pum-agent 0.2.5-beta.1 → 0.2.6-beta.1

package/README.md

@@ -40,7 +40,7 @@ The following screens are real OpenTUI renders captured through `tmux`. A local
 
 ## Why PUM
 
-- **Compact terminal UI:** Streaming Markdown, syntax highlighting, thinking traces, tool rows, usage, cost, and Git status.
+- **Compact terminal UI:** Streaming Markdown, syntax highlighting, thinking traces, tool rows, usage, cost, launch directory, and Git status.
 - **Full coding loop:** Built-in `read`, `write`, `edit`, `bash`, and atomic `apply_patch` tools.
 - **Parallel subagents:** Persistent agents work in isolated Git worktrees, communicate durably, and report lifecycle transitions to their direct spawners.
 - **Prompt control:** Steer active work, answer model questionnaires, use an ownership-aware message cache, attach clipboard images, and resume sessions with metadata-rich history.
@@ -223,10 +223,10 @@ Trigger events target one exact main or retained child session. A missing sessio
 Select a Check mode profile in `Ctrl+P`. It applies to `bash`, `edit`, `apply_patch`, and external-trigger process execution:
 
 - **Strict:** Run deterministic hard rules, then require a clear verifier approval.
-- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls and explicit non-sensitive external reads. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
+- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls, explicit non-sensitive external reads, and narrowly validated lifecycle-disabled `npm pack` operations whose cache and output stay in approved roots. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
 - **Ask:** Show the approval popup for every checked call that passes hard rules, unless an exact session or project approval already matches. A verifier `SAFE`, unclear, error, or unavailable result still requires approval.
 
-Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits only explicit, deterministically classified, non-sensitive external reads. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use the exception.
+Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits explicit, deterministically classified, non-sensitive external reads. It also accepts one direct `npm pack` only when lifecycle scripts are disabled, an explicit cache stays in an approved root, output stays in an approved root, and any package operand is one exact registry version; file, Git, URL, tag, range, composed, and global-install forms remain blocked. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only publication exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use it.
 
 Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. Bash, edit, and external-trigger checks can use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.5-beta.1",
+  "version": "0.2.6-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/app.tsx

@@ -2309,6 +2309,7 @@ export function App({
           theme={theme}
           modelId={visibleModelId}
           thinkingLevel={visibleThinkingLevel}
+          cwd={cwd}
           branch={visibleBranch}
           outgoingTokens={visibleUsage.outgoing}
           incomingTokens={visibleUsage.incoming}

