pum-agent 0.2.9-beta.1 → 0.2.11-beta.1

package/README.md

@@ -23,7 +23,7 @@ pum
 PUM opens the login panel automatically on the first start.
 
 > [!WARNING]
-> PUM can read, write, and delete files. Check mode adds deterministic policy checks and can enforce native Bash isolation on supported Linux and Windows hosts. Other tools, extensions, and external triggers still run in the PUM process boundary described below. Review the safeguards and prerequisites before using untrusted workspaces.
+> PUM can read, write, and delete files. Check mode adds deterministic policy checks, and supported hosts can enforce native Bash isolation. The file-tool sandbox is a process-local path guard, not complete operating-system isolation. Review the safeguards before using untrusted workspaces.
 
 ## See PUM in action
 
@@ -46,7 +46,8 @@ The following screens are real OpenTUI renders captured through `tmux`. A local
 - **Prompt control:** Steer active work, answer model questionnaires, use an ownership-aware message cache, attach clipboard images, and resume sessions with metadata-rich history.
 - **External triggers:** Supervise background commands such as `gh run watch` and automatically wake the exact target agent when they exit.
 - **Provider choice:** Search the providers exposed by pi, or add an OpenAI-compatible custom endpoint.
-- **Optional safeguards:** Use strict, balanced, or ask Check mode, plus native Bash sandboxing through Bubblewrap or Windows CreateProcessInSandbox when available.
+- **Filesystem boundary:** `read`, `write`, and `edit` stay inside the project and configured allowed roots. `apply_patch` stays project-local.
+- **Optional safeguards:** Turn on Check mode to gate `bash`, `edit`, `apply_patch`, and external-trigger process proposals. Supported hosts can also use native Bash sandboxing through Bubblewrap or Windows CreateProcessInSandbox.
 - **Terminal-first appearance:** Nine themes, semantic color overrides, Unicode glyphs, and optional animation.
 
 PUM uses [pi](https://github.com/earendil-works/pi) for the agent loop and [OpenTUI](https://github.com/anomalyco/opentui) for rendering.
@@ -141,6 +142,7 @@ Set `PUM_DIR` to override PUM's complete configuration and data directory. Run `
 | `Shift+Tab` / `Ctrl+Shift+Tab` | Cycle through agent transcripts |
 | `Ctrl+H` | Open session history when the terminal reports the key distinctly |
 | `Ctrl+N` | Open recent answers (News) |
+| `n` / `p` in News | Jump to the answer / user prompt |
 | `Ctrl+End` | Scroll to the end of the selected transcript |
 | `Ctrl+P` | Open settings |
 | `Ctrl+T` | Open supervised external triggers |
@@ -177,6 +179,8 @@ PUM limits remote OSC 52 payloads to 100,000 Base64 characters. This limit preve
 Open the News popup with `Ctrl+N` or `/news`. It lists the final answers of user-initiated turns, newest first. Each entry shows the user prompt and any follow-up steers that produced the answer, above the answer itself.
 
 - `←` / `→` — move between answers
+- `n` — jump to the answer
+- `p` — jump to the user prompt
 - `Space` — toggle an answer between read and unread
 - `c` — copy the current answer to the clipboard
 - `Enter` — reply to the current answer with a quoted draft
@@ -199,6 +203,8 @@ Use `Ctrl+L` to select an agent transcript. Input then goes to that agent. Finis
 
 The public `spawn_subagent` tool accepts `preview: true`. PUM then shows the exact child task before it creates any worktree or session. Press `Enter` to approve. An optional note becomes a separate visible user instruction to the new child. Press `Esc` to cancel without creating a child. Cancellation discards the preview note because no child exists. PUM preserves the existing parent transcript draft.
 
+When the Sandbox setting is `Auto` or `Require`, `spawn_subagent` also accepts `readonly: true`. A readonly child can inspect files and run sandboxed inspection commands. PUM omits `write`, `edit`, `apply_patch`, child spawning, inter-agent delegation, process-starting trigger tools, and message-cache mutation tools from that child. The remaining tool guard blocks unknown or mutation-capable child paths. Worktree access is limited to `list` and `status`. Bash requires an enforced native sandbox, receives read-only project, `/check-path`, and managed Git metadata roots, and receives no network access. If native enforcement is unavailable, readonly Bash blocks instead of using the `Auto` direct fallback. PUM persists readonly state across resume. Sandbox `Off` removes the argument from live spawn tool schemas and rejects any explicit readonly spawn request.
+
 Press `↑` on an empty single-line prompt to recall the newest queued user-authored message for the selected transcript. PUM removes the message from the authoritative queue before restoring its text. PUM does not recall inter-agent, trigger, lifecycle, cache, delivered, or image-bearing messages.
 
