pum-agent 0.2.5-beta.1 → 0.2.7-beta.1

package/README.md

@@ -40,7 +40,7 @@ The following screens are real OpenTUI renders captured through `tmux`. A local
 
 ## Why PUM
 
-- **Compact terminal UI:** Streaming Markdown, syntax highlighting, thinking traces, tool rows, usage, cost, and Git status.
+- **Compact terminal UI:** Streaming Markdown, syntax highlighting, thinking traces, tool rows, usage, cost, launch directory, and Git status.
 - **Full coding loop:** Built-in `read`, `write`, `edit`, `bash`, and atomic `apply_patch` tools.
 - **Parallel subagents:** Persistent agents work in isolated Git worktrees, communicate durably, and report lifecycle transitions to their direct spawners.
 - **Prompt control:** Steer active work, answer model questionnaires, use an ownership-aware message cache, attach clipboard images, and resume sessions with metadata-rich history.
@@ -223,10 +223,10 @@ Trigger events target one exact main or retained child session. A missing sessio
 Select a Check mode profile in `Ctrl+P`. It applies to `bash`, `edit`, `apply_patch`, and external-trigger process execution:
 
 - **Strict:** Run deterministic hard rules, then require a clear verifier approval.
-- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls and explicit non-sensitive external reads. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
+- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls, explicit non-sensitive external reads, and narrow lifecycle-disabled npm release verification operations whose writes stay in approved roots. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
 - **Ask:** Show the approval popup for every checked call that passes hard rules, unless an exact session or project approval already matches. A verifier `SAFE`, unclear, error, or unavailable result still requires approval.
 
-Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits only explicit, deterministically classified, non-sensitive external reads. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use the exception.
+Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits explicit, deterministically classified, non-sensitive external reads. It accepts one direct `npm pack` only when lifecycle scripts are disabled, an explicit cache stays in an approved root, output stays in an approved root, and any package operand is one exact registry version. Balanced also accepts one direct `npm install` of one exact registry version only when `--ignore-scripts`, an approved `--prefix`, and an approved `--cache` are explicit. File, Git, URL, tag, range, composed, general install, and global-install forms remain blocked. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only publication exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use it.
 
 Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. Bash, edit, and external-trigger checks can use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.5-beta.1",
+  "version": "0.2.7-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/app.tsx

@@ -1,7 +1,7 @@
 import { decodePasteBytes, type ScrollBoxRenderable, type TextareaRenderable } from "@opentui/core";
 import { randomUUID } from "node:crypto";
 import { useKeyboard, usePaste, useTerminalDimensions } from "@opentui/react";
-import type { Model } from "@earendil-works/pi-ai";
+import { getSupportedThinkingLevels, type Model } from "@earendil-works/pi-ai";
 import type { AgentSession, ModelRuntime } from "@earendil-works/pi-coding-agent";
 import { Fragment, useEffect, useMemo, useRef, useState } from "react";
 import { AnimationProvider, supportsTrueColor, useWorkingRule, type WorkingRuleRole } from "./animation";
@@ -13,7 +13,6 @@ import {
   moveSettingSelection,
   SettingsPopup,
   SETTINGS_ROWS,
-  THINKING_LEVELS,
   type SettingRowId,
   type ThinkingLevel,
 } from "./settings-popup";
@@ -1095,8 +1094,9 @@ export function App({
   };
 
   const stepThinking = (step: number) => {
-    const i = THINKING_LEVELS.indexOf(thinkingLevel);
-    const target = THINKING_LEVELS[Math.max(0, Math.min(THINKING_LEVELS.length - 1, i + step))]!;
+    const levels = getSupportedThinkingLevels(session.agent.state.model);
+    const i = levels.indexOf(thinkingLevel);
+    const target = levels[Math.max(0, Math.min(levels.length - 1, i + step))]!;
     session.setThinkingLevel(target);
     // setThinkingLevel clamps to what the model supports — show the real value.
     setThinkingLevel(session.agent.state.thinkingLevel as ThinkingLevel);
@@ -2309,6 +2309,7 @@ export function App({
           theme={theme}
           modelId={visibleModelId}
           thinkingLevel={visibleThinkingLevel}
+          cwd={cwd}
           branch={visibleBranch}
           outgoingTokens={visibleUsage.outgoing}
           incomingTokens={visibleUsage.incoming}

