pum-agent 0.2.0-beta.3 → 0.2.1-beta.1

package/README.md

@@ -129,7 +129,7 @@ Set `PUM_DIR` to override PUM's complete configuration and data directory. Run `
 | `Ctrl+C` | Clear the selected non-empty draft; on an empty draft, press twice to quit |
 | `?` | Show all controls when the prompt is empty |
 
-Useful commands include `/login`, `/history`, `/triggers`, `/clear`, `/compress`, and `/worktree`.
+Useful commands include `/login`, `/history`, `/triggers`, `/check-path`, `/clear`, `/compress`, and `/worktree`.
 
 ### Copy transcript text
 
@@ -210,6 +210,8 @@ Select a Check mode profile in `Ctrl+P`. It applies to `bash`, `edit`, `apply_pa
 
 Every active profile hard-blocks project escape, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use the exception.
 
+Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. Bash, edit, and external-trigger checks can use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
+
 For `edit` and `apply_patch`, PUM validates the complete proposed change before any mutation. Review data includes the unified diff, changed paths, line counts, sensitivity flags, project containment, and full-content SHA-256. Invalid, stale, malformed, escaping, or incompletely analyzed input blocks the call. Patch length alone does not block a valid Balanced call.
 
 Ask mode can allow an exact call once, for the current session, or for the current project. Approvals match the authoritative main or child identity, tool, verifier model, project, and canonical complete input. Chat text is not approval. Use **Clear approvals** in Settings to remove project approvals.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.1-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/animation.tsx

@@ -313,9 +313,9 @@ export function useBlinkingText(opts: {
   return ref;
 }
 
-/** Keep both caret frames equivalent to the Markdown parser. */
-export function markdownCaretContent(text: string, visible: boolean): string {
-  return text + (visible ? CARET : CARET_PLACEHOLDER);
+/** Append a stable caret without scheduling Markdown-only source changes. */
+export function markdownCaretContent(text: string): string {
+  return text + CARET;
 }
 
 export type MarkdownCaretBinding = {
@@ -323,52 +323,19 @@ export type MarkdownCaretBinding = {
   content: string;
 };
 
-/** Keep a blinking caret at the end of incrementally rendered Markdown. */
+/** Keep a stable caret at the end of incrementally rendered Markdown. */
 export function useMarkdownCaret(
   text: string,
   active: boolean,
 ): MarkdownCaretBinding {
   const ref = useRef<MarkdownRenderable>(null);
-  const { subscribe, enabled } = useClock();
-  const latest = useRef(text);
-  const caretVisible = useRef(true);
-  latest.current = text;
-
-  const paint = useCallback(() => {
-    if (ref.current) {
-      ref.current.content = markdownCaretContent(latest.current, caretVisible.current);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (!active) return;
-    if (!enabled) {
-      caretVisible.current = true;
-      paint();
-      return;
-    }
-
-    let lastVisible = caretVisible.current;
-    const stop = subscribe((elapsedMs) => {
-      const nextVisible = elapsedMs % CARET_PERIOD_MS < CARET_PERIOD_MS * 0.6;
-      if (nextVisible === lastVisible) return;
-      lastVisible = nextVisible;
-      caretVisible.current = nextVisible;
-      paint();
-    });
-    paint();
-    return stop;
-  }, [active, enabled, paint, subscribe]);
-
-  useEffect(() => {
-    if (active) paint();
-  }, [text, active, paint]);
 
-  // React applies this value in the same commit as each transcript delta.
-  // The direct frame writes only change the width-stable caret glyph.
+  // A blink would assign MarkdownRenderable.content twice per period. Each
+  // assignment starts another incremental parse and asynchronous highlight.
+  // Slow terminals can draw the source markers between those highlight passes.
   return {
     ref,
-    content: active ? markdownCaretContent(text, caretVisible.current) : text,
+    content: active ? markdownCaretContent(text) : text,
   };
 }
 

package/src/app.tsx

@@ -19,6 +19,7 @@ import {
 } from "./settings-popup";
 import {
   CHECK_MODE_PROFILES,
+  checkPathsForProject,
   MAX_ACTIVE_SUBAGENTS,
   MIN_ACTIVE_SUBAGENTS,
   saveSettings,
@@ -72,6 +73,7 @@ import {
   setExplanationStrength,
 } from "./explanation-strength";
 import { setCheckModeConfig } from "./check-mode";
+import { applyCheckPathCommand, parseCheckPathCommand } from "./check-paths";
 import {
   captureClipboardImage,
   cleanupPendingImages,
@@ -908,13 +910,13 @@ export function App({
           break;
         case "tool_execution_end":
           patchTool(event.toolCallId, {
-            state: isRejectedToolResult(event.result)
+            state: isRejectedToolResult(event.result, event.toolCallId)
               ? "rejected"
               : event.isError
                 ? "error"
                 : "ok",
-            detail: isRejectedToolResult(event.result)
-              ? rejectedToolReason(event.result)
+            detail: isRejectedToolResult(event.result, event.toolCallId)
+              ? rejectedToolReason(event.result, event.toolCallId)
               : event.toolName === "edit" || event.toolName === "apply_patch"
                 ? editCounts(event.result)
                 : event.toolName === "questionnaire"
@@ -1027,8 +1029,12 @@ export function App({
     if (patch.explanationStrength !== undefined) {
       setExplanationStrength(patch.explanationStrength);
     }
-    if (patch.checkMode !== undefined || patch.checkModel !== undefined) {
-      setCheckModeConfig({ profile: next.checkMode, model: next.checkModel });
+    if (patch.checkMode !== undefined || patch.checkModel !== undefined || patch.checkPaths !== undefined) {
+      setCheckModeConfig({
+        profile: next.checkMode,
+        model: next.checkModel,
+        additionalPaths: checkPathsForProject(next, cwd),
+      });
     }
     if (patch.showThinking !== undefined) showThinkingRef.current = patch.showThinking;
     if (patch.maxActiveSubagents !== undefined) {
@@ -1248,9 +1254,10 @@ export function App({
     const clear = /^\/(?:clear|new)$/.test(trimmed);
     const historyCommand = trimmed === "/history";
     const loginCommand = trimmed === "/login";
+    const checkPathCommand = /^\/check-path(?:\s|$)/.test(trimmed);
     const triggersCommand = trimmed === "/triggers";
     const worktreeCommand = /^\/worktree(?:\s+([a-zA-Z0-9_-]+))?$/.exec(trimmed);
-    if (!compress && !clear && !historyCommand && !loginCommand && !triggersCommand && !worktreeCommand) return false;
+    if (!compress && !clear && !historyCommand && !loginCommand && !checkPathCommand && !triggersCommand && !worktreeCommand) return false;
     editingStashIndex.current = null;
 