 Idle notices report settled work cycles to the direct spawner. They are not completion notices. PUM acknowledges completion delivery only after the notice enters the parent session. Persisted completion intent and stable message identifiers let interrupted delivery resume without duplicate completion messages.
@@ -231,23 +237,35 @@ Trigger events target one exact main or retained child session. A missing sessio
 
 `apply_patch` supports add, update, delete, move, multiple files, and multiple hunks. PUM validates the full patch before changing files. It rejects traversal, absolute paths, escaping symlinks, path conflicts, and ambiguous context. A failed commit restores all touched files.
 
+### Filesystem sandbox
+
+The process-local filesystem sandbox validates `read`, `write`, `edit`, and `apply_patch` before execution.
+
+- Project paths and `/check-path` roots are allowed.
+- Credential-sensitive paths are blocked.
+- Symbolic links and junctions in tool paths are blocked.
+- `apply_patch` remains project-local and keeps its atomic validation.
+
+This boundary does not isolate `bash`, package scripts, extensions, or trigger processes from the operating system. Use a container, VM, or policy-controlled sandbox for stronger isolation.
+
 ### Check mode
 
-Select a Check mode profile in `Ctrl+P`. It applies to `bash`, `edit`, `apply_patch`, and external-trigger process execution:
+Select Check mode in `Ctrl+P` — either **Off** or **On**. It applies to `bash`, `edit`, `apply_patch`, and external-trigger process execution:
+
+- **Off:** Checked tools run without the deterministic policy or the advisory verifier.
+- **On:** The deterministic policy runs first, then an advisory verifier reviews the complete proposal.
 
-- **Strict:** Run deterministic hard rules, then require a clear verifier approval.
-- **Balanced:** Block deterministic hard-rule or suspicious findings. Allow ordinary complete project-local calls, explicit non-sensitive external reads, and narrow lifecycle-disabled npm release verification operations whose writes stay in approved roots. Verifier review is non-blocking unless the verifier returns explicit `UNSAFE`.
-- **Ask:** Show the approval popup for every checked call that passes hard rules, unless an exact session or project approval already matches. A verifier `SAFE`, unclear, error, or unavailable result still requires approval.
+On allows ordinary complete project-local calls, explicit on-mode external reads (read-only), and project-local edits. It accepts one direct `npm pack` only when lifecycle scripts are disabled, an explicit cache stays in an approved root, output stays in an approved root, and any package operand is one exact registry version. On also accepts one direct `npm install` of one exact registry version only when `--ignore-scripts`, an approved `--prefix`, and an approved `--cache` are explicit. File, Git, URL, tag, range, composed, general install, and global-install forms remain blocked. On hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links or junctions, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. These hard blocks cannot be overridden and never open a popup.
 
-Every active profile hard-blocks external writes, location changes, execution operands, ambiguous path access, escaping links, credential access, privilege escalation, persistence, remote-script execution, destructive Git operations, and broad deletion. Balanced permits explicit, deterministically classified, non-sensitive external reads. It accepts one direct `npm pack` only when lifecycle scripts are disabled, an explicit cache stays in an approved root, output stays in an approved root, and any package operand is one exact registry version. Balanced also accepts one direct `npm install` of one exact registry version only when `--ignore-scripts`, an approved `--prefix`, and an approved `--cache` are explicit. File, Git, URL, tag, range, composed, general install, and global-install forms remain blocked. These hard blocks cannot be overridden and do not open the popup. An explicit verifier `UNSAFE` verdict also blocks without a popup. The only publication exception is a deterministic match for direct main-agent `npm publish` or `npm dist-tag add`. The verifier category does not control this exception. The exception still requires explicit popup approval. Managed subagents cannot use it.
+On blocks an explicit verifier verdict of `UNSAFE`. An unclear, unavailable, failed, or timed-out review does not block a fully validated call. The only exception outside the verifier verdict is a deterministic match for a direct main-agent `npm publish` or `npm dist-tag add ... latest`, which On allows outright. The verifier category does not control this exception. Managed subagents cannot use it.
 
-Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. Bash, edit, and external-trigger checks can use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
+There is no approval popup and no approval store. Check mode is off by default.
 