package/src/check-policy.ts

@@ -17,6 +17,8 @@ export type CheckPolicyFindingCode =
   | "external-read-exfiltration"
   | "destructive-git"
   | "broad-deletion"
+  | "unsafe-npm-install"
+  | "unsafe-npm-pack"
   | "suspicious-execution"
   | "shell-complexity"
   | "mutation"
@@ -209,12 +211,172 @@ const EXPLICIT_READ_COMMANDS = new Set([
   "cat", "head", "tail", "less", "more", "stat", "file", "ls", "tree", "du", "wc", "realpath", "readlink",
 ]);
 const DATA_OPERAND_COMMANDS = new Set(["printf", "echo"]);
+
+type NpmPackCommand = {
+  valid: boolean;
+  reason?: string;
+  packageSpec?: string;
+  cache?: string;
+  packDestination: string;
+};
+
+type NpmInstallCommand = {
+  valid: boolean;
+  reason?: string;
+  packageSpec?: string;
+  prefix?: string;
+  cache?: string;
+};
+
+function isExactRegistryPackageVersion(value: string): boolean {
+  const packageName = String.raw`(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)`;
+  const numericIdentifier = String.raw`(?:0|[1-9]\d*)`;
+  const prereleaseIdentifier = String.raw`(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)`;
+  const buildIdentifier = String.raw`[0-9a-zA-Z-]+`;
+  const version = String.raw`${numericIdentifier}\.${numericIdentifier}\.${numericIdentifier}(?:-${prereleaseIdentifier}(?:\.${prereleaseIdentifier})*)?(?:\+${buildIdentifier}(?:\.${buildIdentifier})*)?`;
+  return new RegExp(`^${packageName}@${version}$`).test(value);
+}
+
+function npmInstallCommand(argv: string[]): NpmInstallCommand | undefined {
+  if (commandName(argv[0]) !== "npm" || argv[1] !== "install") return undefined;
+  const positionals: string[] = [];
+  let prefix: string | undefined;
+  let cache: string | undefined;
+  let ignoreScriptsCount = 0;
+  const pathOptions = new Map([["--prefix", "prefix"], ["--cache", "cache"]] as const);
+
+  for (let index = 2; index < argv.length; index++) {
+    const value = argv[index]!;
+    if (value === "--ignore-scripts") {
+      ignoreScriptsCount++;
+      continue;
+    }
+    const separate = pathOptions.get(value as "--prefix" | "--cache");
+    if (separate) {
+      const path = argv[++index];
+      if (!path || path.startsWith("-")) return { valid: false, reason: `${value} requires one explicit path` };
+      if (separate === "prefix") {
+        if (prefix !== undefined) return { valid: false, reason: "npm install --prefix must occur exactly once" };
+        prefix = path;
+      } else {
+        if (cache !== undefined) return { valid: false, reason: "npm install --cache must occur exactly once" };
+        cache = path;
+      }
+      continue;
+    }
+    const attached = /^(--prefix|--cache)=(.*)$/.exec(value);
+    if (attached) {
+      if (!attached[2]) return { valid: false, reason: `${attached[1]} requires one explicit path` };
+      if (attached[1] === "--prefix") {
+        if (prefix !== undefined) return { valid: false, reason: "npm install --prefix must occur exactly once" };
+        prefix = attached[2];
+      } else {
+        if (cache !== undefined) return { valid: false, reason: "npm install --cache must occur exactly once" };
+        cache = attached[2];
+      }
+      continue;
+    }
+    if (value.startsWith("-")) {
+      return { valid: false, reason: `npm install option ${value} is not in the deterministic allowlist` };
+    }
+    positionals.push(value);
+  }
+
+  if (ignoreScriptsCount !== 1) {
+    return { valid: false, reason: "npm install must disable lifecycle scripts exactly once with --ignore-scripts" };
+  }
+  if (!prefix) return { valid: false, reason: "npm install must set an explicit approved --prefix path" };
+  if (!cache) return { valid: false, reason: "npm install must set an explicit approved --cache path" };