     if (historyCommand) {
@@ -1279,7 +1286,20 @@ export function App({
     }
 
     setWorking(true);
-    if (worktreeCommand) {
+    if (checkPathCommand) {
+      Promise.resolve()
+        .then(() => parseCheckPathCommand(trimmed))
+        .then((command) => {
+          if (!command) throw new Error("invalid /check-path command");
+          return applyCheckPathCommand(settings, cwd, command);
+        })
+        .then((result) => {
+          update({ checkPaths: result.settings.checkPaths });
+          append({ kind: "text", role: "system", text: result.message });
+        })
+        .catch((err) => append({ kind: "text", role: "error", text: String(err) }))
+        .finally(() => setWorking(false));
+    } else if (worktreeCommand) {
       runWorktreeCommand({
         name: worktreeCommand[1],
         manager: subagentManager,
@@ -1514,6 +1534,11 @@ export function App({
       settingsPageRef.current = "checkModels";
       setPage("checkModels");
     } },
+    checkPaths: { enter: () => append({
+      kind: "text",
+      role: "system",
+      text: "use /check-path [list|add <directory>|remove <directory>|clear]",
+    }) },
     clearCheckApprovals: { enter: () => {
       const removed = checkApprovalStore?.clearProject(cwd) ?? 0;
       append({ kind: "text", role: "system", text: removed > 0
@@ -1551,6 +1576,7 @@ export function App({
     explanationStrength: `‹ ${settings.explanationStrength} ›`,
     checkMode: `‹ ${settings.checkMode} ›`,
     checkModel: `${settings.checkModel} ›`,
+    checkPaths: `${checkPathsForProject(settings, cwd).length} additional · /check-path ›`,
     clearCheckApprovals: "clear ›",
     thinkingLevel: `‹ ${thinkingLevel} ›`,
     showThinking: `‹ ${settings.showThinking ? "on" : "off"} ›`,

package/src/check-mode.ts

@@ -30,9 +30,32 @@ export const CHECK_MODE_CACHE_LIMIT = 256;
 export type CheckModeConfig = {
   profile: CheckModeProfile;
   model: string;
+  additionalPaths?: readonly string[];
 };
 
 const REJECTED_TOOL_DETAIL = "pumRejected";
+const pendingRejectedTools = new Map<string, string>();
+
+function toolResultText(result: unknown): string | undefined {
+  const content = (result as { content?: unknown } | null)?.content;
+  if (!Array.isArray(content)) return undefined;
+  const text = content
+    .filter((block): block is { type: "text"; text: string } => (
+      Boolean(block) && typeof block === "object"
+      && (block as { type?: unknown }).type === "text"
+      && typeof (block as { text?: unknown }).text === "string"
+    ))
+    .map((block) => block.text)
+    .join("")
+    .trim();
+  return text || undefined;
+}
+
+function pendingRejectedToolReason(toolCallId: string | undefined, result: unknown): string | undefined {
+  if (!toolCallId) return undefined;
+  const reason = pendingRejectedTools.get(toolCallId);
+  return reason && toolResultText(result) === reason ? reason : undefined;
+}
 
 export function rejectedToolDetails(details: unknown, reason?: string): unknown {
   const marker = { [REJECTED_TOOL_DETAIL]: true, ...(reason ? { pumRejectionReason: reason } : {}) };
@@ -40,29 +63,32 @@ export function rejectedToolDetails(details: unknown, reason?: string): unknown
   return marker;
 }
 
-export function isRejectedToolResult(result: unknown): boolean {
+export function isRejectedToolResult(result: unknown, toolCallId?: string): boolean {
   const details = (result as { details?: unknown } | null)?.details;
-  return Boolean(details && typeof details === "object"
-    && (details as Record<string, unknown>)[REJECTED_TOOL_DETAIL] === true);
+  if (details && typeof details === "object"
+    && (details as Record<string, unknown>)[REJECTED_TOOL_DETAIL] === true) return true;
+  return pendingRejectedToolReason(toolCallId, result) !== undefined;
 }
 
-export function rejectedToolReason(result: unknown): string | undefined {
+export function rejectedToolReason(result: unknown, toolCallId?: string): string | undefined {
   const details = (result as { details?: unknown } | null)?.details;
-  if (!details || typeof details !== "object") return undefined;
-  const reason = (details as Record<string, unknown>).pumRejectionReason;
-  return typeof reason === "string" && reason.trim() ? reason : undefined;
+  if (details && typeof details === "object") {
+    const reason = (details as Record<string, unknown>).pumRejectionReason;
+    if (typeof reason === "string" && reason.trim()) return reason;
+  }
+  return pendingRejectedToolReason(toolCallId, result);
 }
 
-let current: CheckModeConfig = { profile: "off", model: DEFAULT_CHECK_MODEL };
+let current: Required<CheckModeConfig> = { profile: "off", model: DEFAULT_CHECK_MODEL, additionalPaths: [] };
 
 export function setCheckModeConfig(config: CheckModeConfig | { enabled: boolean; model: string }): void {
   current = "profile" in config
-    ? { ...config }
-    : { profile: config.enabled ? "strict" : "off", model: config.model };
+    ? { ...config, additionalPaths: [...(config.additionalPaths ?? [])] }
+    : { profile: config.enabled ? "strict" : "off", model: config.model, additionalPaths: [] };
 }
 
 export function getCheckModeConfig(): CheckModeConfig {
-  return { ...current };
+  return { ...current, additionalPaths: [...current.additionalPaths] };
 }
 
 function modelRef(model: Model<any>): string {
@@ -216,6 +242,7 @@ export async function prepareCheck(
   cwd: string,
   profile: Exclude<CheckModeProfile, "off">,
   context: UntrustedContext = {},
+  additionalPaths: readonly string[] = [],
 ): Promise<{ prepared?: PreparedCheck; block?: string; balancedAllow?: string }> {
   let canonicalInput: string;
   try {
@@ -234,12 +261,13 @@ export async function prepareCheck(
         args: input.args,
         cwd: input.cwd,
         projectCwd: cwd,
+        allowedPaths: additionalPaths,
         profile,
       });
     } else {
       const command = input && typeof input === "object" ? (input as { command?: unknown }).command : undefined;
       if (typeof command !== "string") return { block: "Bash safety check requires a complete command string or process proposal" };
-      policy = analyzeCheckPolicy({ command, cwd, profile });
+      policy = analyzeCheckPolicy({ command, cwd, profile, allowedPaths: additionalPaths });
     }
     bash = policy.analysis;
     if (!bash.complete || bash.truncated || !bash.syntaxBalanced) {
@@ -248,7 +276,7 @@ export async function prepareCheck(
     if (policy.decision === "block") return { block: `Check mode hard block: ${policy.reason}` };
   } else {
     try {
-      mutation = await previewMutation(toolName, cwd, input);
+      mutation = await previewMutation(toolName, cwd, input, additionalPaths);
     } catch (error) {
       return { block: `Check mode blocked invalid or stale ${toolName} input: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -281,6 +309,7 @@ export async function prepareCheck(
     version: 2,
     complete: true,
     cwd,
+    allowedDirectoryRoots: [cwd, ...additionalPaths],
     tool: toolName,
     input,
     deterministicPolicy: policy ? {
@@ -330,6 +359,7 @@ export async function prepareCheck(
       version: 2,
       complete: true,
       cwd,
+      allowedDirectoryRoots: [cwd, ...additionalPaths],
       tool: toolName,
       reviewCoverage: {
         mode: "complete-metadata-digest",
@@ -526,8 +556,10 @@ async function withHardTimeout<T>(operation: (signal: AbortSignal) => Promise<T>
   }
 }
 