-For `edit` and `apply_patch`, PUM validates the complete proposed change before any mutation. Review data includes the unified diff, changed paths, line counts, sensitivity flags, project containment, and full-content SHA-256. Invalid, stale, malformed, escaping, or incompletely analyzed input blocks the call. Patch length alone does not block a valid Balanced call.
+Use `/check-path list`, `/check-path add <directory>`, `/check-path remove <directory>`, or `/check-path clear` to manage up to 16 additional directory roots for the current launch project. The filesystem sandbox applies these roots to `read`, `write`, and `edit`. Bash, edit, and external-trigger checks also use these roots; `apply_patch` remains project-local. Added roots are canonicalized and remain subject to credential, traversal, symlink or junction, broad-deletion, and other hard blocks.
 
-Ask mode can allow an exact call once, for the current session, or for the current project. Approvals match the authoritative main or child identity, tool, verifier model, project, and canonical complete input. Chat text is not approval. Use **Clear approvals** in Settings to remove project approvals.
+For `edit` and `apply_patch`, PUM validates the complete proposed change before any mutation. Review data includes the unified diff, changed paths, line counts, sensitivity flags, project containment, and full-content SHA-256. Invalid, stale, malformed, escaping, or incompletely analyzed input blocks the call. Patch length alone does not block a complete validated on-mode call.
 
-The verifier uses a structured decision schema. One unclear response can receive one adjudication under the shared 15-second watchdog. Strict blocks malformed replies, errors, aborts, and timeouts. Balanced allows a fully validated call after an unclear, unavailable, failed, or timed-out review. Balanced still blocks explicit verifier `UNSAFE`, aborts, deterministic suspicious findings, malformed structures, and incomplete analysis. Ask requires the popup after hard rules for verifier `SAFE`, unclear, error, and unavailable results. Check mode is off by default.
+The verifier uses a structured decision schema. One unclear response can receive one bounded adjudication under the shared 15-second watchdog. On blocks aborts, malformed verifier replies, and incomplete analysis, and it blocks any explicit `UNSAFE` verdict. Check mode is off by default.
 
 #### Native Bash sandbox
 
@@ -259,7 +277,7 @@ The **Sandbox** setting has three modes:
 
 Check mode **Off** always uses pi's normal unsandboxed Bash backend. For an active Check mode, PUM recomputes the sandbox policy from the exact approved command, authoritative working directory, configured additional roots, and deterministic access analysis. Model input cannot supply policy fields.
 
-The project and configured additional roots are writable. Explicit Balanced external reads are mounted read-only. PUM configuration and common credential paths are denied, and credential-shaped or process-injection environment variables are removed. A private temporary directory is supplied for the command. Safe pi metadata such as `PI_PROVIDER`, `PI_MODEL`, and `PI_REASONING_LEVEL` remains available; session paths and identifiers are withheld.
+The project and configured additional roots are writable. Explicit on-mode external reads are mounted read-only. PUM configuration and common credential paths are denied, and credential-shaped or process-injection environment variables are removed. A private temporary directory is supplied for the command. Safe pi metadata such as `PI_PROVIDER`, `PI_MODEL`, and `PI_REASONING_LEVEL` remains available; session paths and identifiers are withheld.
 
 Network access is denied unless deterministic analysis recognizes an approved network operation. Bubblewrap's host-network mode is all-or-nothing and is **not domain-filtered**. Windows similarly grants or withholds the SDK's broad network capabilities; it does not provide hostname allowlists.
 
@@ -267,7 +285,9 @@ The override uses pi's `createBashTool` implementation and custom Bash operation
 
 External triggers preserve direct executable/argument boundaries and continue to use deterministic Check mode, but they are not routed through the native sandbox in this release. The trigger manager's synchronous spawn boundary does not carry the exact approved policy object into execution; silently recomputing a second process policy there would weaken approval identity. Trigger output, environment, limits, and process supervision remain unchanged.
 
-Verifier prompts stay bounded. For an oversized Balanced review, PUM sends complete validation metadata, counts, findings, and SHA-256 digests. PUM does not send a raw prefix or suffix as if it were complete. Strict and Ask keep their fail-closed oversized-input behavior.
+The filesystem sandbox is a process-local path guard for `read`, `write`, `edit`, and `apply_patch`. It does not replace native Bash isolation and does not cover scripts, extensions, or trigger processes.
+
+Verifier prompts stay bounded. For an oversized On-mode review, PUM sends complete validation metadata, counts, findings, and SHA-256 digests. PUM does not send a raw prefix or suffix as if it were complete.
 