+  if ([prefix, cache].some((path) => /[*?\[\]{}]/.test(path))) {
+    return { valid: false, reason: "npm install write paths must not contain shell expansion patterns" };
+  }
+  if (positionals.length !== 1 || !isExactRegistryPackageVersion(positionals[0]!)) {
+    return { valid: false, reason: "npm install must use one exact registry package version" };
+  }
+  return { valid: true, packageSpec: positionals[0], prefix, cache };
+}
+
+function npmPackCommand(argv: string[]): NpmPackCommand | undefined {
+  if (commandName(argv[0]) !== "npm" || argv[1] !== "pack") return undefined;
+  const positionals: string[] = [];
+  let cache: string | undefined;
+  let packDestination = ".";
+  let packDestinationSet = false;
+  let ignoreScripts = false;
+  const booleanOptions = new Set(["--dry-run", "--json", "--ignore-scripts"]);
+  const pathOptions = new Map([["--cache", "cache"], ["--pack-destination", "packDestination"]] as const);
+
+  for (let index = 2; index < argv.length; index++) {
+    const value = argv[index]!;
+    if (booleanOptions.has(value)) {
+      if (value === "--ignore-scripts") ignoreScripts = true;
+      continue;
+    }
+    const separate = pathOptions.get(value as "--cache" | "--pack-destination");
+    if (separate) {
+      const path = argv[++index];
+      if (!path || path.startsWith("-")) return { valid: false, reason: `${value} requires one explicit path`, packDestination };
+      if (separate === "cache") {
+        if (cache !== undefined) return { valid: false, reason: "npm pack --cache must occur exactly once", packDestination };
+        cache = path;
+      } else {
+        if (packDestinationSet) return { valid: false, reason: "npm pack --pack-destination must occur at most once", packDestination };
+        packDestination = path;
+        packDestinationSet = true;
+      }
+      continue;
+    }
+    const attached = /^(--cache|--pack-destination)=(.*)$/.exec(value);
+    if (attached) {
+      if (!attached[2]) return { valid: false, reason: `${attached[1]} requires one explicit path`, packDestination };
+      if (attached[1] === "--cache") {
+        if (cache !== undefined) return { valid: false, reason: "npm pack --cache must occur exactly once", packDestination };
+        cache = attached[2];
+      } else {
+        if (packDestinationSet) return { valid: false, reason: "npm pack --pack-destination must occur at most once", packDestination };
+        packDestination = attached[2];
+        packDestinationSet = true;
+      }
+      continue;
+    }
+    if (value === "--") {
+      positionals.push(...argv.slice(index + 1));
+      break;
+    }
+    if (value.startsWith("-")) return { valid: false, reason: `npm pack option ${value} is not in the deterministic allowlist`, packDestination };
+    positionals.push(value);
+  }
+
+  if (!ignoreScripts) return { valid: false, reason: "npm pack must disable lifecycle scripts with --ignore-scripts", packDestination };
+  if (!cache) return { valid: false, reason: "npm pack must set an explicit project-local --cache path", packDestination };
+  if (positionals.length > 1) return { valid: false, reason: "npm pack accepts at most one deterministic package spec", cache, packDestination };
+  if (positionals[0] && !isExactRegistryPackageVersion(positionals[0])) {
+    return { valid: false, reason: "npm pack package spec must be an exact registry package version", cache, packDestination };
+  }
+  return { valid: true, packageSpec: positionals[0], cache, packDestination };
+}
+
 function commandName(argv0: string | undefined): string {
   if (!argv0) return "";
   const basename = argv0.replaceAll("\\", "/").split("/").at(-1) ?? argv0;
   return basename.replace(/\.(?:exe|cmd|bat)$/i, "").toLowerCase();
 }
 