package/src/check-policy.ts

@@ -17,6 +17,7 @@ export type CheckPolicyFindingCode =
   | "external-read-exfiltration"
   | "destructive-git"
   | "broad-deletion"
+  | "unsafe-npm-pack"
   | "suspicious-execution"
   | "shell-complexity"
   | "mutation"
@@ -209,6 +210,84 @@ const EXPLICIT_READ_COMMANDS = new Set([
   "cat", "head", "tail", "less", "more", "stat", "file", "ls", "tree", "du", "wc", "realpath", "readlink",
 ]);
 const DATA_OPERAND_COMMANDS = new Set(["printf", "echo"]);
+
+type NpmPackCommand = {
+  valid: boolean;
+  reason?: string;
+  packageSpec?: string;
+  cache?: string;
+  packDestination: string;
+};
+
+function isExactRegistryPackageVersion(value: string): boolean {
+  const packageName = String.raw`(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)`;
+  const numericIdentifier = String.raw`(?:0|[1-9]\d*)`;
+  const prereleaseIdentifier = String.raw`(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)`;
+  const buildIdentifier = String.raw`[0-9a-zA-Z-]+`;
+  const version = String.raw`${numericIdentifier}\.${numericIdentifier}\.${numericIdentifier}(?:-${prereleaseIdentifier}(?:\.${prereleaseIdentifier})*)?(?:\+${buildIdentifier}(?:\.${buildIdentifier})*)?`;
+  return new RegExp(`^${packageName}@${version}$`).test(value);
+}
+
+function npmPackCommand(argv: string[]): NpmPackCommand | undefined {
+  if (commandName(argv[0]) !== "npm" || argv[1] !== "pack") return undefined;
+  const positionals: string[] = [];
+  let cache: string | undefined;
+  let packDestination = ".";
+  let packDestinationSet = false;
+  let ignoreScripts = false;
+  const booleanOptions = new Set(["--dry-run", "--json", "--ignore-scripts"]);
+  const pathOptions = new Map([["--cache", "cache"], ["--pack-destination", "packDestination"]] as const);
+
+  for (let index = 2; index < argv.length; index++) {
+    const value = argv[index]!;
+    if (booleanOptions.has(value)) {
+      if (value === "--ignore-scripts") ignoreScripts = true;
+      continue;
+    }
+    const separate = pathOptions.get(value as "--cache" | "--pack-destination");
+    if (separate) {
+      const path = argv[++index];
+      if (!path || path.startsWith("-")) return { valid: false, reason: `${value} requires one explicit path`, packDestination };
+      if (separate === "cache") {
+        if (cache !== undefined) return { valid: false, reason: "npm pack --cache must occur exactly once", packDestination };
+        cache = path;
+      } else {
+        if (packDestinationSet) return { valid: false, reason: "npm pack --pack-destination must occur at most once", packDestination };
+        packDestination = path;
+        packDestinationSet = true;
+      }
+      continue;
+    }
+    const attached = /^(--cache|--pack-destination)=(.*)$/.exec(value);
+    if (attached) {
+      if (!attached[2]) return { valid: false, reason: `${attached[1]} requires one explicit path`, packDestination };
+      if (attached[1] === "--cache") {
+        if (cache !== undefined) return { valid: false, reason: "npm pack --cache must occur exactly once", packDestination };
+        cache = attached[2];
+      } else {
+        if (packDestinationSet) return { valid: false, reason: "npm pack --pack-destination must occur at most once", packDestination };
+        packDestination = attached[2];
+        packDestinationSet = true;
+      }
+      continue;
+    }
+    if (value === "--") {
+      positionals.push(...argv.slice(index + 1));
+      break;
+    }
+    if (value.startsWith("-")) return { valid: false, reason: `npm pack option ${value} is not in the deterministic allowlist`, packDestination };
+    positionals.push(value);
+  }
+
+  if (!ignoreScripts) return { valid: false, reason: "npm pack must disable lifecycle scripts with --ignore-scripts", packDestination };
+  if (!cache) return { valid: false, reason: "npm pack must set an explicit project-local --cache path", packDestination };
+  if (positionals.length > 1) return { valid: false, reason: "npm pack accepts at most one deterministic package spec", cache, packDestination };
+  if (positionals[0] && !isExactRegistryPackageVersion(positionals[0])) {
+    return { valid: false, reason: "npm pack package spec must be an exact registry package version", cache, packDestination };
+  }
+  return { valid: true, packageSpec: positionals[0], cache, packDestination };
+}
+
 function commandName(argv0: string | undefined): string {
   if (!argv0) return "";
   const basename = argv0.replaceAll("\\", "/").split("/").at(-1) ?? argv0;
@@ -352,6 +431,7 @@ function mutationIndicators(argv: string[], redirections: BashRedirection[]): st
   if (name === "git" && argv[1] && !new Set(["status", "diff", "log", "show", "rev-parse", "ls-files", "branch"]).has(argv[1])) {
     indicators.push("Git state change");
   }
+  if (npmPackCommand(argv)?.valid) indicators.push("package archive or cache output");
   return [...new Set(indicators)];
 }
 
@@ -742,6 +822,12 @@ function classifyStageAccesses(stage: BashStage): ClassifiedAccess[] {
   }
 
