pum-agent 0.2.6-beta.1 → 0.2.7-beta.1

package/README.md

@@ -223,10 +223,10 @@ Trigger events target one exact main or retained child session. A missing sessio
 Select a Check mode profile in `Ctrl+P`. It applies to `bash`, `edit`, `apply_patch`, and external-trigger process execution:
 
 - **Strict:** Run deterministic hard rules, then require a clear verifier approval.
-- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls, explicit non-sensitive external reads, and narrowly validated lifecycle-disabled `npm pack` operations whose cache and output stay in approved roots. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
+- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls, explicit non-sensitive external reads, and narrow lifecycle-disabled npm release verification operations whose writes stay in approved roots. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
 - **Ask:** Show the approval popup for every checked call that passes hard rules, unless an exact session or project approval already matches. A verifier `SAFE`, unclear, error, or unavailable result still requires approval.
 
-Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits explicit, deterministically classified, non-sensitive external reads. It also accepts one direct `npm pack` only when lifecycle scripts are disabled, an explicit cache stays in an approved root, output stays in an approved root, and any package operand is one exact registry version; file, Git, URL, tag, range, composed, and global-install forms remain blocked. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only publication exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use it.
+Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits explicit, deterministically classified, non-sensitive external reads. It accepts one direct `npm pack` only when lifecycle scripts are disabled, an explicit cache stays in an approved root, output stays in an approved root, and any package operand is one exact registry version. Balanced also accepts one direct `npm install` of one exact registry version only when `--ignore-scripts`, an approved `--prefix`, and an approved `--cache` are explicit. File, Git, URL, tag, range, composed, general install, and global-install forms remain blocked. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only publication exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use it.
 
 Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. Bash, edit, and external-trigger checks can use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.6-beta.1",
+  "version": "0.2.7-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/app.tsx

@@ -1,7 +1,7 @@
 import { decodePasteBytes, type ScrollBoxRenderable, type TextareaRenderable } from "@opentui/core";
 import { randomUUID } from "node:crypto";
 import { useKeyboard, usePaste, useTerminalDimensions } from "@opentui/react";
-import type { Model } from "@earendil-works/pi-ai";
+import { getSupportedThinkingLevels, type Model } from "@earendil-works/pi-ai";
 import type { AgentSession, ModelRuntime } from "@earendil-works/pi-coding-agent";
 import { Fragment, useEffect, useMemo, useRef, useState } from "react";
 import { AnimationProvider, supportsTrueColor, useWorkingRule, type WorkingRuleRole } from "./animation";
@@ -13,7 +13,6 @@ import {
   moveSettingSelection,
   SettingsPopup,
   SETTINGS_ROWS,
-  THINKING_LEVELS,
   type SettingRowId,
   type ThinkingLevel,
 } from "./settings-popup";
@@ -1095,8 +1094,9 @@ export function App({
   };
 
   const stepThinking = (step: number) => {
-    const i = THINKING_LEVELS.indexOf(thinkingLevel);
-    const target = THINKING_LEVELS[Math.max(0, Math.min(THINKING_LEVELS.length - 1, i + step))]!;
+    const levels = getSupportedThinkingLevels(session.agent.state.model);
+    const i = levels.indexOf(thinkingLevel);
+    const target = levels[Math.max(0, Math.min(levels.length - 1, i + step))]!;
     session.setThinkingLevel(target);
     // setThinkingLevel clamps to what the model supports — show the real value.
     setThinkingLevel(session.agent.state.thinkingLevel as ThinkingLevel);

package/src/check-policy.ts

@@ -17,6 +17,7 @@ export type CheckPolicyFindingCode =
   | "external-read-exfiltration"
   | "destructive-git"
   | "broad-deletion"
+  | "unsafe-npm-install"
   | "unsafe-npm-pack"
   | "suspicious-execution"
   | "shell-complexity"
@@ -219,6 +220,14 @@ type NpmPackCommand = {
   packDestination: string;
 };
 