+function npmSubcommand(argv: string[]): string | undefined {
+  if (commandName(argv[0]) !== "npm") return undefined;
+  const valueOptions = new Set(["--cache", "--prefix", "--registry", "--userconfig"]);
+  for (let index = 1; index < argv.length; index++) {
+    const value = argv[index]!;
+    if (valueOptions.has(value)) {
+      index++;
+      continue;
+    }
+    if (value.startsWith("-")) continue;
+    return value.toLowerCase();
+  }
+  return undefined;
+}
+
 function effectiveArgv(argv: string[]): string[] {
   let current = argv;
   for (let depth = 0; depth < 4; depth++) {
@@ -352,6 +514,8 @@ function mutationIndicators(argv: string[], redirections: BashRedirection[]): st
   if (name === "git" && argv[1] && !new Set(["status", "diff", "log", "show", "rev-parse", "ls-files", "branch"]).has(argv[1])) {
     indicators.push("Git state change");
   }
+  if (npmInstallCommand(argv)?.valid) indicators.push("package installation or cache output");
+  if (npmPackCommand(argv)?.valid) indicators.push("package archive or cache output");
   return [...new Set(indicators)];
 }
 
@@ -742,6 +906,18 @@ function classifyStageAccesses(stage: BashStage): ClassifiedAccess[] {
   }
 
   if (DATA_OPERAND_COMMANDS.has(name)) return accesses;
+  const npmInstall = npmInstallCommand(argv);
+  if (npmInstall?.valid) {
+    accesses.push({ path: npmInstall.prefix!, mode: "write", source: "operand" });
+    accesses.push({ path: npmInstall.cache!, mode: "write", source: "operand" });
+    return accesses;
+  }
+  const npmPack = npmPackCommand(argv);
+  if (npmPack?.valid) {
+    accesses.push({ path: npmPack.cache!, mode: "write", source: "operand" });
+    accesses.push({ path: npmPack.packDestination, mode: "write", source: "operand" });
+    return accesses;
+  }
   if (["cd", "chdir", "set-location"].includes(name)) {
     return [...accesses, ...positionalOperands(argv).map((path) => ({ path, mode: "location" as const, source: "operand" as const }))];
   }
@@ -930,6 +1106,61 @@ function inspectHardBlocks(
     const argv = effectiveArgv(stage.argv);
     const name = commandName(argv[0]);
     const lowerArgs = argv.map((arg) => arg.toLowerCase());
+    const npmInstall = npmInstallCommand(argv);
+    if (npmInstall) {
+      const direct = commandName(stage.argv[0]) === "npm"
+        && analysis.stages.length === 1
+        && analysis.operators.length === 0
+        && stage.substitutions.length === 0
+        && stage.redirections.length === 0
+        && Object.keys(stage.envAssignments).length === 0;
+      if (!direct || !npmInstall.valid) {
+        addFinding(findings, {
+          code: "unsafe-npm-install",
+          severity: "hard-block",
+          message: !direct ? "npm install must be one direct command without shell composition" : npmInstall.reason!,
+          stage: stage.index,
+        });
+      }
+    } else if (name === "npm" && new Set([
+      "install", "i", "add", "ci", "install-ci-test", "install-test", "rebuild",
+      "update", "upgrade", "remove", "uninstall", "link",
+    ]).has(npmSubcommand(argv) ?? "")) {
+      addFinding(findings, {
+        code: "unsafe-npm-install",
+        severity: "hard-block",
+        message: "only the deterministic direct npm install verification form is supported",
+        stage: stage.index,
+      });
+    }
+    const npmPack = npmPackCommand(argv);
+    if (npmPack) {
+      const direct = commandName(stage.argv[0]) === "npm"
+        && analysis.stages.length === 1
+        && analysis.operators.length === 0
+        && stage.substitutions.length === 0
+        && stage.redirections.length === 0
+        && Object.keys(stage.envAssignments).length === 0;
+      if (!direct || !npmPack.valid) {
+        addFinding(findings, {
+          code: "unsafe-npm-pack",
+          severity: "hard-block",
+          message: !direct ? "npm pack must be one direct command without shell composition" : npmPack.reason!,
+          stage: stage.index,
+        });
+      }
+    }
+    const globalPackageWrite = (name === "npm" || name === "bun")
+      && lowerArgs.some((arg) => new Set(["install", "add", "i", "update", "upgrade", "remove", "uninstall", "link"]).has(arg))
+      && lowerArgs.some((arg) => arg === "-g" || arg === "--global");
+    if (globalPackageWrite) {
+      addFinding(findings, {
+        code: "outside-project",
+        severity: "hard-block",
+        message: "global package installation writes outside the project and approved roots",
+        stage: stage.index,
+      });
+    }
     if (PRIVILEGE_COMMANDS.has(name)
       || ((name === "powershell" || name === "start-process") && lowerArgs.includes("runas"))) {
       addFinding(findings, { code: "privilege-escalation", severity: "hard-block", message: `${name} can escalate privileges`, stage: stage.index });
@@ -1191,6 +1422,12 @@ function stageNetworkCommand(stage: BashStage): string | undefined {
   if (NETWORK_COMMANDS.has(name)) return name;
   const subcommand = (argv[1] ?? "").toLowerCase();
   if (name === "git" && new Set(["clone", "fetch", "pull", "push", "ls-remote"]).has(subcommand)) return `git ${subcommand}`;
+  if (name === "npm" && subcommand === "pack") {
+    return npmPackCommand(argv)?.packageSpec ? "npm pack" : undefined;
+  }
+  if (name === "npm" && subcommand === "install") {
+    return npmInstallCommand(argv)?.valid ? "npm install" : undefined;
+  }
   if (["npm", "pnpm", "yarn"].includes(name)
     && new Set(["add", "audit", "install", "publish", "search", "update", "upgrade", "view", "info"]).has(subcommand)) {
     return `${name} ${subcommand}`;