 ### Hosted web search
 
@@ -309,8 +329,6 @@ Set `PUM_DIR` to override the complete PUM data directory.
 | `prompt-stash.json` | Stashed prompts by working directory |
 | `sessions/` | Main conversation sessions |
 | `subagents/` | Persistent subagent sessions |
-| `check-mode-cache.json` | Accepted checks for eligible read-only Git commands |
-| `check-mode-approvals.json` | Exact project approvals created in Ask mode |
 
 PUM preserves all stashed prompt occurrences. PUM also keeps the 100 most recent additional sent-history occurrences for each working directory.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.9-beta.1",
+  "version": "0.2.11-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",

package/src/agent-selector.tsx

@@ -17,6 +17,7 @@ export type AgentTreeRow = {
   id: string | null;
   name: string;
   status?: SubagentSnapshot["status"];
+  readonly?: boolean;
   depth: number;
   metadata?: StatusMetadataValues;
 };
@@ -36,7 +37,9 @@ export function agentSelectorRowLayout(
   const indent = Math.min(2 + row.depth * 2, Math.max(2, popupColumns - 12));
   // One column remains clear for the pinned scrollbar.
   const contentColumns = Math.max(1, popupColumns - indent - 1);
-  const label = row.status ? `${row.name} · ${row.status}` : row.name;
+  const label = row.status
+    ? `${row.name}${row.readonly ? " · readonly" : ""} · ${row.status}`
+    : row.name;
   const minimumLabelWidth = Math.min(
     label.length,
     Math.max(8, Math.ceil(contentColumns * 0.45)),
@@ -73,6 +76,7 @@ export function buildAgentTree(agents: readonly SubagentSnapshot[]): AgentTreeRo
         id: agent.id,
         name: agent.name,
         status: agent.status,
+        readonly: agent.readonly === true,
         depth,
         metadata: {
           branch: agent.worktree.branch ?? null,
@@ -95,6 +99,7 @@ export function buildAgentTree(agents: readonly SubagentSnapshot[]): AgentTreeRo
       id: agent.id,
       name: agent.name,
       status: agent.status,
+      readonly: agent.readonly === true,
       depth: 1,
       metadata: {
         branch: agent.worktree.branch ?? null,

package/src/app.tsx

@@ -9,7 +9,7 @@ import { randomUUID } from "node:crypto";
 import { useKeyboard, usePaste, useRenderer, useTerminalDimensions } from "@opentui/react";
 import { getSupportedThinkingLevels, type Model } from "@earendil-works/pi-ai";
 import type { AgentSession, ModelRuntime } from "@earendil-works/pi-coding-agent";
-import { Fragment, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
+import { useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
 import { AnimationProvider, supportsTrueColor, useWorkingRule, type WorkingRuleRole } from "./animation";
 import {
   filterModels,
@@ -115,16 +115,6 @@ import { LoginController } from "./login-controller";
 import { providerLoginMethods, refreshAndSelectModel } from "./login-flow";
 import { questionnaireDetail, QuestionnaireManager } from "./questionnaire";
 import { QuestionnairePopup } from "./questionnaire-popup";
-import {
-  CheckApprovalPopup,
-  invokeCheckApprovalDecision,
-  type CheckApprovalDecision,
-} from "./check-approval-popup";
-import type {
-  CheckApprovalCoordinator,
-  CheckApprovalRequest,
-  CheckApprovalStore,
-} from "./check-approvals";
 import {
   moveTriggerSelection,
   sortTriggers,
@@ -162,6 +152,26 @@ const NAV_KEYS = new Set(["up", "down", "left", "right", "home", "end", "pageup"
  * than a bit mask: Shift=1, Alt=2, Ctrl=4.
  */
 const MODIFIED_ENTER_SEQUENCE = /^\x1b\[(?:13;(\d+)u|27;(\d+);13~)$/;
+const KITTY_PRINTABLE_SEQUENCE = /^\x1b\[(\d+)(?:;\d+(?::\d+)?)?u$/;
+const MODIFY_OTHER_KEYS_PRINTABLE_SEQUENCE = /^\x1b\[27;\d+;(\d+)~$/;
+
+function printableKeyCharacter(
+  name: string | undefined,
+  sequence: string,
+  raw = sequence,
+): string | undefined {
+  if (name?.length === 1) return name.toLowerCase();
+  for (const candidate of [sequence, raw]) {
+    if (candidate.length === 1) return candidate.toLowerCase();
+    const kitty = KITTY_PRINTABLE_SEQUENCE.exec(candidate);
+    const modifyOtherKeys = MODIFY_OTHER_KEYS_PRINTABLE_SEQUENCE.exec(candidate);
+    const codePoint = Number(kitty?.[1] ?? modifyOtherKeys?.[1]);
+    if (!Number.isInteger(codePoint) || codePoint < 0x20 || codePoint > 0x10FFFF) continue;
+    if (codePoint >= 0xD800 && codePoint <= 0xDFFF) continue;
+    return String.fromCodePoint(codePoint).toLowerCase();
+  }
+  return undefined;
+}
 