-function normalizeConfig(config: ToolCheck["config"]): CheckModeConfig {
-  return "profile" in config ? config : { profile: config.enabled ? "strict" : "off", model: config.model };
+function normalizeConfig(config: ToolCheck["config"]): Required<CheckModeConfig> {
+  return "profile" in config
+    ? { ...config, additionalPaths: [...(config.additionalPaths ?? [])] }
+    : { profile: config.enabled ? "strict" : "off", model: config.model, additionalPaths: [] };
 }
 
 const NPM_BOOLEAN_RELEASE_FLAGS = new Set([
@@ -619,7 +651,14 @@ export async function evaluateToolCall(runtime: CheckerRuntime, cache: BashSafet
   if (config.profile === "off") return { decision: "allow", reason: "Check mode is off", category: "off" };
   if (call.signal?.aborted) return { decision: "block", reason: "Safety check aborted", category: "abort" };
   const profile = config.profile as Exclude<CheckModeProfile, "off">;
-  const preparedResult = await prepareCheck(call.toolName, call.input, call.cwd, profile, call.context);
+  const preparedResult = await prepareCheck(
+    call.toolName,
+    call.input,
+    call.cwd,
+    profile,
+    call.context,
+    config.additionalPaths,
+  );
   if (!preparedResult.prepared) return { decision: "block", reason: preparedResult.block ?? "Safety preparation failed", category: "hard-block" };
   const prepared = preparedResult.prepared;
   if (profile === "ask" && call.isApproved?.(prepared)) {
@@ -936,15 +975,32 @@ export function createCheckModeExtension(
 
         const visibleReason = redactApprovalPreview(evaluation.reason);
         rejected.set(event.toolCallId, visibleReason);
+        pendingRejectedTools.set(event.toolCallId, visibleReason);
         return { block: true, reason: visibleReason };
       });
 
       pi.on("tool_result", (event) => {
         const reason = rejected.get(event.toolCallId);
         if (!reason) return;
-        rejected.delete(event.toolCallId);
         return { details: rejectedToolDetails(event.details, reason) };
       });
+
+      // pi 0.84 does not call tool_result for calls blocked by beforeToolCall.
+      // Mark the finalized message so session replay keeps the rejected state.
+      pi.on("message_end", (event) => {
+        const message = event.message as any;
+        if (message?.role !== "toolResult" || typeof message.toolCallId !== "string") return;
+        const reason = rejected.get(message.toolCallId);
+        if (!reason) return;
+        rejected.delete(message.toolCallId);
+        pendingRejectedTools.delete(message.toolCallId);
+        return {
+          message: {
+            ...message,
+            details: rejectedToolDetails(message.details, reason),
+          },
+        };
+      });
     },
   };
 }

package/src/check-mutation.ts

@@ -1,9 +1,15 @@
 import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
 import { createHash } from "node:crypto";
 import { lstat, readFile, realpath } from "node:fs/promises";
-import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, dirname, relative, resolve, sep } from "node:path";
 import { previewApplyPatch } from "./apply-patch";
 import type { CheckedToolName } from "./check-approvals";
+import {
+  canonicalPathIdentityAllowMissing,
+  isPathInsideOrSame,
+  pathIdentity,
+  pathsHaveSameIdentity,
+} from "./platform";
 
 export type MutationSensitivity = {
   executable: boolean;
@@ -66,32 +72,48 @@ function windowsAbsolute(path: string): boolean {
   return /^[A-Za-z]:[\\/]/.test(path) || /^\\\\/.test(path) || /^\/\//.test(path);
 }
 
-function insideRoot(root: string, path: string): boolean {
-  const rel = relative(root, path);
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
-}
-
-async function validateEditPath(cwd: string, inputPath: string): Promise<{ root: string; absolute: string; display: string; mode: number }> {
+async function validateEditPath(
+  cwd: string,
+  inputPath: string,
+  allowedPaths: readonly string[],
+): Promise<{ root: string; absolute: string; display: string; mode: number }> {
   if (!inputPath || inputPath.includes("\0")) throw new Error("Edit path is invalid");
   if (windowsAbsolute(inputPath) && process.platform !== "win32") {
     throw new Error(`Edit path is outside the project: ${inputPath}`);
   }
-  const root = await realpath(cwd);
-  const absolute = resolve(root, inputPath);
-  if (!insideRoot(root, absolute)) throw new Error(`Edit path is outside the project: ${inputPath}`);
+  const projectRoot = await realpath(cwd);
+  const roots = await Promise.all([projectRoot, ...allowedPaths].map((path) => realpath(path)));
+  const absolute = resolve(projectRoot, inputPath);
+  const sortedRoots = roots.sort((first, second) => second.length - first.length);
+  let root = sortedRoots.find((candidate) => isPathInsideOrSame(candidate, absolute));
+  if (!root) {
+    let targetIdentity: string;
+    try {
+      targetIdentity = await canonicalPathIdentityAllowMissing(absolute);
+    } catch {
+      throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
+    }
+    root = sortedRoots.find((candidate) => isPathInsideOrSame(pathIdentity(candidate), targetIdentity));
+  }
+  if (!root) throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
+  const canonical = await realpath(absolute);
 
