@tiens.nguyen/gonext-cli 1.0.350

package/README.md

@@ -0,0 +1,52 @@
+# @tiens.nguyen/gonext-cli
+Run:
+  GONEXT_API_BASE=... GONEXT_WORKER_KEY=... npx -y --package @tiens.nguyen/gonext-cli gonext-cli
+
+## Agent chat mode
+
+Select **Agent** (instead of Chat) under the composer in the web app. Your
+free-form prompt is handed to a [smolagents](https://github.com/huggingface/smolagents)
+agent running on your local MLX/Ollama model. The agent can call tools (v1:
+`http_request`) and streams its thinking steps + final answer directly into the
+chat thread.
+
+Requires smolagents in the worker's Python environment:
+
+```sh
+pip install smolagents certifi
+```
+
+- `certifi` supplies a trusted CA bundle so the agent's `http_request` tool can
+  verify HTTPS certificates on macOS (where Python's default bundle may be
+  missing). The worker falls back to the system bundle if certifi is absent.
+- Agent mode is blocked for cloud models (the API returns 400). Select a local
+  MLX or Ollama model first.
+- Tool steps appear in the collapsible reasoning (`<think>`) area; the final
+  answer is the message body — no new UI needed.
+
+The agent script is `gonext_agent_chat.py` (reads `{messages, agentBaseURL,
+agentApiKey, agentModelId, tools, maxSteps}` on stdin; emits NDJSON
+`{"type":"step"/"final","text":"..."}` lines on stdout).
+
+## API Check / HTTP probe (Tools & Agents modes)
+
+The worker can run Postman-style HTTP probes queued from the web app
+("Tools" = `tool_only`, "Agents" = `agentic`). The worker always performs the
+actual HTTP request itself (Node `fetch`, so TLS works), measures the
+status/latency/headers/body, and classifies it (2xx/3xx/4xx/5xx/timeout/
+network_error).
+
+- **Tools (`tool_only`)** — no extra setup. The selected local model writes a
+  one-line health summary of the measured result.
+- **Agents (`agentic`)** — a smolagents agent (running on the selected local
+  model) produces the summary. Requires `pip install smolagents`.
+
+  The agent talks to your local MLX OpenAI-compatible server (no cloud calls).
+  The agent only summarizes; the worker's measurement stays the source of truth,
+  so if smolagents or the model is unavailable the probe still returns the
+  measured result with a note.
+
+### Env vars
+
+  GONEXT_PROBE_PYTHON   Python executable for smolagents scripts
+                        (default: GONEXT_MLX_LM_PYTHON or python3)

package/coding-key-prompt.mjs

@@ -0,0 +1,47 @@
+// The startup Kimi-K3 (cloud coding model) API-key prompt (task #127). Extracted from the
+// REPL so it's importable + testable with a mock `ask`/`save` — the REPL bin runs main() on
+// import, so the logic can't live there and be tested directly.
+//
+// When the resolved agent CODE model is an OpenAI-compatible cloud coder with NO key stored,
+// the API payload carries codingKeyMissing (+ codingKeyModel/codingKeyUrl). Here we ask the
+// user for the key (masked, via the injected askSecret) and save it. If they skip, the state
+// stays "waiting" SERVER-SIDE (coder configured, no key), so this fires again on the next
+// `gonext` start until the key is set. Until then the agent falls back to the chat model for
+// coding (the coder is omitted from the job payload), so the terminal still works.
+
+const identity = (s) => s;
+
+/**
+ * @param payload  the /agent-payload `payload` object (reads codingKeyMissing/codingKeyModel).
+ * @param deps.askSecret  async (prompt) => string  — masked input; "" means the user skipped.
+ * @param deps.saveCodingKey  async (key) => boolean — persist the key (POST /coding-key).
+ * @param deps.log  (line) => void — printer.
+ * @param deps.colors  optional { dim, cyan, green, red } — identity in tests.
+ * @returns { asked, saved } — asked=false when there was no missing key.