package/src/status-bar.tsx

@@ -15,6 +15,7 @@ export type StatusProps = {
   theme: Theme;
   modelId: string;
   thinkingLevel: string;
+  cwd: string;
   branch: string | null;
   outgoingTokens: number;
   incomingTokens: number;
@@ -65,6 +66,7 @@ type StatusBarLayoutInput = Pick<
   StatusProps,
   | "modelId"
   | "thinkingLevel"
+  | "cwd"
   | "branch"
   | "outgoingTokens"
   | "incomingTokens"
@@ -183,6 +185,10 @@ export function statusBarLayout(input: StatusBarLayoutInput): StatusBarLayout {
     layout.trailingSpace = false;
     measureLayout(input, layout);
   }
+  if (layout.totalWidth > input.width) {
+    layout.metadata = layout.metadata.filter((item) => item.key !== "cwd");
+    measureLayout(input, layout);
+  }
   if (layout.totalWidth > input.width) {
     layout.showIdleAgents = false;
     measureLayout(input, layout);

package/src/status-metadata.ts

@@ -2,6 +2,7 @@ import { fg, type TextChunk } from "@opentui/core";
 import type { Theme } from "./theme";
 
 export type StatusMetadataValues = {
+  cwd?: string;
   branch: string | null;
   outgoingTokens: number;
   incomingTokens: number;
@@ -11,9 +12,9 @@ export type StatusMetadataValues = {
 };
 
 export type StatusMetadataItem = {
-  key: "branch" | "outgoing" | "incoming" | "cacheRead" | "cost" | "context";
+  key: "cwd" | "branch" | "outgoing" | "incoming" | "cacheRead" | "cost" | "context";
   text: string;
-  tone: "branch" | "dim" | "warn";
+  tone: "cwd" | "branch" | "dim" | "warn";
   priority: number;
 };
 
@@ -28,8 +29,20 @@ export const formatCost = (value: number): string =>
 
 export const statusTextWidth = (text: string): number => Bun.stringWidth(text);
 