-  let component = root;
-  const rel = relative(root, absolute);
-  for (const part of rel.split(sep).filter(Boolean)) {
-    component = resolve(component, part);
+  let component = absolute;
+  while (true) {
     const metadata = await lstat(component);
     if (metadata.isSymbolicLink()) throw new Error(`Edit path contains an escaping link or junction: ${inputPath}`);
+    if (await pathsHaveSameIdentity(component, root)) break;
+    const parent = dirname(component);
+    if (parent === component) throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
+    component = parent;
   }
-  const canonical = await realpath(absolute);
-  if (!insideRoot(root, canonical)) throw new Error(`Edit path resolves outside the project: ${inputPath}`);
+  if (!isPathInsideOrSame(root, canonical)) throw new Error(`Edit path resolves outside the project: ${inputPath}`);
   const metadata = await lstat(absolute);
   if (!metadata.isFile()) throw new Error(`Edit path is not a file: ${inputPath}`);
-  return { root, absolute, display: relative(root, absolute).split(sep).join("/"), mode: metadata.mode };
+  const display = isPathInsideOrSame(projectRoot, canonical)
+    ? relative(projectRoot, canonical).split(sep).join("/")
+    : absolute;
+  return { root, absolute, display, mode: metadata.mode };
 }
 
 function occurrences(content: string, needle: string): number[] {
@@ -144,7 +166,7 @@ function completeContentMetadata(patch: string): Pick<MutationPreview, "contentC
   };
 }
 
-async function previewEdit(cwd: string, input: unknown): Promise<MutationPreview> {
+async function previewEdit(cwd: string, input: unknown, allowedPaths: readonly string[]): Promise<MutationPreview> {
   if (!input || typeof input !== "object") throw new Error("Edit input is invalid");
   const value = input as { path?: unknown; edits?: unknown; oldText?: unknown; newText?: unknown };
   if (typeof value.path !== "string") throw new Error("Edit path is invalid");
@@ -162,7 +184,7 @@ async function previewEdit(cwd: string, input: unknown): Promise<MutationPreview
     && typeof (edit as any).newText === "string",
   )) throw new Error("Edit replacements are invalid");
 
-  const validated = await validateEditPath(cwd, value.path);
+  const validated = await validateEditPath(cwd, value.path, allowedPaths);
   const buffer = await readFile(validated.absolute);
   let content: string;
   try {
@@ -204,8 +226,9 @@ export async function previewMutation(
   toolName: CheckedToolName,
   cwd: string,
   input: unknown,
+  allowedPaths: readonly string[] = [],
 ): Promise<MutationPreview | undefined> {
-  if (toolName === "edit") return previewEdit(cwd, input);
+  if (toolName === "edit") return previewEdit(cwd, input, allowedPaths);
   if (toolName !== "apply_patch") return undefined;
   if (!input || typeof input !== "object" || typeof (input as { patch?: unknown }).patch !== "string") {
     throw new Error("Apply patch input is invalid");

package/src/check-paths.ts

@@ -0,0 +1,132 @@
+import { lstat, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { AGENT_DIR } from "./config";
+import { isCredentialSensitivePath } from "./check-policy";
+import {
+  canonicalPathIdentityAllowMissing,
+  isPathInsideOrSame,
+  pathIdentity,
+} from "./platform";
+import {
+  checkPathsForProject,
+  MAX_CHECK_PATHS_PER_PROJECT,
+  type PumSettings,
+  withCheckPathsForProject,
+} from "./settings";
+
+export type CheckPathCommand =
+  | { action: "list" }
+  | { action: "clear" }
+  | { action: "add" | "remove"; path: string };
+
+function unquote(value: string): string {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2) {
+    const first = trimmed[0];
+    if ((first === "\"" || first === "'") && trimmed.at(-1) === first) {
+      return trimmed.slice(1, -1);
+    }
+  }
+  return trimmed;
+}
+
+export function parseCheckPathCommand(input: string): CheckPathCommand | undefined {
+  const match = /^\/check-path(?:\s+(.*))?$/s.exec(input.trim());
+  if (!match) return undefined;
+  const argumentsText = match[1]?.trim() ?? "";
+  if (!argumentsText || argumentsText === "list") return { action: "list" };
+  if (argumentsText === "clear") return { action: "clear" };
+  const action = /^(add|remove)\s+([\s\S]+)$/.exec(argumentsText);
+  if (!action) throw new Error("usage: /check-path [list|add <directory>|remove <directory>|clear]");
+  const path = unquote(action[2]!);
+  if (!path || path.includes("\0")) throw new Error("Check path is invalid");
+  return { action: action[1] as "add" | "remove", path };
+}
+
+async function canonicalDirectory(input: string, cwd: string): Promise<string> {
+  const absolute = resolve(cwd, input);
+  const canonical = await realpath(absolute);
+  const metadata = await lstat(canonical);
+  if (!metadata.isDirectory()) throw new Error(`Check path is not a directory: ${input}`);
+  if (dirname(canonical) === canonical) throw new Error("Check path cannot be a filesystem root");
+  if (isCredentialSensitivePath(canonical)) {
+    throw new Error("Check path cannot be a credential-sensitive directory");
+  }
+  const [agentDirectory, homeDirectory] = await Promise.all([
+    realpath(AGENT_DIR).catch(() => resolve(AGENT_DIR)),
+    realpath(homedir()).catch(() => resolve(homedir())),
+  ]);
+  if (isPathInsideOrSame(canonical, agentDirectory) || isPathInsideOrSame(agentDirectory, canonical)) {
+    throw new Error("Check path cannot contain or enter PUM's configuration directory");
+  }
+  if (isPathInsideOrSame(canonical, homeDirectory)) {
+    throw new Error("Check path cannot contain the home directory");
+  }
+  return canonical;
+}
+
+async function removalIdentity(input: string, cwd: string): Promise<string> {
+  const absolute = resolve(cwd, input);
+  return canonicalPathIdentityAllowMissing(absolute);
+}
+
+export async function applyCheckPathCommand(
+  settings: PumSettings,
+  cwd: string,
+  command: CheckPathCommand,
+): Promise<{ settings: PumSettings; paths: string[]; message: string }> {
+  const paths = checkPathsForProject(settings, cwd);
+  if (command.action === "list") {
+    return {
+      settings,
+      paths,
+      message: paths.length > 0
+        ? `Check mode additional paths:\n${paths.map((path) => `- ${path}`).join("\n")}`
+        : "Check mode has no additional paths for this project",
+    };
+  }
+  if (command.action === "clear") {
+    const next = withCheckPathsForProject(settings, cwd, []);
+    return {
+      settings: next,
+      paths: [],
+      message: paths.length > 0
+        ? `cleared ${paths.length} Check mode additional path${paths.length === 1 ? "" : "s"}`
+        : "Check mode has no additional paths to clear",
+    };
+  }
+
+  const canonical = command.action === "add"
+    ? await canonicalDirectory(command.path, cwd)
+    : await removalIdentity(command.path, cwd);
+  const project = await realpath(cwd);
+  if (command.action === "add") {
+    if (isPathInsideOrSame(project, canonical)) {
+      throw new Error("The directory is already inside the project boundary");
+    }
+    const identity = pathIdentity(canonical);
+    if (paths.some((path) => pathIdentity(path) === identity)) {
+      throw new Error(`Check path is already allowed: ${canonical}`);
+    }
+    if (paths.length >= MAX_CHECK_PATHS_PER_PROJECT) {
+      throw new Error(`Check mode allows at most ${MAX_CHECK_PATHS_PER_PROJECT} additional paths per project`);
+    }
+    const nextPaths = [...paths, canonical];
+    return {
+      settings: withCheckPathsForProject(settings, cwd, nextPaths),
+      paths: nextPaths,
+      message: `allowed Check mode path: ${canonical}`,
+    };
+  }
+
+  const identity = pathIdentity(canonical);
+  const index = paths.findIndex((path) => pathIdentity(path) === identity);
+  if (index < 0) throw new Error(`Check path is not configured: ${canonical}`);
+  const nextPaths = paths.filter((_path, candidate) => candidate !== index);
+  return {
+    settings: withCheckPathsForProject(settings, cwd, nextPaths),
+    paths: nextPaths,
+    message: `removed Check mode path: ${canonical}`,
+  };
+}