+ */
+export async function promptCodingKeyIfMissing(payload, { askSecret, saveCodingKey, log, colors = {} }) {
+  const dim = colors.dim ?? identity;
+  const cyan = colors.cyan ?? identity;
+  const green = colors.green ?? identity;
+  const red = colors.red ?? identity;
+
+  if (!payload?.codingKeyMissing) return { asked: false, saved: false };
+
+  const model = String(payload.codingKeyModel || "the coding model").trim();
+  log(dim("\ngonext: your agent coding model (") + cyan(model) + dim(") needs an API key."));
+  log(dim("  Until it's set, coding falls back to your local model. Enter the key now,"));
+  log(dim("  or press Enter to skip (I'll ask again next time).\n"));
+
+  const key = await askSecret(`  ${model} API key: `);
+  if (!key) {
+    log(dim("  ⏳ waiting for your ") + cyan(model) + dim(" API key — I'll ask again next time.\n"));
+    return { asked: true, saved: false };
+  }
+  const ok = await saveCodingKey(key);
+  log(
+    ok
+      ? green(`  ✓ saved — ${model} is now your coding model.\n`)
+      : red("  couldn't save the key — try again next start, or set it in web Settings → Agent.\n")
+  );
+  return { asked: true, saved: ok };
+}

package/daemon-control.mjs

@@ -0,0 +1,232 @@
+// Worker-daemon lifecycle for the gonext CLI (task #127, Phase 2). Lets a plain terminal
+// keep the polling worker running WITHOUT the GoTerminal desktop app: `gonext-cli
+// start|stop|status|logs`, and `gonext` (the REPL) auto-ensures it on startup.
+//
+// BC4 (task #127): NEVER double-spawn. A second polling daemon would race the first for
+// jobs. We detect an already-running daemon two ways — our own pidfile AND a `ps` scan that
+// also catches a daemon started by GoTerminal or by hand (which never wrote our pidfile) —
+// and refuse to start when either says one is alive.
+import { spawn, execFile } from "node:child_process";
+import { readFile, writeFile, unlink, mkdir, open, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const DIR = join(homedir(), ".gonext");
+export const PID_FILE = join(DIR, "worker.pid");
+export const LOG_FILE = join(DIR, "worker.log");
+const LOCK_FILE = join(DIR, "worker.start.lock");
+const LOCK_STALE_MS = 30_000; // a lock older than this is from a crashed start → steal it
+const DAEMON_SCRIPT = fileURLToPath(new URL("./gonext-cli.mjs", import.meta.url));
+// The daemon script was named gonext-local-worker.mjs before the CLI was renamed to
+// gonext-cli. Match BOTH so BC4 (never double-spawn) still detects a daemon started by an
+// OLDER install across the upgrade window.
+const DAEMON_FILE_RE = /gonext-(cli|local-worker)\.mjs(\s|$)/;
+
+// Any cmdline containing one of these is a SUBCOMMAND invocation (login, start, …), not the
+// polling daemon — so it must not be mistaken for a running worker in the ps scan.
+const SUBCOMMANDS = [
+  "login", "set", "start", "stop", "status", "logs", "restart",
+  "ws-ping-test", "simulate-chat", "embed", "workspace",
+];
+
+function pidAlive(pid) {
+  if (!pid || !Number.isFinite(pid)) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    // EPERM = the process exists but we can't signal it (still "alive" for our purposes).
+    return e && e.code === "EPERM";
+  }
+}
+
+function psList() {
+  return new Promise((resolve) => {
+    execFile(
+      "ps",
+      ["-A", "-o", "pid=,command="],
+      { maxBuffer: 8 * 1024 * 1024 },
+      (err, stdout) => {
+        if (err) return resolve([]);
+        const rows = [];
+        for (const line of String(stdout).split("\n")) {
+          const m = line.trim().match(/^(\d+)\s+(.*)$/);
+          if (m) rows.push({ pid: Number(m[1]), cmd: m[2] });
+        }
+        resolve(rows);
+      }
+    );
+  });
+}
+
+/**
+ * PIDs of polling worker daemons currently running (excluding THIS process and any
+ * subcommand invocation). Catches a daemon started by GoTerminal / by hand, not just ours.