 function modifiedEnterFromSequence(sequence: string) {
   const match = MODIFIED_ENTER_SEQUENCE.exec(sequence);
@@ -391,8 +401,6 @@ export function App({
   stagePastedText = stagePastedTextDefault,
   copyNewsAnswerText = copyTextToClipboard,
   onExit = () => process.exit(0),
-  checkApprovalCoordinator,
-  checkApprovalStore,
   triggerManager,
   messageCacheController,
   terminalTitle,
@@ -421,8 +429,6 @@ export function App({
   /** Copies the selected news answer for the popup. */
   copyNewsAnswerText?: typeof copyTextToClipboard;
   onExit?: () => void | Promise<void>;
-  checkApprovalCoordinator?: CheckApprovalCoordinator;
-  checkApprovalStore?: CheckApprovalStore;
   triggerManager?: TriggerManagerLike;
   messageCacheController?: MessageCacheController;
   terminalTitle?: TerminalTitleController;
@@ -476,6 +482,10 @@ export function App({
   const [settingsSearchFocused, setSettingsSearchFocused] = useState(true);
   const [selectedSettingId, setSelectedSettingId] = useState<SettingRowId | null>(SETTINGS_ROWS[0]!.id);
   const [settings, setSettings] = useState(initial);
+  // Mirrors settings for update(): a keypress or an async .then can fire a
+  // second update before React commits the first, so update() must build the
+  // next value from the latest pending settings, not the render closure.
+  const settingsRef = useRef(settings);
   const [thinkingLevel, setThinkingLevel] = useState<ThinkingLevel>(
     session.agent.state.thinkingLevel as ThinkingLevel,
   );
@@ -509,8 +519,6 @@ export function App({
   }));
   const [modelQuery, setModelQuery] = useState("");
   const [modelSearchFocused, setModelSearchFocused] = useState(false);
-  const [checkApproval, setCheckApproval] = useState<CheckApprovalRequest | null>(null);
-  const [checkApprovalDecision, setCheckApprovalDecision] = useState<CheckApprovalDecision>("allowOnce");
   const [, setAgentRevision] = useState(0);
   const [triggersOpen, setTriggersOpen] = useState(false);
   const [triggerCursor, setTriggerCursor] = useState(0);
@@ -735,6 +743,13 @@ export function App({
     else if (editingIndex !== null && editingIndex > index) {
       editingStashIndex.current = editingIndex - 1;
     }
+    // The stash is shared across agent views, so a delete shifts the indices
+    // that every other view checked out. Reindex the saved per-view values too,
+    // or a later submit in another view would overwrite the wrong cached row.
+    for (const [key, value] of viewEditingStashIndices.current) {
+      if (value === index) viewEditingStashIndices.current.set(key, null);
+      else if (value !== null && value > index) viewEditingStashIndices.current.set(key, value - 1);
+    }
 
     if (next.length === 0) setStashMode(false);
     else setSelectedStash(Math.min(index, next.length - 1));
@@ -951,6 +966,7 @@ export function App({
       agentSelectorOpen ||
       helpOpen ||
       historyOpen ||
+      newsOpenRef.current ||
       settingsOpenRef.current
     ) return;
     const input = inputRef.current;
@@ -1006,10 +1022,6 @@ export function App({
     append({ kind: "text", role: "system", text: warning });
   }), [sandboxWarningSource]);
 
-  useEffect(() => checkApprovalCoordinator?.subscribe((request) => {
-    setCheckApproval(request);
-    setCheckApprovalDecision("allowOnce");
-  }), [checkApprovalCoordinator]);
 
   useEffect(() => triggerManager?.subscribe(() => {
     setTriggerRevision((revision) => revision + 1);
@@ -1326,7 +1338,8 @@ export function App({
   }, [activeAgent?.id, activeAgent?.status, activeAgent?.runStartedAt, visibleBusy]);
 
   const update = (patch: Partial<PumSettings>) => {
-    const next = { ...settings, ...patch };
+    const next = { ...settingsRef.current, ...patch };
+    settingsRef.current = next;
     setSettings(next);
     if (patch.webSearch !== undefined) webSearch.enabled = patch.webSearch;
     if (patch.writingStyle !== undefined) setWritingStyle(patch.writingStyle);
@@ -1490,6 +1503,44 @@ export function App({
     setNewsCursor(next);
   };
 