package/src/check-policy.ts

@@ -104,6 +104,8 @@ export type CheckPolicyFileSystem = {
 export type AnalyzeCheckPolicyOptions = {
   command: string;
   cwd: string;
+  /** Canonical directory roots explicitly added for this launch project. */
+  allowedPaths?: readonly string[];
   profile?: CheckPolicyProfile;
   limits?: Partial<CheckPolicyLimits>;
   fileSystem?: CheckPolicyFileSystem;
@@ -125,6 +127,8 @@ export type ProcessCheckProposal = {
 
 export type AnalyzeExecutablePolicyOptions = Pick<ProcessCheckProposal, "executable" | "args" | "cwd"> & {
   projectCwd?: string;
+  /** Canonical directory roots explicitly added for this launch project. */
+  allowedPaths?: readonly string[];
   profile?: CheckPolicyProfile;
   limits?: Partial<CheckPolicyLimits>;
   fileSystem?: CheckPolicyFileSystem;
@@ -160,6 +164,7 @@ const PATH_OPERAND_COMMANDS = new Set([
   "readlink", "rm", "rmdir", "unlink", "shred", "mv", "cp", "install", "mkdir", "touch", "truncate",
   "chmod", "chown", "chgrp", "setfacl", "tee", "sed", "perl",
   "node", "bun", "deno", "python", "python3", "ruby", "perl", "php", "java",
+  "cd", "chdir", "set-location",
 ]);
 const PRIVILEGE_COMMANDS = new Set(["sudo", "doas", "su", "pkexec", "runas"]);
 const PERSISTENCE_COMMANDS = new Set(["crontab", "at", "schtasks", "launchctl"]);
@@ -517,23 +522,40 @@ function looksLikePath(value: string): boolean {
     || value.includes("/") || value.includes("\\");
 }
 
-function normalizedAbsolute(value: string, cwd: string, projectCwd = cwd): { absolute: string; root: string; inside: boolean } {
+function normalizedAbsolute(
+  value: string,
+  cwd: string,
+  projectCwd = cwd,
+  allowedPaths: readonly string[] = [],
+): { absolute: string; root: string; inside: boolean; additional: boolean } {
   const flavor = pathFlavor(value, cwd);
-  const root = flavor.resolve(projectCwd);
+  const roots = [projectCwd, ...allowedPaths]
+    .map((root) => flavor.resolve(root))
+    .sort((first, second) => second.length - first.length);
   const expanded = value === "~" || value.startsWith("~/") || value.startsWith("~\\") ? value : value;
   const absolute = flavor.resolve(cwd, expanded);
+  const root = roots.find((candidate) => {
+    const relative = flavor.relative(candidate, absolute);
+    return relative === "" || (!relative.startsWith("..") && !flavor.isAbsolute(relative));
+  }) ?? flavor.resolve(projectCwd);
   const relative = flavor.relative(root, absolute);
   const inside = relative === "" || (!relative.startsWith("..") && !flavor.isAbsolute(relative));
-  return { absolute, root, inside };
+  return {
+    absolute,
+    root,
+    inside,
+    additional: flavor.relative(flavor.resolve(projectCwd), root) !== "",
+  };
 }
 
-function isProjectRoot(value: string, cwd: string): boolean {
+function isAllowedRoot(value: string, cwd: string, projectCwd: string, allowedPaths: readonly string[]): boolean {
   const flavor = pathFlavor(value, cwd);
-  const resolved = normalizedAbsolute(value, cwd);
-  return flavor.relative(resolved.root, resolved.absolute) === "";
+  const absolute = flavor.resolve(cwd, value);
+  return [projectCwd, ...allowedPaths]
+    .some((root) => flavor.relative(flavor.resolve(root), absolute) === "");
 }
 
-function credentialPath(value: string): boolean {
+export function isCredentialSensitivePath(value: string): boolean {
   const lower = value.toLowerCase().replaceAll("\\", "/");
   const segments = lower.split("/").filter(Boolean);
   if (segments.some((segment) => CREDENTIAL_SEGMENTS.has(segment))) return true;
@@ -589,6 +611,27 @@ function symlinkEscapes(path: string, root: string, fs: CheckPolicyFileSystem):
   }
 }
 
+function additionalRootProblem(
+  root: string,
+  fs: CheckPolicyFileSystem,
+): "missing" | "link" | undefined {
+  try {
+    if (!fs.exists(root)) return "missing";
+    const flavor = pathFlavor(root, root);
+    const resolved = flavor.resolve(root);
+    const parsed = flavor.parse(resolved);
+    let component = parsed.root;
+    for (const part of resolved.slice(parsed.root.length).split(/[\\/]+/).filter(Boolean)) {
+      component = flavor.join(component, part);
+      if (fs.isSymbolicLink(component)) return "link";
+    }
+    fs.realpath(root);
+    return undefined;
+  } catch {
+    return "link";
+  }
+}
+
 function addFinding(findings: CheckPolicyFinding[], finding: CheckPolicyFinding): void {
   if (!findings.some((item) => item.code === finding.code && item.stage === finding.stage && item.path === finding.path)) findings.push(finding);
 }
@@ -599,6 +642,7 @@ function inspectHardBlocks(
   fs: CheckPolicyFileSystem,
   depth = 0,
   projectCwd = cwd,
+  allowedPaths: readonly string[] = [],
 ): CheckPolicyFinding[] {
   const findings: CheckPolicyFinding[] = [];
   if (!analysis.complete) {
@@ -606,6 +650,7 @@ function inspectHardBlocks(
     return findings;
   }
 