+type NpmInstallCommand = {
+  valid: boolean;
+  reason?: string;
+  packageSpec?: string;
+  prefix?: string;
+  cache?: string;
+};
+
 function isExactRegistryPackageVersion(value: string): boolean {
   const packageName = String.raw`(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)`;
   const numericIdentifier = String.raw`(?:0|[1-9]\d*)`;
@@ -228,6 +237,65 @@ function isExactRegistryPackageVersion(value: string): boolean {
   return new RegExp(`^${packageName}@${version}$`).test(value);
 }
 
+function npmInstallCommand(argv: string[]): NpmInstallCommand | undefined {
+  if (commandName(argv[0]) !== "npm" || argv[1] !== "install") return undefined;
+  const positionals: string[] = [];
+  let prefix: string | undefined;
+  let cache: string | undefined;
+  let ignoreScriptsCount = 0;
+  const pathOptions = new Map([["--prefix", "prefix"], ["--cache", "cache"]] as const);
+
+  for (let index = 2; index < argv.length; index++) {
+    const value = argv[index]!;
+    if (value === "--ignore-scripts") {
+      ignoreScriptsCount++;
+      continue;
+    }
+    const separate = pathOptions.get(value as "--prefix" | "--cache");
+    if (separate) {
+      const path = argv[++index];
+      if (!path || path.startsWith("-")) return { valid: false, reason: `${value} requires one explicit path` };
+      if (separate === "prefix") {
+        if (prefix !== undefined) return { valid: false, reason: "npm install --prefix must occur exactly once" };
+        prefix = path;
+      } else {
+        if (cache !== undefined) return { valid: false, reason: "npm install --cache must occur exactly once" };
+        cache = path;
+      }
+      continue;
+    }
+    const attached = /^(--prefix|--cache)=(.*)$/.exec(value);
+    if (attached) {
+      if (!attached[2]) return { valid: false, reason: `${attached[1]} requires one explicit path` };
+      if (attached[1] === "--prefix") {
+        if (prefix !== undefined) return { valid: false, reason: "npm install --prefix must occur exactly once" };
+        prefix = attached[2];
+      } else {
+        if (cache !== undefined) return { valid: false, reason: "npm install --cache must occur exactly once" };
+        cache = attached[2];
+      }
+      continue;
+    }
+    if (value.startsWith("-")) {
+      return { valid: false, reason: `npm install option ${value} is not in the deterministic allowlist` };
+    }
+    positionals.push(value);
+  }
+
+  if (ignoreScriptsCount !== 1) {
+    return { valid: false, reason: "npm install must disable lifecycle scripts exactly once with --ignore-scripts" };
+  }
+  if (!prefix) return { valid: false, reason: "npm install must set an explicit approved --prefix path" };
+  if (!cache) return { valid: false, reason: "npm install must set an explicit approved --cache path" };
+  if ([prefix, cache].some((path) => /[*?\[\]{}]/.test(path))) {
+    return { valid: false, reason: "npm install write paths must not contain shell expansion patterns" };
+  }
+  if (positionals.length !== 1 || !isExactRegistryPackageVersion(positionals[0]!)) {
+    return { valid: false, reason: "npm install must use one exact registry package version" };
+  }
+  return { valid: true, packageSpec: positionals[0], prefix, cache };
+}
+
 function npmPackCommand(argv: string[]): NpmPackCommand | undefined {
   if (commandName(argv[0]) !== "npm" || argv[1] !== "pack") return undefined;
   const positionals: string[] = [];
@@ -294,6 +362,21 @@ function commandName(argv0: string | undefined): string {
   return basename.replace(/\.(?:exe|cmd|bat)$/i, "").toLowerCase();
 }
 
+function npmSubcommand(argv: string[]): string | undefined {
+  if (commandName(argv[0]) !== "npm") return undefined;
+  const valueOptions = new Set(["--cache", "--prefix", "--registry", "--userconfig"]);
+  for (let index = 1; index < argv.length; index++) {
+    const value = argv[index]!;
+    if (valueOptions.has(value)) {
+      index++;
+      continue;
+    }
+    if (value.startsWith("-")) continue;
+    return value.toLowerCase();
+  }
+  return undefined;
+}
+
 function effectiveArgv(argv: string[]): string[] {
   let current = argv;
   for (let depth = 0; depth < 4; depth++) {
@@ -431,6 +514,7 @@ function mutationIndicators(argv: string[], redirections: BashRedirection[]): st
   if (name === "git" && argv[1] && !new Set(["status", "diff", "log", "show", "rev-parse", "ls-files", "branch"]).has(argv[1])) {
     indicators.push("Git state change");
   }
+  if (npmInstallCommand(argv)?.valid) indicators.push("package installation or cache output");
   if (npmPackCommand(argv)?.valid) indicators.push("package archive or cache output");
   return [...new Set(indicators)];
 }
@@ -822,6 +906,12 @@ function classifyStageAccesses(stage: BashStage): ClassifiedAccess[] {
   }
 