   if (DATA_OPERAND_COMMANDS.has(name)) return accesses;
+  const npmPack = npmPackCommand(argv);
+  if (npmPack?.valid) {
+    accesses.push({ path: npmPack.cache!, mode: "write", source: "operand" });
+    accesses.push({ path: npmPack.packDestination, mode: "write", source: "operand" });
+    return accesses;
+  }
   if (["cd", "chdir", "set-location"].includes(name)) {
     return [...accesses, ...positionalOperands(argv).map((path) => ({ path, mode: "location" as const, source: "operand" as const }))];
   }
@@ -930,6 +1016,34 @@ function inspectHardBlocks(
     const argv = effectiveArgv(stage.argv);
     const name = commandName(argv[0]);
     const lowerArgs = argv.map((arg) => arg.toLowerCase());
+    const npmPack = npmPackCommand(argv);
+    if (npmPack) {
+      const direct = commandName(stage.argv[0]) === "npm"
+        && analysis.stages.length === 1
+        && analysis.operators.length === 0
+        && stage.substitutions.length === 0
+        && stage.redirections.length === 0
+        && Object.keys(stage.envAssignments).length === 0;
+      if (!direct || !npmPack.valid) {
+        addFinding(findings, {
+          code: "unsafe-npm-pack",
+          severity: "hard-block",
+          message: !direct ? "npm pack must be one direct command without shell composition" : npmPack.reason!,
+          stage: stage.index,
+        });
+      }
+    }
+    const globalPackageWrite = (name === "npm" || name === "bun")
+      && lowerArgs.some((arg) => new Set(["install", "add", "i", "update", "upgrade", "remove", "uninstall", "link"]).has(arg))
+      && lowerArgs.some((arg) => arg === "-g" || arg === "--global");
+    if (globalPackageWrite) {
+      addFinding(findings, {
+        code: "outside-project",
+        severity: "hard-block",
+        message: "global package installation writes outside the project and approved roots",
+        stage: stage.index,
+      });
+    }
     if (PRIVILEGE_COMMANDS.has(name)
       || ((name === "powershell" || name === "start-process") && lowerArgs.includes("runas"))) {
       addFinding(findings, { code: "privilege-escalation", severity: "hard-block", message: `${name} can escalate privileges`, stage: stage.index });
@@ -1191,6 +1305,9 @@ function stageNetworkCommand(stage: BashStage): string | undefined {
   if (NETWORK_COMMANDS.has(name)) return name;
   const subcommand = (argv[1] ?? "").toLowerCase();
   if (name === "git" && new Set(["clone", "fetch", "pull", "push", "ls-remote"]).has(subcommand)) return `git ${subcommand}`;
+  if (name === "npm" && subcommand === "pack") {
+    return npmPackCommand(argv)?.packageSpec ? "npm pack" : undefined;
+  }
   if (["npm", "pnpm", "yarn"].includes(name)
     && new Set(["add", "audit", "install", "publish", "search", "update", "upgrade", "view", "info"]).has(subcommand)) {
     return `${name} ${subcommand}`;

package/src/status-bar.tsx

@@ -15,6 +15,7 @@ export type StatusProps = {
   theme: Theme;
   modelId: string;
   thinkingLevel: string;
+  cwd: string;
   branch: string | null;
   outgoingTokens: number;
   incomingTokens: number;
@@ -65,6 +66,7 @@ type StatusBarLayoutInput = Pick<
   StatusProps,
   | "modelId"
   | "thinkingLevel"
+  | "cwd"
   | "branch"
   | "outgoingTokens"
   | "incomingTokens"
@@ -183,6 +185,10 @@ export function statusBarLayout(input: StatusBarLayoutInput): StatusBarLayout {
     layout.trailingSpace = false;
     measureLayout(input, layout);
   }
+  if (layout.totalWidth > input.width) {
+    layout.metadata = layout.metadata.filter((item) => item.key !== "cwd");
+    measureLayout(input, layout);
+  }
   if (layout.totalWidth > input.width) {
     layout.showIdleAgents = false;
     measureLayout(input, layout);

package/src/status-metadata.ts

@@ -2,6 +2,7 @@ import { fg, type TextChunk } from "@opentui/core";
 import type { Theme } from "./theme";
 
 export type StatusMetadataValues = {
+  cwd?: string;
   branch: string | null;
   outgoingTokens: number;
   incomingTokens: number;
@@ -11,9 +12,9 @@ export type StatusMetadataValues = {
 };
 
 export type StatusMetadataItem = {
-  key: "branch" | "outgoing" | "incoming" | "cacheRead" | "cost" | "context";
+  key: "cwd" | "branch" | "outgoing" | "incoming" | "cacheRead" | "cost" | "context";
   text: string;
-  tone: "branch" | "dim" | "warn";
+  tone: "cwd" | "branch" | "dim" | "warn";
   priority: number;
 };
 
@@ -28,8 +29,20 @@ export const formatCost = (value: number): string =>
 
 export const statusTextWidth = (text: string): number => Bun.stringWidth(text);
 