+  let activeCwd = cwd;
   for (const stage of analysis.stages) {
     const argv = effectiveArgv(stage.argv);
     const name = commandName(argv[0]);
@@ -643,27 +688,51 @@ function inspectHardBlocks(
       const recursive = argv.slice(1).some((arg) => arg === "--recursive" || /^-[^-]*r/i.test(arg));
       const force = argv.slice(1).some((arg) => arg === "--force" || /^-[^-]*f/i.test(arg));
       const broad = operands.some((arg) => [".", "..", "*", "./*", ".\\*", "/", "\\"].includes(arg)
-        || /[*?\[]/.test(arg) || isProjectRoot(arg, projectCwd))
+        || /[*?\[]/.test(arg) || isAllowedRoot(arg, activeCwd, projectCwd, allowedPaths))
         || (recursive && force && operands.length !== 1);
       if (broad) addFinding(findings, { code: "broad-deletion", severity: "hard-block", message: "deletion target is broad or recursive across multiple paths", stage: stage.index });
     }
 
     const effectiveStage = argv === stage.argv ? stage : { ...stage, argv };
     for (const value of pathOperands(effectiveStage)) {
-      if (credentialPath(value)) addFinding(findings, { code: "credential-access", severity: "hard-block", message: "command accesses a credential or secret path", stage: stage.index, path: value });
-      if (isExactPosixNullDevice(value, cwd)) continue;
+      if (isCredentialSensitivePath(value)) addFinding(findings, { code: "credential-access", severity: "hard-block", message: "command accesses a credential or secret path", stage: stage.index, path: value });
+      if (isExactPosixNullDevice(value, activeCwd)) continue;
       if (value.startsWith("~")) {
         addFinding(findings, { code: "outside-project", severity: "hard-block", message: "home-relative path is outside the project boundary", stage: stage.index, path: value });
         continue;
       }
-      const resolved = normalizedAbsolute(value, cwd, projectCwd);
+      const resolved = normalizedAbsolute(value, activeCwd, projectCwd, allowedPaths);
+      const rootProblem = resolved.additional ? additionalRootProblem(resolved.root, fs) : undefined;
       if (!resolved.inside) {
         addFinding(findings, { code: "outside-project", severity: "hard-block", message: "path resolves outside the project boundary", stage: stage.index, path: value });
+      } else if (rootProblem === "missing") {
+        addFinding(findings, { code: "outside-project", severity: "hard-block", message: "additional Check mode path no longer exists", stage: stage.index, path: value });
+      } else if (rootProblem === "link") {
+        addFinding(findings, { code: "escaping-symlink", severity: "hard-block", message: "additional Check mode path became a symlink or junction", stage: stage.index, path: value });
       } else if (symlinkEscapes(resolved.absolute, resolved.root, fs)) {
         addFinding(findings, { code: "escaping-symlink", severity: "hard-block", message: "path follows a symlink outside the project boundary or cannot be verified", stage: stage.index, path: value });
       }
     }
 
+    if (["cd", "chdir", "set-location"].includes(name)) {
+      const targets = pathOperands(effectiveStage);
+      const target = targets.length === 1
+        ? normalizedAbsolute(targets[0]!, activeCwd, projectCwd, allowedPaths)
+        : undefined;
+      if ((stage.operatorAfter === ";" || stage.operatorAfter === "newline")
+        && stage.index < analysis.stages.length - 1) {
+        addFinding(findings, {
+          code: "outside-project",
+          severity: "hard-block",
+          message: "an unconditional directory change before another command cannot be bounded safely",
+          stage: stage.index,
+          path: targets[0],
+        });
+      } else if (stage.operatorAfter === "&&" && target?.inside) {
+        activeCwd = target.absolute;
+      }
+    }
+
     if (depth < 2) {
       const nestedCommands = stage.substitutions.map((item) => item.text);
       const lowerName = name.toLowerCase();
@@ -672,7 +741,7 @@ function inspectHardBlocks(
         : SHELL_INTERPRETERS.has(name) ? argv.findIndex((arg) => arg === "-c") : -1;
       if (commandFlag >= 0 && argv[commandFlag + 1]) nestedCommands.push(argv[commandFlag + 1]!);
       for (const nestedCommand of nestedCommands) {
-        const nestedFindings = inspectHardBlocks(analyzeBashCommand(nestedCommand), cwd, fs, depth + 1, projectCwd);
+        const nestedFindings = inspectHardBlocks(analyzeBashCommand(nestedCommand), cwd, fs, depth + 1, projectCwd, allowedPaths);
         for (const finding of nestedFindings) {
           addFinding(findings, { ...finding, stage: stage.index, message: `nested command: ${finding.message}` });
         }
@@ -795,7 +864,14 @@ export function analyzeCheckPolicy(options: AnalyzeCheckPolicyOptions): CheckPol
   const profile = options.profile ?? "balanced";
   const limits = options.limits ?? (profile === "balanced" ? balancedCompleteShellLimits(options.command) : undefined);
   const analysis = analyzeBashCommand(options.command, limits);
-  const findings = inspectHardBlocks(analysis, options.cwd, options.fileSystem ?? nodeFileSystem);
+  const findings = inspectHardBlocks(
+    analysis,
+    options.cwd,
+    options.fileSystem ?? nodeFileSystem,
+    0,
+    options.cwd,
+    options.allowedPaths,
+  );
   if (findings.some((item) => item.severity === "hard-block")) {
     return { profile, decision: "block", reason: findings[0]!.message, findings, analysis };
   }
@@ -881,8 +957,11 @@ export function analyzeExecutablePolicy(options: AnalyzeExecutablePolicyOptions)
   };
   const projectCwd = options.projectCwd ?? options.cwd;
   const fs = options.fileSystem ?? nodeFileSystem;
-  const findings = inspectHardBlocks(analysis, options.cwd, fs, 0, projectCwd);
-  const executionDirectory = normalizedAbsolute(options.cwd, projectCwd, projectCwd);
+  const findings = inspectHardBlocks(analysis, options.cwd, fs, 0, projectCwd, options.allowedPaths);
+  const executionDirectory = normalizedAbsolute(options.cwd, projectCwd, projectCwd, options.allowedPaths);
+  const executionRootProblem = executionDirectory.additional
+    ? additionalRootProblem(executionDirectory.root, fs)
+    : undefined;
   if (!executionDirectory.inside) {
     addFinding(findings, {
       code: "outside-project",
@@ -890,6 +969,20 @@ export function analyzeExecutablePolicy(options: AnalyzeExecutablePolicyOptions)
       message: "execution cwd resolves outside the project boundary",
       path: options.cwd,
     });
+  } else if (executionRootProblem === "missing") {
+    addFinding(findings, {
+      code: "outside-project",
+      severity: "hard-block",
+      message: "additional Check mode path no longer exists",
+      path: options.cwd,
+    });
+  } else if (executionRootProblem === "link") {
+    addFinding(findings, {
+      code: "escaping-symlink",
+      severity: "hard-block",
+      message: "additional Check mode path became a symlink or junction",
+      path: options.cwd,
+    });
   } else if (symlinkEscapes(executionDirectory.absolute, executionDirectory.root, fs)) {
     addFinding(findings, {
       code: "escaping-symlink",

