pum-agent 0.2.0-beta.4 → 0.2.1-beta.1

package/README.md

@@ -129,7 +129,7 @@ Set `PUM_DIR` to override PUM's complete configuration and data directory. Run `
 | `Ctrl+C` | Clear the selected non-empty draft; on an empty draft, press twice to quit |
 | `?` | Show all controls when the prompt is empty |
 
-Useful commands include `/login`, `/history`, `/triggers`, `/clear`, `/compress`, and `/worktree`.
+Useful commands include `/login`, `/history`, `/triggers`, `/check-path`, `/clear`, `/compress`, and `/worktree`.
 
 ### Copy transcript text
 
@@ -210,6 +210,8 @@ Select a Check mode profile in `Ctrl+P`. It applies to `bash`, `edit`, `apply_pa
 
 Every active profile hard-blocks project escape, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use the exception.
 
+Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. Bash, edit, and external-trigger checks can use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
+
 For `edit` and `apply_patch`, PUM validates the complete proposed change before any mutation. Review data includes the unified diff, changed paths, line counts, sensitivity flags, project containment, and full-content SHA-256. Invalid, stale, malformed, escaping, or incompletely analyzed input blocks the call. Patch length alone does not block a valid Balanced call.
 
 Ask mode can allow an exact call once, for the current session, or for the current project. Approvals match the authoritative main or child identity, tool, verifier model, project, and canonical complete input. Chat text is not approval. Use **Clear approvals** in Settings to remove project approvals.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.0-beta.4",
+  "version": "0.2.1-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/check-mutation.ts

@@ -1,9 +1,15 @@
 import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
 import { createHash } from "node:crypto";
 import { lstat, readFile, realpath } from "node:fs/promises";
-import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, dirname, relative, resolve, sep } from "node:path";
 import { previewApplyPatch } from "./apply-patch";
 import type { CheckedToolName } from "./check-approvals";
+import {
+  canonicalPathIdentityAllowMissing,
+  isPathInsideOrSame,
+  pathIdentity,
+  pathsHaveSameIdentity,
+} from "./platform";
 
 export type MutationSensitivity = {
   executable: boolean;
@@ -66,11 +72,6 @@ function windowsAbsolute(path: string): boolean {
   return /^[A-Za-z]:[\\/]/.test(path) || /^\\\\/.test(path) || /^\/\//.test(path);
 }
 
-function insideRoot(root: string, path: string): boolean {
-  const rel = relative(root, path);
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
-}
-
 async function validateEditPath(
   cwd: string,
   inputPath: string,
@@ -83,23 +84,34 @@ async function validateEditPath(
   const projectRoot = await realpath(cwd);
   const roots = await Promise.all([projectRoot, ...allowedPaths].map((path) => realpath(path)));
   const absolute = resolve(projectRoot, inputPath);
-  const root = roots.sort((first, second) => second.length - first.length)
-    .find((candidate) => candidate === absolute || insideRoot(candidate, absolute));
+  const sortedRoots = roots.sort((first, second) => second.length - first.length);
+  let root = sortedRoots.find((candidate) => isPathInsideOrSame(candidate, absolute));
+  if (!root) {
+    let targetIdentity: string;
+    try {
+      targetIdentity = await canonicalPathIdentityAllowMissing(absolute);
+    } catch {
+      throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
+    }
+    root = sortedRoots.find((candidate) => isPathInsideOrSame(pathIdentity(candidate), targetIdentity));
+  }
   if (!root) throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
+  const canonical = await realpath(absolute);
 
-  let component = root;
-  const rel = relative(root, absolute);
-  for (const part of rel.split(sep).filter(Boolean)) {
-    component = resolve(component, part);
+  let component = absolute;
+  while (true) {
     const metadata = await lstat(component);
     if (metadata.isSymbolicLink()) throw new Error(`Edit path contains an escaping link or junction: ${inputPath}`);
+    if (await pathsHaveSameIdentity(component, root)) break;
+    const parent = dirname(component);
+    if (parent === component) throw new Error(`Edit path is outside the allowed Check mode paths: ${inputPath}`);
+    component = parent;
   }
-  const canonical = await realpath(absolute);
-  if (!insideRoot(root, canonical)) throw new Error(`Edit path resolves outside the project: ${inputPath}`);
+  if (!isPathInsideOrSame(root, canonical)) throw new Error(`Edit path resolves outside the project: ${inputPath}`);
   const metadata = await lstat(absolute);
   if (!metadata.isFile()) throw new Error(`Edit path is not a file: ${inputPath}`);
-  const display = projectRoot === absolute || insideRoot(projectRoot, absolute)
-    ? relative(projectRoot, absolute).split(sep).join("/")
+  const display = isPathInsideOrSame(projectRoot, canonical)
+    ? relative(projectRoot, canonical).split(sep).join("/")
     : absolute;
   return { root, absolute, display, mode: metadata.mode };
 }

package/src/check-paths.ts

@@ -1,8 +1,13 @@
 import { lstat, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { dirname, resolve } from "node:path";
 import { AGENT_DIR } from "./config";
 import { isCredentialSensitivePath } from "./check-policy";
+import {
+  canonicalPathIdentityAllowMissing,
+  isPathInsideOrSame,
+  pathIdentity,
+} from "./platform";
 import {
   checkPathsForProject,
   MAX_CHECK_PATHS_PER_PROJECT,
@@ -39,11 +44,6 @@ export function parseCheckPathCommand(input: string): CheckPathCommand | undefin
   return { action: action[1] as "add" | "remove", path };
 }
 