+/** Show the launch directory without the long parent path. */
+export function formatWorkingDirectory(cwd: string): string {
+  const withoutTrailingSeparators = cwd.replace(/[\\/]+$/, "");
+  if (!withoutTrailingSeparators) return "/";
+  if (/^[A-Za-z]:$/.test(withoutTrailingSeparators)) return `${withoutTrailingSeparators}\\`;
+  const name = withoutTrailingSeparators.split(/[\\/]/).at(-1) || withoutTrailingSeparators;
+  return name;
+}
+
 export function statusMetadataItems(values: StatusMetadataValues): StatusMetadataItem[] {
   const items: StatusMetadataItem[] = [];
+  if (values.cwd) {
+    items.push({ key: "cwd", text: formatWorkingDirectory(values.cwd), tone: "cwd", priority: 85 });
+  }
   if (values.branch) {
     items.push({ key: "branch", text: values.branch, tone: "branch", priority: 90 });
   }
@@ -101,8 +114,10 @@ export function statusMetadataChunks(
   const chunks: TextChunk[] = [];
   for (const item of items) {
     if (chunks.length) chunks.push(fg(theme.dim)(" · "));
-    const color = item.tone === "branch"
-      ? theme.toolArg
+    const color = item.tone === "cwd"
+      ? theme.statusCwd
+      : item.tone === "branch"
+        ? theme.toolArg
       : item.tone === "warn"
         ? theme.warn
         : theme.dim;

package/src/theme.ts

@@ -9,6 +9,8 @@ export type Theme = {
   fg: string;
   dim: string;
   accent: string;
+  /** Foreground for the current working directory in the status bar. */
+  statusCwd: string;
   border: string;
   /** Foreground and background of a user turn's full-width bar. */
   user: string;
@@ -47,6 +49,7 @@ const tokyonight: Theme = {
   fg: "#c0caf5",
   dim: "#565f89",
   accent: "#7aa2f7",
+  statusCwd: "#2ac3de",
   border: "#292e42",
   user: "#c0caf5",
   userBg: "#283457",
@@ -79,6 +82,7 @@ const gruvbox: Theme = {
   fg: "#ebdbb2",
   dim: "#928374",
   accent: "#83a598",
+  statusCwd: "#8ec07c",
   border: "#3c3836",
   user: "#ebdbb2",
   userBg: "#3c3836",
@@ -111,6 +115,7 @@ const catppuccin: Theme = {
   fg: "#cdd6f4",
   dim: "#6c7086",
   accent: "#89b4fa",
+  statusCwd: "#94e2d5",
   border: "#313244",
   user: "#cdd6f4",
   userBg: "#313244",
@@ -143,6 +148,7 @@ const nord: Theme = {
   fg: "#d8dee9",
   dim: "#7b88a1",
   accent: "#88c0d0",
+  statusCwd: "#8fbcbb",
   border: "#3b4252",
   user: "#eceff4",
   userBg: "#434c5e",
@@ -175,6 +181,7 @@ const dracula: Theme = {
   fg: "#f8f8f2",
   dim: "#6272a4",
   accent: "#bd93f9",
+  statusCwd: "#8be9fd",
   border: "#44475a",
   user: "#f8f8f2",
   userBg: "#44475a",
@@ -207,6 +214,7 @@ const rosepine: Theme = {
   fg: "#e0def4",
   dim: "#6e6a86",
   accent: "#c4a7e7",
+  statusCwd: "#9ccfd8",
   border: "#26233a",
   user: "#e0def4",
   userBg: "#26233a",
@@ -239,6 +247,7 @@ const solarized: Theme = {
   fg: "#839496",
   dim: "#586e75",
   accent: "#268bd2",
+  statusCwd: "#2aa198",
   border: "#073642",
   user: "#93a1a1",
   userBg: "#073642",
@@ -271,6 +280,7 @@ const kanagawa: Theme = {
   fg: "#dcd7ba",
   dim: "#727169",
   accent: "#7e9cd8",
+  statusCwd: "#7fb4ca",
   border: "#2a2a37",
   user: "#dcd7ba",
   userBg: "#2d4f67",
@@ -303,6 +313,7 @@ const githubLight: Theme = {
   fg: "#24292f",
   dim: "#6e7781",
   accent: "#0969da",
+  statusCwd: "#0a3069",
   border: "#d0d7de",
   user: "#24292f",
   userBg: "#ddf4ff",