package/src/commands.ts

@@ -25,6 +25,10 @@ export const COMMANDS: Command[] = [
     name: "/login",
     description: "Add or update a provider login",
   },
+  {
+    name: "/check-path",
+    description: "Manage additional Check mode directory roots",
+  },
   {
     name: "/triggers",
     description: "Manage external triggers",

package/src/help-popup.tsx

@@ -55,6 +55,7 @@ export const HELP_GROUPS: HelpGroup[] = [
       ["/clear", "Start a fresh session"],
       ["/history", "Browse saved sessions"],
       ["/login", "Add or update a provider"],
+      ["/check-path", "Manage extra Check mode paths"],
       ["/triggers", "Manage external triggers"],
       ["/worktree", "Create a managed worktree"],
       ["Tab", "Complete a command preview"],

package/src/main.tsx

@@ -11,7 +11,7 @@ import { mkdirSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { App } from "./app";
 import { AGENT_DIR, AUTH_PATH, MODELS_PATH, sessionDir } from "./config";
-import { loadSettings } from "./settings";
+import { checkPathsForProject, loadSettings } from "./settings";
 import { installWebSearch, webSearch } from "./web-search";
 import { setWritingStyle, writingStyleExtension } from "./writing-style";
 import {
@@ -59,7 +59,11 @@ export async function start(options: StartupOptions): Promise<void> {
   const spawnPreviewManager = new SpawnPreviewManager();
   const sessionHistoryIndex = new SessionHistoryIndex();
   const messageCacheController = new MessageCacheController(process.cwd());
-  setCheckModeConfig({ profile: settings.checkMode, model: settings.checkModel });
+  setCheckModeConfig({
+    profile: settings.checkMode,
+    model: settings.checkModel,
+    additionalPaths: checkPathsForProject(settings, process.cwd()),
+  });
   const checkApprovalCoordinator = new CheckApprovalCoordinator();
   const checkApprovalStore = new CheckApprovalStore();
   const mainCheckModeExtension = createCheckModeExtension(modelRuntime, undefined, {

package/src/platform.ts

@@ -64,6 +64,23 @@ export function isPathInside(
   return relative !== "" && relative !== ".." && !relative.startsWith(`..${paths.sep}`) && !paths.isAbsolute(relative);
 }
 
+export function pathIdentity(
+  path: string,
+  platform: RuntimePlatform = process.platform,
+): string {
+  const canonical = pathApi(platform).resolve(path);
+  return platform === "win32" ? canonical.toLowerCase() : canonical;
+}
+
+export function isPathInsideOrSame(
+  parent: string,
+  candidate: string,
+  platform: RuntimePlatform = process.platform,
+): boolean {
+  return pathIdentity(parent, platform) === pathIdentity(candidate, platform)
+    || isPathInside(parent, candidate, platform);
+}
+
 export async function canonicalPathIdentity(
   path: string,
   platform: RuntimePlatform = process.platform,
@@ -74,6 +91,28 @@ export async function canonicalPathIdentity(
   return platform === "win32" ? canonical.toLowerCase() : canonical;
 }
 
+export async function canonicalPathIdentityAllowMissing(
+  path: string,
+  platform: RuntimePlatform = process.platform,
+  resolvePath: (path: string) => Promise<string> = realpath,
+): Promise<string> {
+  const paths = pathApi(platform);
+  const absolute = paths.resolve(path);
+  const missing: string[] = [];
+  let existing = absolute;
+  while (true) {
+    try {
+      const canonical = await resolvePath(existing);
+      return pathIdentity(paths.resolve(canonical, ...missing.reverse()), platform);
+    } catch (error) {
+      const parent = paths.dirname(existing);
+      if (parent === existing || existing === paths.parse(existing).root) throw error;
+      missing.push(paths.basename(existing));
+      existing = parent;
+    }
+  }
+}
+
 export async function pathsHaveSameIdentity(
   first: string,
   second: string,

package/src/settings-popup.tsx

@@ -15,6 +15,7 @@ export type SettingRowId =
   | "explanationStrength"
   | "checkMode"
   | "checkModel"
+  | "checkPaths"
   | "clearCheckApprovals"
   | "thinkingLevel"
   | "showThinking"
@@ -44,6 +45,7 @@ export const SETTINGS_ROWS: readonly SettingRow[] = [
   { id: "webSearch", label: "Web search", category: "Agent", keywords: "internet hosted codex provider", description: "Allow hosted web search on supported Codex providers. Other providers are unchanged." },
   { id: "checkMode", label: "Check mode", category: "Safety", keywords: "profile strict balanced ask verify tools hard block approval bash edit patch", description: "Choose off, strict, balanced, or ask. Hard security rules apply to every active profile." },
   { id: "checkModel", label: "Check model", category: "Safety", keywords: "verifier tools safety structured verdict model", description: "Select the separate verifier model used for ambiguous Check mode calls." },
+  { id: "checkPaths", label: "Allowed paths", category: "Safety", keywords: "additional directories roots boundary command", description: "Use /check-path to manage extra directory roots allowed by Check mode for this project." },
   { id: "clearCheckApprovals", label: "Clear approvals", category: "Safety", keywords: "remove reset exact project approvals ask", description: "Remove exact Check mode approvals stored for this project." },
 ];
 

package/src/settings.ts

@@ -2,6 +2,7 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { AGENT_DIR } from "./config";
 import { DEFAULT_CHECK_MODEL } from "./check-mode";
+import { projectStorageKey } from "./platform";
 import { isWritingStyle, type WritingStyle } from "./writing-style";
 import {
   isExplanationStrength,
@@ -15,6 +16,39 @@ export type CheckModeProfile = (typeof CHECK_MODE_PROFILES)[number];
 export const MIN_ACTIVE_SUBAGENTS = 1;
 export const MAX_ACTIVE_SUBAGENTS = 25;
 export const DEFAULT_MAX_ACTIVE_SUBAGENTS = 10;
+export const MAX_CHECK_PATHS_PER_PROJECT = 16;
+
+export type CheckPathsByProject = Record<string, string[]>;
+
+export function normalizeCheckPathsByProject(value: unknown): CheckPathsByProject {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const normalized: CheckPathsByProject = {};
+  for (const [project, paths] of Object.entries(value)) {
+    if (!project || !Array.isArray(paths)) continue;
+    const entries = [...new Set(paths.filter((path): path is string =>
+      typeof path === "string" && path.length > 0 && !path.includes("\0"),
+    ))].slice(0, MAX_CHECK_PATHS_PER_PROJECT);
+    if (entries.length > 0) normalized[project] = entries;
+  }
+  return normalized;
+}
+
+export function checkPathsForProject(settings: Pick<PumSettings, "checkPaths">, cwd: string): string[] {
+  return [...(settings.checkPaths?.[projectStorageKey(cwd)] ?? [])];
+}
+
+export function withCheckPathsForProject(
+  settings: PumSettings,
+  cwd: string,
+  paths: readonly string[],
+): PumSettings {
+  const key = projectStorageKey(cwd);
+  const checkPaths = { ...(settings.checkPaths ?? {}) };
+  const normalized = [...new Set(paths)].slice(0, MAX_CHECK_PATHS_PER_PROJECT);
+  if (normalized.length > 0) checkPaths[key] = normalized;
+  else delete checkPaths[key];
+  return { ...settings, checkPaths };
+}
 