+/** Show the launch directory without the long parent path. */
+export function formatWorkingDirectory(cwd: string): string {
+  const withoutTrailingSeparators = cwd.replace(/[\\/]+$/, "");
+  if (!withoutTrailingSeparators) return "cwd /";
+  if (/^[A-Za-z]:$/.test(withoutTrailingSeparators)) return `cwd ${withoutTrailingSeparators}\\`;
+  const name = withoutTrailingSeparators.split(/[\\/]/).at(-1) || withoutTrailingSeparators;
+  return `cwd ${name}`;
+}
+
 export function statusMetadataItems(values: StatusMetadataValues): StatusMetadataItem[] {
   const items: StatusMetadataItem[] = [];
+  if (values.cwd) {
+    items.push({ key: "cwd", text: formatWorkingDirectory(values.cwd), tone: "cwd", priority: 85 });
+  }
   if (values.branch) {
     items.push({ key: "branch", text: values.branch, tone: "branch", priority: 90 });
   }
@@ -101,8 +114,10 @@ export function statusMetadataChunks(
   const chunks: TextChunk[] = [];
   for (const item of items) {
     if (chunks.length) chunks.push(fg(theme.dim)(" · "));
-    const color = item.tone === "branch"
-      ? theme.toolArg
+    const color = item.tone === "cwd"
+      ? theme.statusCwd
+      : item.tone === "branch"
+        ? theme.toolArg
       : item.tone === "warn"
         ? theme.warn
         : theme.dim;

package/src/theme.ts

@@ -9,6 +9,8 @@ export type Theme = {
   fg: string;
   dim: string;
   accent: string;
+  /** Foreground for the current working directory in the status bar. */
+  statusCwd: string;
   border: string;
   /** Foreground and background of a user turn's full-width bar. */
   user: string;
@@ -47,6 +49,7 @@ const tokyonight: Theme = {
   fg: "#c0caf5",
   dim: "#565f89",
   accent: "#7aa2f7",
+  statusCwd: "#2ac3de",
   border: "#292e42",
   user: "#c0caf5",
   userBg: "#283457",
@@ -79,6 +82,7 @@ const gruvbox: Theme = {
   fg: "#ebdbb2",
   dim: "#928374",
   accent: "#83a598",
+  statusCwd: "#8ec07c",
   border: "#3c3836",
   user: "#ebdbb2",
   userBg: "#3c3836",
@@ -111,6 +115,7 @@ const catppuccin: Theme = {
   fg: "#cdd6f4",
   dim: "#6c7086",
   accent: "#89b4fa",
+  statusCwd: "#94e2d5",
   border: "#313244",
   user: "#cdd6f4",
   userBg: "#313244",
@@ -143,6 +148,7 @@ const nord: Theme = {
   fg: "#d8dee9",
   dim: "#7b88a1",
   accent: "#88c0d0",
+  statusCwd: "#8fbcbb",
   border: "#3b4252",
   user: "#eceff4",
   userBg: "#434c5e",
@@ -175,6 +181,7 @@ const dracula: Theme = {
   fg: "#f8f8f2",
   dim: "#6272a4",
   accent: "#bd93f9",
+  statusCwd: "#8be9fd",
   border: "#44475a",
   user: "#f8f8f2",
   userBg: "#44475a",
@@ -207,6 +214,7 @@ const rosepine: Theme = {
   fg: "#e0def4",
   dim: "#6e6a86",
   accent: "#c4a7e7",
+  statusCwd: "#9ccfd8",
   border: "#26233a",
   user: "#e0def4",
   userBg: "#26233a",
@@ -239,6 +247,7 @@ const solarized: Theme = {
   fg: "#839496",
   dim: "#586e75",
   accent: "#268bd2",
+  statusCwd: "#2aa198",
   border: "#073642",
   user: "#93a1a1",
   userBg: "#073642",
@@ -271,6 +280,7 @@ const kanagawa: Theme = {
   fg: "#dcd7ba",
   dim: "#727169",
   accent: "#7e9cd8",
+  statusCwd: "#7fb4ca",
   border: "#2a2a37",
   user: "#dcd7ba",
   userBg: "#2d4f67",
@@ -303,6 +313,7 @@ const githubLight: Theme = {
   fg: "#24292f",
   dim: "#6e7781",
   accent: "#0969da",
+  statusCwd: "#0a3069",
   border: "#d0d7de",
   user: "#24292f",
   userBg: "#ddf4ff",