continue;
+    const entries = [...new Set(paths.filter((path): path is string =>
+      typeof path === "string" && path.length > 0 && !path.includes("\0"),
+    ))].slice(0, MAX_CHECK_PATHS_PER_PROJECT);
+    if (entries.length > 0) normalized[project] = entries;
+  }
+  return normalized;
+}
+
+export function checkPathsForProject(settings: Pick<PumSettings, "checkPaths">, cwd: string): string[] {
+  return [...(settings.checkPaths?.[projectStorageKey(cwd)] ?? [])];
+}
+
+export function withCheckPathsForProject(
+  settings: PumSettings,
+  cwd: string,
+  paths: readonly string[],
+): PumSettings {
+  const key = projectStorageKey(cwd);
+  const checkPaths = { ...(settings.checkPaths ?? {}) };
+  const normalized = [...new Set(paths)].slice(0, MAX_CHECK_PATHS_PER_PROJECT);
+  if (normalized.length > 0) checkPaths[key] = normalized;
+  else delete checkPaths[key];
+  return { ...settings, checkPaths };
+}
 
 export function normalizeMaxActiveSubagents(value: unknown): number {
   return typeof value === "number"
@@ -49,6 +83,8 @@ export type PumSettings = {
   explanationStrength: ExplanationStrength;
   checkMode: CheckModeProfile;
   checkModel: string;
+  /** Additional canonical directory roots allowed by Check mode, keyed by launch project. */
+  checkPaths?: CheckPathsByProject;
   maxActiveSubagents: number;
 };
 
@@ -64,6 +100,7 @@ const DEFAULTS: PumSettings = {
   explanationStrength: "simple",
   checkMode: "off",
   checkModel: DEFAULT_CHECK_MODEL,
+  checkPaths: {},
   maxActiveSubagents: DEFAULT_MAX_ACTIVE_SUBAGENTS,
 };
 
@@ -91,6 +128,7 @@ export function normalizeSettings(parsed: unknown): PumSettings {
       typeof merged.checkModel === "string" && merged.checkModel.includes("/")
         ? merged.checkModel
         : DEFAULTS.checkModel,
+    checkPaths: normalizeCheckPathsByProject(merged.checkPaths),
     maxActiveSubagents: normalizeMaxActiveSubagents(merged.maxActiveSubagents),
   };
 }

package/src/subagents/manager.ts

@@ -590,13 +590,13 @@ export class SubagentManager {
         break;
       case "tool_execution_end":
         this.patchTool(record, event.toolCallId, {
-          state: isRejectedToolResult(event.result)
+          state: isRejectedToolResult(event.result, event.toolCallId)
             ? "rejected"
             : event.isError
               ? "error"
               : "ok",
-          detail: isRejectedToolResult(event.result)
-            ? rejectedToolReason(event.result)
+          detail: isRejectedToolResult(event.result, event.toolCallId)
+            ? rejectedToolReason(event.result, event.toolCallId)
             : event.toolName === "edit" || event.toolName === "apply_patch"
               ? editCounts(event.result)
               : event.toolName === "questionnaire"

package/src/transcript.tsx

@@ -375,7 +375,7 @@ export function ToolLine({
   const bodyChunks = call.arg
     ? [fg(argColor)(call.arg)]
     : [fg(toolColor)(call.name)];
-  if (call.detail) bodyChunks.push(fg(detailColor)(`  ${call.detail}`));
+  if (call.detail && !rejected) bodyChunks.push(fg(detailColor)(`  ${call.detail}`));
 
   const caret = useBlinkingText({
     chunks: bodyChunks,
@@ -385,36 +385,49 @@ export function ToolLine({
   });
 
   return (
-    <Row
-      glyph={GUTTER}
-      glyphColor={toolColor}
-      background={rejected ? theme.rejectionBg : undefined}
-    >
-      <box style={{ flexDirection: "row", flexGrow: 1, flexShrink: 1, minWidth: 0 }}>
-        {prefix ? <text content={prefix} selectable style={{ flexShrink: 0 }} /> : null}
-        <text
-          ref={workingCaret ? caret : undefined}
-          content={workingCaret ? undefined : new StyledText(bodyChunks)}
-          selectable
-          wrapMode="word"
-          style={{ flexGrow: 1, flexShrink: 1, minWidth: 0 }}
-        />
-      </box>
-      {/* The transcript scrollbox uses two padding columns and one pinned
-          scrollbar column. The row then uses a two-column gutter and a
-          one-column state marker. Bash reserves one additional column before
-          the marker so commands wrap before the terminal-edge boundary. */}
-      <box style={{ width: call.name === "bash" ? 2 : 1, flexShrink: 0 }} />
-      <box style={{ width: 1, flexShrink: 0 }}>
-        {call.state === "running" ? (
-          <text ref={spinner} fg={theme.accent} />
-        ) : (
+    <box style={{ flexDirection: "column", width: "100%" }}>
+      <Row
+        glyph={GUTTER}
+        glyphColor={toolColor}
+        background={rejected ? theme.rejectionBg : undefined}
+      >
+        <box style={{ flexDirection: "row", flexGrow: 1, flexShrink: 1, minWidth: 0 }}>
+          {prefix ? <text content={prefix} selectable style={{ flexShrink: 0 }} /> : null}
           <text
-            content={toolStateGlyph(call.state)}
-            fg={call.state === "ok" ? theme.success : rejected ? theme.rejection : theme.error}
+            ref={workingCaret ? caret : undefined}
+            content={workingCaret ? undefined : new StyledText(bodyChunks)}
+            selectable
+            wrapMode="word"
+            style={{ flexGrow: 1, flexShrink: 1, minWidth: 0 }}
           />
-        )}
-      </box>
-    </Row>
+        </box>
+        {/* The transcript scrollbox uses two padding columns and one pinned
+            scrollbar column. The row then uses a two-column gutter and a
+            one-column state marker. Bash reserves one additional column before
+            the marker so commands wrap before the terminal-edge boundary. */}
+        <box style={{ width: call.name === "bash" ? 2 : 1, flexShrink: 0 }} />
+        <box style={{ width: 1, flexShrink: 0 }}>
+          {call.state === "running" ? (
+            <text ref={spinner} fg={theme.accent} />
+          ) : (
+            <text
+              content={toolStateGlyph(call.state)}
+              fg={call.state === "ok" ? theme.success : rejected ? theme.rejection : theme.error}
+            />
+          )}
+        </box>
+      </Row>
+      {rejected && call.detail ? (
+        <Row glyph={GUTTER} glyphColor={theme.rejection} background={theme.rejectionBg}>
+          <text
+            content={call.detail}
+            fg={theme.rejection}
+            selectable
+            wrapMode="word"
+            style={{ flexGrow: 1, flexShrink: 1, minWidth: 0, width: "100%" }}
+          />
+        </Row>
+      ) : null}
+    </box>
   );
 }