-function insideOrSame(parent: string, candidate: string): boolean {
-  const rel = relative(parent, candidate);
-  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
-}
-
 async function canonicalDirectory(input: string, cwd: string): Promise<string> {
   const absolute = resolve(cwd, input);
   const canonical = await realpath(absolute);
@@ -57,10 +57,10 @@ async function canonicalDirectory(input: string, cwd: string): Promise<string> {
     realpath(AGENT_DIR).catch(() => resolve(AGENT_DIR)),
     realpath(homedir()).catch(() => resolve(homedir())),
   ]);
-  if (insideOrSame(canonical, agentDirectory) || insideOrSame(agentDirectory, canonical)) {
+  if (isPathInsideOrSame(canonical, agentDirectory) || isPathInsideOrSame(agentDirectory, canonical)) {
     throw new Error("Check path cannot contain or enter PUM's configuration directory");
   }
-  if (insideOrSame(canonical, homeDirectory)) {
+  if (isPathInsideOrSame(canonical, homeDirectory)) {
     throw new Error("Check path cannot contain the home directory");
   }
   return canonical;
@@ -68,7 +68,7 @@ async function canonicalDirectory(input: string, cwd: string): Promise<string> {
 
 async function removalIdentity(input: string, cwd: string): Promise<string> {
   const absolute = resolve(cwd, input);
-  return realpath(absolute).catch(() => absolute);
+  return canonicalPathIdentityAllowMissing(absolute);
 }
 
 export async function applyCheckPathCommand(
@@ -102,10 +102,13 @@ export async function applyCheckPathCommand(
     : await removalIdentity(command.path, cwd);
   const project = await realpath(cwd);
   if (command.action === "add") {
-    if (canonical === project || insideOrSame(project, canonical)) {
+    if (isPathInsideOrSame(project, canonical)) {
       throw new Error("The directory is already inside the project boundary");
     }
-    if (paths.includes(canonical)) throw new Error(`Check path is already allowed: ${canonical}`);
+    const identity = pathIdentity(canonical);
+    if (paths.some((path) => pathIdentity(path) === identity)) {
+      throw new Error(`Check path is already allowed: ${canonical}`);
+    }
     if (paths.length >= MAX_CHECK_PATHS_PER_PROJECT) {
       throw new Error(`Check mode allows at most ${MAX_CHECK_PATHS_PER_PROJECT} additional paths per project`);
     }
@@ -117,7 +120,8 @@ export async function applyCheckPathCommand(
     };
   }
 
-  const index = paths.indexOf(canonical);
+  const identity = pathIdentity(canonical);
+  const index = paths.findIndex((path) => pathIdentity(path) === identity);
   if (index < 0) throw new Error(`Check path is not configured: ${canonical}`);
   const nextPaths = paths.filter((_path, candidate) => candidate !== index);
   return {

package/src/check-policy.ts

@@ -617,11 +617,16 @@ function additionalRootProblem(
 ): "missing" | "link" | undefined {
   try {
     if (!fs.exists(root)) return "missing";
-    if (fs.isSymbolicLink(root)) return "link";
     const flavor = pathFlavor(root, root);
-    return flavor.relative(flavor.resolve(root), flavor.resolve(fs.realpath(root))) === ""
-      ? undefined
-      : "link";
+    const resolved = flavor.resolve(root);
+    const parsed = flavor.parse(resolved);
+    let component = parsed.root;
+    for (const part of resolved.slice(parsed.root.length).split(/[\\/]+/).filter(Boolean)) {
+      component = flavor.join(component, part);
+      if (fs.isSymbolicLink(component)) return "link";
+    }
+    fs.realpath(root);
+    return undefined;
   } catch {
     return "link";
   }

package/src/platform.ts

@@ -64,6 +64,23 @@ export function isPathInside(
   return relative !== "" && relative !== ".." && !relative.startsWith(`..${paths.sep}`) && !paths.isAbsolute(relative);
 }
 
+export function pathIdentity(
+  path: string,
+  platform: RuntimePlatform = process.platform,
+): string {
+  const canonical = pathApi(platform).resolve(path);
+  return platform === "win32" ? canonical.toLowerCase() : canonical;
+}
+
+export function isPathInsideOrSame(
+  parent: string,
+  candidate: string,
+  platform: RuntimePlatform = process.platform,
+): boolean {
+  return pathIdentity(parent, platform) === pathIdentity(candidate, platform)
+    || isPathInside(parent, candidate, platform);
+}
+
 export async function canonicalPathIdentity(
   path: string,
   platform: RuntimePlatform = process.platform,
@@ -74,6 +91,28 @@ export async function canonicalPathIdentity(
   return platform === "win32" ? canonical.toLowerCase() : canonical;
 }
 
+export async function canonicalPathIdentityAllowMissing(
+  path: string,
+  platform: RuntimePlatform = process.platform,
+  resolvePath: (path: string) => Promise<string> = realpath,
+): Promise<string> {
+  const paths = pathApi(platform);
+  const absolute = paths.resolve(path);
+  const missing: string[] = [];
+  let existing = absolute;
+  while (true) {
+    try {
+      const canonical = await resolvePath(existing);
+      return pathIdentity(paths.resolve(canonical, ...missing.reverse()), platform);
+    } catch (error) {
+      const parent = paths.dirname(existing);
+      if (parent === existing || existing === paths.parse(existing).root) throw error;
+      missing.push(paths.basename(existing));
+      existing = parent;
+    }
+  }
+}
+
 export async function pathsHaveSameIdentity(
   first: string,
   second: string,