+ */
+export async function findRunningDaemonPids() {
+  const rows = await psList();
+  const self = process.pid;
+  return rows
+    .filter((r) => r.pid !== self)
+    .filter((r) => DAEMON_FILE_RE.test(r.cmd))
+    .filter((r) => !SUBCOMMANDS.some((sc) => new RegExp(`(\\s|/)${sc}(\\s|$)`).test(r.cmd)))
+    .map((r) => r.pid);
+}
+
+/**
+ * True when `pid` is actually a gonext polling daemon (not an unrelated process that reused
+ * the PID). Reads that one pid's command line — cheap and exact (review M1).
+ */
+function pidIsGonextDaemon(pid) {
+  if (!pid || !Number.isFinite(pid)) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    execFile("ps", ["-p", String(pid), "-o", "command="], (err, stdout) => {
+      const cmd = String(stdout || "").trim();
+      resolve(
+        !err &&
+          DAEMON_FILE_RE.test(cmd) &&
+          !SUBCOMMANDS.some((sc) => new RegExp(`(\\s|/)${sc}(\\s|$)`).test(cmd))
+      );
+    });
+  });
+}
+
+async function readPidFile() {
+  try {
+    const n = Number(String(await readFile(PID_FILE, "utf8")).trim());
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * { running, pids, pidFilePid }. The `ps` scan is the primary signal. The pidfile is trusted
+ * ONLY after VERIFYING that its PID is genuinely a gonext daemon (review M1) — this both
+ * rescues the case where the full-table scan missed it and rejects a stale pidfile whose PID
+ * was reused by an unrelated process (which would otherwise wrongly suppress auto-start).
+ */
+export async function daemonStatus() {
+  const [pids, pidFilePid] = await Promise.all([findRunningDaemonPids(), readPidFile()]);
+  const pidFileIsDaemon =
+    pidFilePid != null && (pids.includes(pidFilePid) || (await pidIsGonextDaemon(pidFilePid)));
+  const allPids = pidFileIsDaemon && !pids.includes(pidFilePid) ? [...pids, pidFilePid] : pids;
+  return {
+    running: allPids.length > 0,
+    pids: allPids,
+    pidFilePid: pidFileIsDaemon ? pidFilePid : null,
+  };
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Acquire an exclusive single-flight lock over the check→spawn window (review L2). O_EXCL
+ * (`wx`) is atomic, so of two concurrent starts exactly one wins. A lock left by a crashed
+ * start is stolen once it's older than LOCK_STALE_MS so it can never wedge startup.
+ * Returns a handle whose .release() removes the lock, or null if another start holds it.
+ */
+async function acquireStartLock() {
+  await mkdir(DIR, { recursive: true });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fh = await open(LOCK_FILE, "wx");
+      await fh.writeFile(String(process.pid), "utf8");
+      return {
+        release: async () => {
+          await fh.close().catch(() => {});
+          await unlink(LOCK_FILE).catch(() => {});
+        },
+      };
+    } catch (e) {
+      if (!e || e.code !== "EEXIST") throw e;
+      // Held by someone else — steal it only if it's stale (a crashed start), then retry.
+      let age = 0;
+      try {
+        age = Date.now() - (await stat(LOCK_FILE)).mtimeMs;
+      } catch {
+        age = LOCK_STALE_MS + 1; // vanished between EEXIST and stat → treat as free
+      }
+      if (age > LOCK_STALE_MS) {
+        await unlink(LOCK_FILE).catch(() => {});
+        continue; // retry the atomic create
+      }
+      return null; // a fresh lock → another start is genuinely in progress
+    }
+  }
+  return null;
+}
+
+/**
+ * Start the polling daemon DETACHED (survives the launching shell, logs to ~/.gonext/
+ * worker.log). No-op when one is already running (BC4). Concurrency-safe (L2): a lock
+ * serializes the check→spawn window so two simultaneous starts can't both spawn.