+  const jumpFromNews = (target: "answer" | "prompt") => {
+    const item = newsRef.current[newsCursorRef.current];
+    if (!item) return;
+    const lines = txRef.current.lines;
+    const answerIndex = lines.findIndex((line) =>
+      line.kind === "text" && line.role === "assistant" && line.newsId === item.id,
+    );
+    let targetIndex = answerIndex;
+    if (target === "prompt") {
+      const promptText = item.prompts?.find((prompt) => !prompt.steer)?.text
+        ?? item.prompts?.[0]?.text;
+      targetIndex = -1;
+      if (promptText) {
+        const end = answerIndex >= 0 ? answerIndex : lines.length;
+        for (let index = end - 1; index >= 0; index--) {
+          const line = lines[index];
+          if (line?.kind === "text" && line.role === "user" && line.text === promptText) {
+            targetIndex = index;
+            break;
+          }
+        }
+      }
+    }
+    if (targetIndex < 0) return;
+
+    if (activeAgentIdRef.current !== null && !selectAgentView(null)) return;
+    newsOpenRef.current = false;
+    setNewsOpen(false);
+    const scrollToTarget = () => {
+      const transcript = transcriptScrollRef.current;
+      if (!transcript) return;
+      transcript.scrollTop = 0;
+      transcript.scrollChildIntoView(`transcript-line-${targetIndex}`);
+    };
+    queueMicrotask(scrollToTarget);
+    setTimeout(scrollToTarget, 30);
+  };
+
   const toggleCurrentNewsRead = () => {
     const item = newsRef.current[newsCursorRef.current];
     if (!item) return;
@@ -1598,7 +1649,12 @@ export function App({
     const restore = queued.length ? queued[queued.length - 1]! : inFlight.current;
     if (inputRef.current && !inputRef.current.plainText) setEditorText(restore);
     histCursor.current = null;
-    session.abort().finally(() => setWorking(false));
+    // clearQueue may have dropped a subagent completion notice queued to the
+    // streaming main agent; re-arm undelivered notices so a merge is not stuck.
+    session.abort().finally(() => {
+      setWorking(false);
+      void subagentManager.resendUndeliveredMainSettlements();
+    });
   };
 
   const recallQueuedUserMessage = async (target: string | null) => {
@@ -1606,7 +1662,12 @@ export function App({
       ? await subagentManager.recallQueuedUserMessage(target)
       : await recallNewestQueuedUserMessage(session, tx.pending);
     if (!recalled) return;
-    if (!target) dropPending(recalled.id);
+    // Recalling from the main queue clears it, which can drop a queued subagent
+    // completion notice; re-arm undelivered notices so a merge is not stuck.
+    if (!target) {
+      dropPending(recalled.id);
+      void subagentManager.resendUndeliveredMainSettlements();
+    }
     const key = target ?? "main";
     viewDrafts.current.set(key, recalled.text);
     if (activeAgentIdRef.current === target) {
@@ -1798,6 +1859,11 @@ export function App({
   };
 
   const submitPrompt = (value?: string, stashIndex?: number) => {
+    // Read the selected agent from the ref, not the state. A view switch updates
+    // the ref synchronously, but a switch-then-send in one input chunk runs
+    // before React commits the new state, so the state would still name the
+    // previous agent and deliver the prompt to the wrong session.
+    const selectedAgentId = activeAgentIdRef.current;
     const displayText = value ?? inputRef.current?.plainText ?? "";
     const attachments = value === undefined ? [...pendingImages.current] : [];
     const pastedTexts = value === undefined ? [...pendingPastedTexts.current] : [];
@@ -1826,7 +1892,7 @@ export function App({
     // The temp files must survive until the turn that reads them settles, so
     // move them out of the draft tracking before the editor is cleared below.
     if (value === undefined && pastedTexts.length > 0) {
-      const targetKey = activeAgentId ?? "main";
+      const targetKey = selectedAgentId ?? "main";
       const existing = postTurnPastedTexts.current.get(targetKey) ?? [];
       postTurnPastedTexts.current.set(targetKey, [...existing, ...pastedTexts]);
       pendingPastedTexts.current = [];
@@ -1841,9 +1907,9 @@ export function App({
       return;
     }
 