   if (DATA_OPERAND_COMMANDS.has(name)) return accesses;
+  const npmInstall = npmInstallCommand(argv);
+  if (npmInstall?.valid) {
+    accesses.push({ path: npmInstall.prefix!, mode: "write", source: "operand" });
+    accesses.push({ path: npmInstall.cache!, mode: "write", source: "operand" });
+    return accesses;
+  }
   const npmPack = npmPackCommand(argv);
   if (npmPack?.valid) {
     accesses.push({ path: npmPack.cache!, mode: "write", source: "operand" });
@@ -1016,6 +1106,33 @@ function inspectHardBlocks(
     const argv = effectiveArgv(stage.argv);
     const name = commandName(argv[0]);
     const lowerArgs = argv.map((arg) => arg.toLowerCase());
+    const npmInstall = npmInstallCommand(argv);
+    if (npmInstall) {
+      const direct = commandName(stage.argv[0]) === "npm"
+        && analysis.stages.length === 1
+        && analysis.operators.length === 0
+        && stage.substitutions.length === 0
+        && stage.redirections.length === 0
+        && Object.keys(stage.envAssignments).length === 0;
+      if (!direct || !npmInstall.valid) {
+        addFinding(findings, {
+          code: "unsafe-npm-install",
+          severity: "hard-block",
+          message: !direct ? "npm install must be one direct command without shell composition" : npmInstall.reason!,
+          stage: stage.index,
+        });
+      }
+    } else if (name === "npm" && new Set([
+      "install", "i", "add", "ci", "install-ci-test", "install-test", "rebuild",
+      "update", "upgrade", "remove", "uninstall", "link",
+    ]).has(npmSubcommand(argv) ?? "")) {
+      addFinding(findings, {
+        code: "unsafe-npm-install",
+        severity: "hard-block",
+        message: "only the deterministic direct npm install verification form is supported",
+        stage: stage.index,
+      });
+    }
     const npmPack = npmPackCommand(argv);
     if (npmPack) {
       const direct = commandName(stage.argv[0]) === "npm"
@@ -1308,6 +1425,9 @@ function stageNetworkCommand(stage: BashStage): string | undefined {
   if (name === "npm" && subcommand === "pack") {
     return npmPackCommand(argv)?.packageSpec ? "npm pack" : undefined;
   }
+  if (name === "npm" && subcommand === "install") {
+    return npmInstallCommand(argv)?.valid ? "npm install" : undefined;
+  }
   if (["npm", "pnpm", "yarn"].includes(name)
     && new Set(["add", "audit", "install", "publish", "search", "update", "upgrade", "view", "info"]).has(subcommand)) {
     return `${name} ${subcommand}`;

package/src/status-metadata.ts

@@ -32,10 +32,10 @@ export const statusTextWidth = (text: string): number => Bun.stringWidth(text);
 /** Show the launch directory without the long parent path. */
 export function formatWorkingDirectory(cwd: string): string {
   const withoutTrailingSeparators = cwd.replace(/[\\/]+$/, "");
-  if (!withoutTrailingSeparators) return "cwd /";
-  if (/^[A-Za-z]:$/.test(withoutTrailingSeparators)) return `cwd ${withoutTrailingSeparators}\\`;
+  if (!withoutTrailingSeparators) return "/";
+  if (/^[A-Za-z]:$/.test(withoutTrailingSeparators)) return `${withoutTrailingSeparators}\\`;
   const name = withoutTrailingSeparators.split(/[\\/]/).at(-1) || withoutTrailingSeparators;
-  return `cwd ${name}`;
+  return name;
 }
 
 export function statusMetadataItems(values: StatusMetadataValues): StatusMetadataItem[] {