@tiens.nguyen/gonext-local-worker 1.0.221 → 1.0.223

package/gonext-local-worker.mjs

@@ -1249,8 +1249,15 @@ async function correctOcrTextViaOpenAI(extractedText, base, model) {
       model,
       stream: false,
       temperature: 0,
+      // Qwen3 (and other reasoning models) emit a <think> trace by default. Over the
+      // OpenAI /v1 API there's no `think:false` flag, so use Qwen3's `/no_think` SOFT
+      // SWITCH (honored by its chat template, same as the agent loop) to suppress it —
+      // otherwise the model spends its whole token budget reasoning and returns no
+      // corrected text (seen live: correction was a no-op, chars unchanged). Generous
+      // max_tokens so a long OCR page isn't truncated.
+      max_tokens: 4096,
       messages: [
-        { role: "system", content: OCR_CORRECT_SYSTEM_PROMPT },
+        { role: "system", content: `${OCR_CORRECT_SYSTEM_PROMPT}\n/no_think` },
         { role: "user", content: `Text:\n${extractedText}` },
       ],
     }),
@@ -1261,7 +1268,13 @@ async function correctOcrTextViaOpenAI(extractedText, base, model) {
   }
   const json = await res.json();
   let corrected = json?.choices?.[0]?.message?.content?.trim() || "";
-  corrected = corrected.replace(/<think>[\s\S]*?<\/think>/gi, "").trim();
+  // Strip a <think> trace if `/no_think` wasn't honored: closed pairs, a template-opened
+  // leading …</think>, and a trailing UNCLOSED <think> (truncated by max_tokens).
+  corrected = corrected
+    .replace(/<think>[\s\S]*?<\/think>/gi, "")
+    .replace(/^[\s\S]*?<\/think>/i, "")
+    .replace(/<think>[\s\S]*$/i, "")
+    .trim();
   return normalizeCorrection(corrected, extractedText);
 }
 

package/gonext_agent_chat.py

@@ -2202,12 +2202,23 @@ def _ws_record_change(action: str, path: str, backup) -> None:
         _log(f"workspace manifest write failed: {e}")
 
 
-# Command prefixes run_command may execute (first token after shlex split). Build/test
-# runners only — no shells, no package publishes, no sudo.
+# Command prefixes run_command may execute (first token after shlex split). This is a
+# STEERING mechanism, not a sandbox: python3 (allowed) can subprocess anything, and
+# ssh/rsync flags (ProxyCommand, -e) can local-exec too. A run-enabled workspace means
+# the user trusts the agent with local-user-level execution — the list exists to keep
+# the model on productive paths (build/test/deploy), not to contain a hostile one.
+# Still excluded on purpose: bare shells, package publishes, sudo, and bare `pip`
+# (the model must use `python3 -m pip`, which pip itself recommends).
 _WS_RUN_ALLOWED = {
     "npm", "npx", "yarn", "pnpm", "node", "mvn", "./mvnw", "gradle", "./gradlew",
     "pytest", "python", "python3", "go", "cargo", "make", "dotnet", "swift",
     "rspec", "bundle", "php", "composer", "tsc", "jest", "vitest",
+    # Deployment (task #57): transfer files + run remote commands. Auth uses the user's
+    # own SSH key/agent (SSH_AUTH_SOCK passes through _ws_scrubbed_env); the model is
+    # told to use non-interactive KEY auth (BatchMode) and NEVER hardcode passwords (a
+    # stdin password prompt EOFErrors here). No `sftp`: it's interactive by default
+    # (would hang → timeout kill); scp/rsync cover the same ground batch-safely.
+    "ssh", "scp", "rsync",
 }
 