-    if (activeAgentId) {
+    if (selectedAgentId) {
       void subagentManager
-        .sendUserMessage(activeAgentId, promptText, images, displayText.trim())
+        .sendUserMessage(selectedAgentId, promptText, images, displayText.trim())
         .catch((error) => append({ kind: "text", role: "error", text: String(error) }));
       return;
     }
@@ -1950,18 +2016,6 @@ export function App({
     }));
   };
 
-  const resolveCheckApproval = (decision: CheckApprovalDecision) => {
-    if (!checkApproval || !checkApprovalCoordinator) return;
-    const choice = decision === "allowOnce"
-      ? "allow-once"
-      : decision === "allowSession"
-        ? "allow-session"
-        : decision === "allowProject"
-          ? "allow-project"
-          : "deny";
-    checkApprovalCoordinator.resolve(checkApproval.id, choice);
-  };
-
   const stepCheckMode = (step: number) => {
     const index = CHECK_MODE_PROFILES.indexOf(settings.checkMode);
     update({ checkMode: CHECK_MODE_PROFILES[(index + step + CHECK_MODE_PROFILES.length) % CHECK_MODE_PROFILES.length]! });
@@ -1994,12 +2048,6 @@ export function App({
       role: "system",
       text: "use /check-path [list|add <directory>|remove <directory>|clear]",
     }) },
-    clearCheckApprovals: { enter: () => {
-      const removed = checkApprovalStore?.clearProject(cwd) ?? 0;
-      append({ kind: "text", role: "system", text: removed > 0
-        ? `cleared ${removed} Check mode project approval${removed === 1 ? "" : "s"}`
-        : "no Check mode project approvals were stored" });
-    } },
     thinkingLevel: { step: stepThinking },
     showThinking: { step: () => update({ showThinking: !settings.showThinking }) },
     maxActiveSubagents: { step: (step) => update({
@@ -2033,7 +2081,6 @@ export function App({
     sandboxMode: `‹ ${settings.sandboxMode ?? "auto"} ›`,
     checkModel: `${settings.checkModel} ›`,
     checkPaths: `${checkPathsForProject(settings, cwd).length} additional · /check-path ›`,
-    clearCheckApprovals: "clear ›",
     thinkingLevel: `‹ ${thinkingLevel} ›`,
     showThinking: `‹ ${settings.showThinking ? "on" : "off"} ›`,
     maxActiveSubagents: `‹ ${settings.maxActiveSubagents} ›`,
@@ -2127,40 +2174,19 @@ export function App({
   });
 
   useKeyboard((key) => {
-    if (checkApproval) {
-      key.stopPropagation();
-      if (key.name === "escape" || (key.ctrl && key.name === "c")) {
-        resolveCheckApproval("deny");
-        return;
-      }
-      const decisions: CheckApprovalDecision[] = ["allowOnce", "allowSession", "allowProject", "deny"];
-      const index = decisions.indexOf(checkApprovalDecision);
-      if (["left", "up"].includes(key.name)) {
-        setCheckApprovalDecision(decisions[(index - 1 + decisions.length) % decisions.length]!);
-      } else if (["right", "down", "tab"].includes(key.name)) {
-        setCheckApprovalDecision(decisions[(index + 1) % decisions.length]!);
-      } else if (["return", "enter", "kpenter", "linefeed"].includes(key.name)) {
-        invokeCheckApprovalDecision(checkApprovalDecision, {
-          onAllowOnce: () => resolveCheckApproval("allowOnce"),
-          onAllowSession: () => resolveCheckApproval("allowSession"),
-          onAllowProject: () => resolveCheckApproval("allowProject"),
-          onDeny: () => resolveCheckApproval("deny"),
-        });
-      }
-      return;
-    }
-
     if (spawnPreview) {
       const isPreviewReturn = ["return", "enter", "kpenter", "linefeed"].includes(key.name);
       if (key.name === "escape" || (key.ctrl && key.name === "c")) {
         key.stopPropagation();
         spawnPreviewInputRef.current?.setText("");
-        spawnPreviewManager?.cancel();
+        // Bind the action to the request the popup rendered; if the active
+        // request changed under it, this is a no-op instead of hitting another.
+        spawnPreviewManager?.cancel("cancelled", spawnPreview.id);
       } else if (isPreviewReturn && !key.shift && !key.ctrl && !key.meta && !key.option) {
         key.stopPropagation();
         const note = spawnPreviewInputRef.current?.plainText ?? "";
         spawnPreviewInputRef.current?.setText("");
-        spawnPreviewManager?.approve(note);
+        spawnPreviewManager?.approve(note, spawnPreview.id);
       }
       return;
     }
@@ -2355,19 +2381,22 @@ export function App({
       return;
     }
 