+ * Returns { started, pid?, pids }.
+ */
+export async function startDaemon() {
+  // Fast path: already running → no lock needed.
+  const pre = await daemonStatus();
+  if (pre.running) return { started: false, ...pre };
+  const lock = await acquireStartLock();
+  if (!lock) {
+    // A concurrent start holds the lock — let it win, then report the resulting state.
+    await sleep(700);
+    const s = await daemonStatus();
+    return { started: false, ...s };
+  }
+  try {
+    // Re-check UNDER the lock — the winner of a race must see the loser's daemon if it
+    // spawned in the gap (and vice-versa this is where the second caller no-ops).
+    const status = await daemonStatus();
+    if (status.running) return { started: false, ...status };
+    const out = await open(LOG_FILE, "a");
+    try {
+      const child = spawn(process.execPath, [DAEMON_SCRIPT], {
+        detached: true,
+        stdio: ["ignore", out.fd, out.fd],
+        env: process.env,
+      });
+      await writeFile(PID_FILE, String(child.pid ?? ""), "utf8");
+      child.unref();
+      return { started: true, pid: child.pid, pids: [] };
+    } finally {
+      await out.close();
+    }
+  } finally {
+    await lock.release();
+  }
+}
+
+/** Stop every running daemon (ours + any ps-found) and clear the pidfile. */
+export async function stopDaemon() {
+  const status = await daemonStatus();
+  const targets = new Set(status.pids);
+  if (status.pidFilePid) targets.add(status.pidFilePid);
+  let killed = 0;
+  for (const pid of targets) {
+    try {
+      process.kill(pid, "SIGTERM");
+      killed++;
+    } catch {
+      /* already gone */
+    }
+  }
+  try {
+    await unlink(PID_FILE);
+  } catch {
+    /* no pidfile */
+  }
+  return { killed };
+}
+
+/** Last `n` lines of the daemon log (empty string when none yet). */
+export async function tailLog(n = 40) {
+  try {
+    const txt = await readFile(LOG_FILE, "utf8");
+    const lines = txt.split("\n");
+    return lines.slice(Math.max(0, lines.length - n)).join("\n");
+  } catch {
+    return "";
+  }
+}

package/device-login.mjs

@@ -0,0 +1,141 @@
+// Device-pairing login for the gonext CLI (task #127, Phase 1). Shared by both bins
+// (gonext-cli.mjs and gonext-repl.mjs) so `gonext login` and the first-run
+// auto-prompt use the exact same flow. No secrets live here — the CLI obtains a worker key
+// only after an authenticated human approves in the browser.
+import { execFile } from "node:child_process";
+import { mkdir, writeFile, readFile } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import dotenv from "dotenv";
+
+export const DEFAULT_API_BASE = "https://chat-api-v2.gomarsic.cc";
+const ENV_FILE = join(homedir(), ".gonext", "worker.env");
+const POLL_INTERVAL_MS = 2500;
+const POLL_TIMEOUT_MS = 10 * 60_000; // matches the server's pairing TTL
+
+/** True when worker.env already has BOTH a key and an API base (task #127 BC1a). */
+export async function hasWorkerConfig() {
+  try {
+    const parsed = dotenv.parse(await readFile(ENV_FILE, "utf8"));
+    return Boolean(
+      String(parsed.GONEXT_WORKER_KEY ?? "").trim() &&
+        String(parsed.GONEXT_API_BASE ?? "").trim()
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Write ~/.gonext/worker.env, preserving any existing GONEXT_POLL_MS. */
+async function writeWorkerEnv(apiBase, workerKey) {
+  let pollMs = "500";
+  try {
+    const prev = dotenv.parse(await readFile(ENV_FILE, "utf8"));
+    if (String(prev.GONEXT_POLL_MS ?? "").trim()) pollMs = String(prev.GONEXT_POLL_MS).trim();
+  } catch {
+    /* first-time write */
+  }
+  await mkdir(join(homedir(), ".gonext"), { recursive: true });
+  await writeFile(
+    ENV_FILE,
+    `GONEXT_API_BASE=${apiBase.replace(/\/+$/, "")}\nGONEXT_WORKER_KEY=${workerKey}\nGONEXT_POLL_MS=${pollMs}\n`,
+    { encoding: "utf8", mode: 0o600 }
+  );
+  return ENV_FILE;
+}
+
+function openBrowser(url) {
+  const cmd =
+    platform() === "darwin" ? "open" : platform() === "win32" ? "start" : "xdg-open";
+  try {
+    execFile(cmd, [url], () => {}); // best-effort; the URL is also printed
+  } catch {
+    /* the user can open it manually */
+  }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Run the browser device-pairing flow and write worker.env on success.