 # ---- background servers (behavior-detected, command-agnostic) ----
@@ -2339,7 +2350,10 @@ def _ws_scrubbed_env() -> dict:
     them, so we pass an explicit whitelist instead of inheriting."""
     import os
     keep = ("PATH", "HOME", "LANG", "LC_ALL", "TMPDIR", "SHELL", "USER", "TERM",
-            "JAVA_HOME", "GOPATH", "CARGO_HOME", "NVM_DIR")
+            "JAVA_HOME", "GOPATH", "CARGO_HOME", "NVM_DIR",
+            # SSH agent socket so ssh/scp/rsync can authenticate with the user's KEY
+            # (no password in the model's context) for deploys (task #57).
+            "SSH_AUTH_SOCK", "SSH_AGENT_PID")
     env = {k: os.environ[k] for k in keep if k in os.environ}
     # CI=1 makes watch-mode test runners (CRA's `npm test`, jest --watch) run ONCE and
     # exit instead of sitting in interactive watch mode until the timeout kills them.
@@ -2927,6 +2941,21 @@ def run_agent_chat(cfg):
         "left RUNNING (its window opens on the user's Mac); stop_server closes it. An "
         "interactive input() CLI can't be driven here (EOFError) — make it non-interactive "
         "or give the user the command.\n"
+        f"      ALLOWED runners (first word only): {', '.join(sorted(_WS_RUN_ALLOWED))}. "
+        "Anything else is rejected — do NOT retry a blocked command a different way. "
+        "For Python packages use `python3 -m pip install <pkg>` (bare `pip` is NOT allowed).\n"
+        "      DEPLOY (ssh/scp/rsync are allowed): transfer files + run remote commands "
+        "directly, e.g. `rsync -az build/ user@host:/path` then `ssh user@host '…'`. Use "
+        "NON-INTERACTIVE KEY auth: add `-o BatchMode=yes` (and "
+        "`-o StrictHostKeyChecking=accept-new`) so it fails fast instead of hanging on a "
+        "prompt. NEVER put a password in a command, file, or your reply — there is no "
+        "stdin here. If the server only accepts a PASSWORD (BatchMode fails with "
+        "'Permission denied (publickey,password)'), STOP and tell the user to set up key "
+        "auth once: `ssh-copy-id user@host` — then retry. Do not write paramiko/expect "
+        "scripts with hardcoded credentials. REMOTE sudo usually FAILS over ssh (no TTY: "
+        "'a terminal is required') — deploy to a directory the remote user can write, "
+        "and if a root step is unavoidable (mv to /var/www, nginx config/reload), "
+        "final_answer the exact one-liner for the user to run on the server themselves.\n"
         "    NOTE: plain `import os`/`open()` is blocked — use ONLY these tools for files.\n"
         "    WRITING FILE CONTENT: multi-line content MUST use \\n for newlines (or a "
         "triple-quoted string). NEVER put a raw line break inside a normal \"...\" — it "
@@ -4496,7 +4525,7 @@ def run_agent_chat(cfg):
 
         @tool
         def run_command(command: str, workdir: str = "", timeout_seconds: int = 180) -> str:
-            """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
+            """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Also allows DEPLOY commands (ssh/scp/rsync) — use non-interactive KEY auth (-o BatchMode=yes); never put a password in the command (there is no stdin). Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
 
             Args:
                 command: the command line (allowlisted runners only; no shells or sudo).
@@ -4509,7 +4538,27 @@ def run_agent_chat(cfg):
                 import signal
                 import subprocess
                 import time as _t
-                wd = _rag_read_allowed((workdir or "").strip() or _default_ws_root())
+                # workdir="" → the active workspace. Guard the common model mistake of
+                # passing the workspace's OWN name (e.g. workdir="t13" while the active
+                # folder is /…/t13), which would double-nest to /…/t13/t13
+                # (FileNotFoundError). EXISTENCE-FIRST: a real subdir always wins — only
+                # strip the redundant leading segment when the nested path does NOT exist
+                # (so a legit repo/repo layout like web/web is never misrouted). Handles
+                # both the bare form ("t13") and the prefixed form ("t13/my-react-app").
+                _wd_in = (workdir or "").strip()
+                if _wd_in and not os.path.isabs(os.path.expanduser(_wd_in)):
+                    _active = _default_ws_root()
+                    if _wd_in in (".", "./"):
+                        _wd_in = ""
+                    elif not os.path.isdir(os.path.join(_active, _wd_in)):
+                        _base = os.path.basename(_active)
+                        if _wd_in == _base:
+                            _wd_in = ""
+                        elif _wd_in.startswith(_base + os.sep):
+                            _stripped = _wd_in[len(_base) + 1:]
+                            if os.path.isdir(os.path.join(_active, _stripped)):
+                                _wd_in = _stripped
+                wd = _rag_read_allowed(_wd_in or _default_ws_root())
                 w = _ws_for_path(wd)
                 if w is None or not w.get("allowRun"):
                     msg = ("Error: running commands is not enabled for this workspace. "

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.221",
+  "version": "1.0.223",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",