 export function normalizeMaxActiveSubagents(value: unknown): number {
   return typeof value === "number"
@@ -49,6 +83,8 @@ export type PumSettings = {
   explanationStrength: ExplanationStrength;
   checkMode: CheckModeProfile;
   checkModel: string;
+  /** Additional canonical directory roots allowed by Check mode, keyed by launch project. */
+  checkPaths?: CheckPathsByProject;
   maxActiveSubagents: number;
 };
 
@@ -64,6 +100,7 @@ const DEFAULTS: PumSettings = {
   explanationStrength: "simple",
   checkMode: "off",
   checkModel: DEFAULT_CHECK_MODEL,
+  checkPaths: {},
   maxActiveSubagents: DEFAULT_MAX_ACTIVE_SUBAGENTS,
 };
 
@@ -91,6 +128,7 @@ export function normalizeSettings(parsed: unknown): PumSettings {
       typeof merged.checkModel === "string" && merged.checkModel.includes("/")
         ? merged.checkModel
         : DEFAULTS.checkModel,
+    checkPaths: normalizeCheckPathsByProject(merged.checkPaths),
     maxActiveSubagents: normalizeMaxActiveSubagents(merged.maxActiveSubagents),
   };
 }

package/src/subagents/manager.ts

@@ -590,13 +590,13 @@ export class SubagentManager {
         break;
       case "tool_execution_end":
         this.patchTool(record, event.toolCallId, {
-          state: isRejectedToolResult(event.result)
+          state: isRejectedToolResult(event.result, event.toolCallId)
             ? "rejected"
             : event.isError
               ? "error"
               : "ok",
-          detail: isRejectedToolResult(event.result)
-            ? rejectedToolReason(event.result)
+          detail: isRejectedToolResult(event.result, event.toolCallId)
+            ? rejectedToolReason(event.result, event.toolCallId)
             : event.toolName === "edit" || event.toolName === "apply_patch"
               ? editCounts(event.result)
               : event.toolName === "questionnaire"

package/src/transcript.tsx

@@ -375,7 +375,7 @@ export function ToolLine({
   const bodyChunks = call.arg
     ? [fg(argColor)(call.arg)]
     : [fg(toolColor)(call.name)];
-  if (call.detail) bodyChunks.push(fg(detailColor)(`  ${call.detail}`));
+  if (call.detail && !rejected) bodyChunks.push(fg(detailColor)(`  ${call.detail}`));
 
   const caret = useBlinkingText({
     chunks: bodyChunks,
@@ -385,36 +385,49 @@ export function ToolLine({
   });
 
   return (
-    <Row
-      glyph={GUTTER}
-      glyphColor={toolColor}
-      background={rejected ? theme.rejectionBg : undefined}
-    >
-      <box style={{ flexDirection: "row", flexGrow: 1, flexShrink: 1, minWidth: 0 }}>
-        {prefix ? <text content={prefix} selectable style={{ flexShrink: 0 }} /> : null}
-        <text
-          ref={workingCaret ? caret : undefined}
-          content={workingCaret ? undefined : new StyledText(bodyChunks)}
-          selectable
-          wrapMode="word"
-          style={{ flexGrow: 1, flexShrink: 1, minWidth: 0 }}
-        />
-      </box>
-      {/* The transcript scrollbox uses two padding columns and one pinned
-          scrollbar column. The row then uses a two-column gutter and a
-          one-column state marker. Bash reserves one additional column before
-          the marker so commands wrap before the terminal-edge boundary. */}
-      <box style={{ width: call.name === "bash" ? 2 : 1, flexShrink: 0 }} />
-      <box style={{ width: 1, flexShrink: 0 }}>
-        {call.state === "running" ? (
-          <text ref={spinner} fg={theme.accent} />
-        ) : (
+    <box style={{ flexDirection: "column", width: "100%" }}>
+      <Row
+        glyph={GUTTER}
+        glyphColor={toolColor}
+        background={rejected ? theme.rejectionBg : undefined}
+      >
+        <box style={{ flexDirection: "row", flexGrow: 1, flexShrink: 1, minWidth: 0 }}>
+          {prefix ? <text content={prefix} selectable style={{ flexShrink: 0 }} /> : null}
           <text
-            content={toolStateGlyph(call.state)}
-            fg={call.state === "ok" ? theme.success : rejected ? theme.rejection : theme.error}
+            ref={workingCaret ? caret : undefined}
+            content={workingCaret ? undefined : new StyledText(bodyChunks)}
+            selectable
+            wrapMode="word"
+            style={{ flexGrow: 1, flexShrink: 1, minWidth: 0 }}
           />
-        )}
-      </box>
-    </Row>
+        </box>
+        {/* The transcript scrollbox uses two padding columns and one pinned
+            scrollbar column. The row then uses a two-column gutter and a
+            one-column state marker. Bash reserves one additional column before
+            the marker so commands wrap before the terminal-edge boundary. */}
+        <box style={{ width: call.name === "bash" ? 2 : 1, flexShrink: 0 }} />
+        <box style={{ width: 1, flexShrink: 0 }}>
+          {call.state === "running" ? (
+            <text ref={spinner} fg={theme.accent} />
+          ) : (
+            <text
+              content={toolStateGlyph(call.state)}
+              fg={call.state === "ok" ? theme.success : rejected ? theme.rejection : theme.error}
+            />
+          )}
+        </box>
+      </Row>
+      {rejected && call.detail ? (
+        <Row glyph={GUTTER} glyphColor={theme.rejection} background={theme.rejectionBg}>
+          <text
+            content={call.detail}
+            fg={theme.rejection}
+            selectable
+            wrapMode="word"
+            style={{ flexGrow: 1, flexShrink: 1, minWidth: 0, width: "100%" }}
+          />
+        </Row>
+      ) : null}
+    </box>
   );
 }