+ *
+ * Returns { apiBase, workerKey, envFile } on success.
+ * Throws Error with .code === "PAIRING_UNSUPPORTED" when the API has no /pair routes
+ *   (404), so callers can fall back to the manual `set` path (task #127 BC7).
+ * Throws Error with .code === "PAIRING_TIMEOUT" / "PAIRING_EXPIRED" otherwise.
+ *
+ * `log` is an injectable printer (defaults to console.log) so the REPL can style it.
+ */
+export async function deviceLogin({ apiBase = DEFAULT_API_BASE, log = console.log } = {}) {
+  const base = String(apiBase || DEFAULT_API_BASE).trim().replace(/\/+$/, "");
+  let start;
+  try {
+    const res = await fetch(`${base}/api/pair/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ apiBase: base }),
+    });
+    if (res.status === 404) {
+      const err = new Error("This API does not support CLI login (device pairing).");
+      err.code = "PAIRING_UNSUPPORTED";
+      throw err;
+    }
+    if (!res.ok) {
+      throw new Error(`pairing start failed (HTTP ${res.status})`);
+    }
+    start = await res.json();
+  } catch (e) {
+    if (e && e.code === "PAIRING_UNSUPPORTED") throw e;
+    // A network failure to a base that has no /pair yet also can't pair — surface as
+    // unsupported so the caller offers manual setup rather than looping.
+    const err = new Error(
+      `Could not reach ${base} to start login: ${e instanceof Error ? e.message : e}`
+    );
+    err.code = "PAIRING_UNSUPPORTED";
+    throw err;
+  }
+
+  const { pairId, pairCode, verificationUrlBase } = start;
+  const url = `${verificationUrlBase || `${base}/link`}?code=${encodeURIComponent(pairCode)}`;
+  log("");
+  log("  To connect this machine, sign in and approve this code in your browser:");
+  log("");
+  log(`      code:  ${pairCode}`);
+  log(`      url:   ${url}`);
+  log("");
+  log("  (opening your browser… if it doesn't, paste the url above)");
+  log("");
+  openBrowser(url);
+
+  const deadline = Date.now() + POLL_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    await sleep(POLL_INTERVAL_MS);
+    let poll;
+    try {
+      const res = await fetch(`${base}/api/pair/poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ pairId }),
+      });
+      if (!res.ok) continue; // transient — keep polling
+      poll = await res.json();
+    } catch {
+      continue; // network blip — keep polling
+    }
+    if (poll.status === "approved" && poll.workerApiKey) {
+      const finalBase = String(poll.apiBase || base).trim().replace(/\/+$/, "");
+      const envFile = await writeWorkerEnv(finalBase, poll.workerApiKey);
+      log(`  ✓ Linked. Saved ${envFile}`);
+      return { apiBase: finalBase, workerKey: poll.workerApiKey, envFile };
+    }
+    if (poll.status === "expired") {
+      const err = new Error("Login code expired before it was approved. Run `gonext login` again.");
+      err.code = "PAIRING_EXPIRED";
+      throw err;
+    }
+    // "pending" / "consumed" → keep waiting (consumed by a racing poll is unlikely).
+  }
+  const err = new Error("Login timed out waiting for browser approval.");
+  err.code = "PAIRING_TIMEOUT";
+  throw err;
+}