-    if (key.ctrl && key.name === "n") {
+    const printableKey = printableKeyCharacter(key.name, key.sequence, key.raw);
+    if (key.ctrl && printableKey === "n") {
       key.stopPropagation();
       if (newsOpenRef.current) closeNews();
       else openNews();
       return;
     }
-    if (newsOpenRef.current) {
+    if (newsOpenRef.current || newsOpen) {
       key.stopPropagation();
       if (key.name === "escape") closeNews();
       else if (key.name === "left") moveNewsCursor(1);
       else if (key.name === "right") moveNewsCursor(-1);
       else if (key.name === "space" || key.sequence === " ") toggleCurrentNewsRead();
-      else if (key.name === "c" || key.sequence === "c") void copyNewsAnswer();
+      else if (printableKey === "n") jumpFromNews("answer");
+      else if (printableKey === "p") jumpFromNews("prompt");
+      else if (printableKey === "c") void copyNewsAnswer();
       else if (key.name === "return" || key.name === "enter" || key.name === "kpenter")
         replyToCurrentNews();
       return;
@@ -2700,10 +2729,13 @@ export function App({
       } else if ((activeAgentId && visibleBusy) || (!activeAgentId && busyRef.current)) {
         key.stopPropagation();
         const now = Date.now();
-        const target = activeAgentId ?? "main";
+        // Cancel the agent named by the ref, not the state: a switch-then-Esc in
+        // one input chunk must abort the newly selected agent, not the previous.
+        const selected = activeAgentIdRef.current;
+        const target = selected ?? "main";
         if (confirmsCancellation(lastCancelPress.current, cancelTarget.current, target, now)) {
           resetCancelArm();
-          if (activeAgentId) void subagentManager.abortAgent(activeAgentId);
+          if (selected) void subagentManager.abortAgent(selected);
           else cancel();
         } else {
           lastCancelPress.current = now;
@@ -2812,10 +2844,14 @@ export function App({
                   ? `agent:${line.sender}:${line.recipient}:${i}:${line.text}`
                   : `text:${line.role}:${i}:${line.text}`;
             return (
-              <Fragment key={lineKey}>
+              <box
+                id={`transcript-line-${i}`}
+                key={lineKey}
+                style={{ flexDirection: "column", width: "100%", flexShrink: 0 }}
+              >
                 {gapBefore ? <Gap /> : null}
                 {row}
-              </Fragment>
+              </box>
             );
           })}
           {visibleTx.stream ? (
@@ -2925,7 +2961,7 @@ export function App({
             selectionBg={theme.selectionBg}
             wrapMode="word"
             scrollMargin={1}
-            focused={!settingsOpen && !helpOpen && !historyOpen && !agentSelectorOpen && !triggersOpen && !loginOpen && !questionnaire && !spawnPreview && !checkApproval}
+            focused={!settingsOpen && !helpOpen && !historyOpen && !agentSelectorOpen && !triggersOpen && !loginOpen && !questionnaire && !spawnPreview && !newsOpen}
             onContentChange={handleTextareaChange}
             onCursorChange={scheduleInputMetrics}
             onSubmit={() => submitPrompt()}
@@ -3015,32 +3051,6 @@ export function App({
             terminalHeight={height}
           />
         ) : null}
-        {checkApproval ? (
-          <CheckApprovalPopup
-            theme={theme}
-            request={{
-              tool: checkApproval.toolName,
-              summary: checkApproval.summary,
-              reason: checkApproval.reason,
-              paths: checkApproval.paths,
-              preview: { kind: checkApproval.toolName === "bash" ? "command" : "diff", text: checkApproval.preview },
-              agentLabel: checkApproval.target?.agentId
-                ? agents.find((agent) => agent.id === checkApproval.target?.agentId)?.name ?? "subagent"
-                : checkApproval.target?.sessionId
-                  ? "main"
-                  : checkApproval.cwd === cwd
-                    ? "main"
-                    : agents.find((agent) => agent.worktree.path === checkApproval.cwd)?.name ?? "subagent",
-            }}
-            selectedDecision={checkApprovalDecision}
-            terminalWidth={width}
-            terminalHeight={height}
-            onAllowOnce={() => resolveCheckApproval("allowOnce")}
-            onAllowSession={() => resolveCheckApproval("allowSession")}
-            onAllowProject={() => resolveCheckApproval("allowProject")}
-            onDeny={() => resolveCheckApproval("deny")}
-          />
-        ) : null}
         {settingsOpen ? (
           <SettingsPopup
             theme={theme}