@tiens.nguyen/gonext-local-worker 1.0.224 → 1.0.225

package/gonext_agent_chat.py

@@ -2369,6 +2369,23 @@ def _ws_distill_output(out: str, cap_head: int = 1200, cap_tail: int = 4000) ->
             + out[-cap_tail:])
 
 
+def _ws_cap_obs(text: str, cap: int = 3000) -> str:
+    """Cap a READ tool's observation (read_file_lines / list_dir / read_text_file /
+    grep_repo) before it's returned to the CodeAgent. Every observation stays in the
+    agent's step memory and is re-sent to the model EVERY subsequent step, so an
+    uncapped 20k-char file dump costs ~5-6k tokens PER remaining step (O(n²) growth —
+    task #63). Keeps the head (line numbers / range start) + a small tail; the model is
+    told to read smaller ranges / grep to locate instead of whole files."""
+    if len(text) <= cap:
+        return text
+    head = int(cap * 0.7)
+    tail = cap - head
+    return (text[:head].rstrip()
+            + f"\n…[{len(text) - cap} chars truncated to save context — read a smaller "
+              "line range, or grep_repo to locate the exact spot]…\n"
+            + text[-tail:].lstrip())
+
+
 def _rag_s3_client(region: str, akid: str, secret: str):
     import boto3  # noqa: PLC0415
     return boto3.client(
@@ -2928,7 +2945,9 @@ def run_agent_chat(cfg):
         "    - grep_repo(pattern, path='', glob='') — search code, returns file:line hits. "
         "Use this to find the EXACT lines to change.\n"
         "    - read_file_lines(path, start_line, end_line) — read WITH line numbers "
-        "before editing.\n"
+        "before editing. Read a SMALL range around the spot you need (large reads are "
+        "truncated and slow every later step). Use grep_repo to LOCATE first, then read "
+        "~40 lines around the hit — do NOT re-read the whole file or the same range twice.\n"
         "    - edit_lines(path, start_line, end_line, new_content) — PRIMARY edit tool: "
         "replace a line range (backup saved automatically).\n"
         "    - edit_file(path, old_string, new_string) — replace one exact unique string "
@@ -2944,18 +2963,15 @@ def run_agent_chat(cfg):
         f"      ALLOWED runners (first word only): {', '.join(sorted(_WS_RUN_ALLOWED))}. "
         "Anything else is rejected — do NOT retry a blocked command a different way. "
         "For Python packages use `python3 -m pip install <pkg>` (bare `pip` is NOT allowed).\n"
-        "      DEPLOY (ssh/scp/rsync are allowed): transfer files + run remote commands "
-        "directly, e.g. `rsync -az build/ user@host:/path` then `ssh user@host '…'`. Use "
-        "NON-INTERACTIVE KEY auth: add `-o BatchMode=yes` (and "
-        "`-o StrictHostKeyChecking=accept-new`) so it fails fast instead of hanging on a "
-        "prompt. NEVER put a password in a command, file, or your reply — there is no "
-        "stdin here. If the server only accepts a PASSWORD (BatchMode fails with "
-        "'Permission denied (publickey,password)'), STOP and tell the user to set up key "
-        "auth once: `ssh-copy-id user@host` — then retry. Do not write paramiko/expect "
-        "scripts with hardcoded credentials. REMOTE sudo usually FAILS over ssh (no TTY: "
-        "'a terminal is required') — deploy to a directory the remote user can write, "
-        "and if a root step is unavoidable (mv to /var/www, nginx config/reload), "
-        "final_answer the exact one-liner for the user to run on the server themselves.\n"
+        "    - deploy_web(local_dir, host, user, remote_path, domain='') — DEPLOY a built "
+        "static site in ONE call: build first (run_command('npm run build')), then "
+        "deploy_web('my-app/build', host, user, remote_path, domain). It rsyncs over your "
+        "SSH KEY, finishes nginx via passwordless sudo when possible, else writes deploy.sh "
+        "+ returns the exact server commands; if key auth isn't set up it returns the "
+        "one-time `ssh-copy-id` to run. PREFER THIS over hand-writing scp/ssh/rsync.\n"
+        "      Raw ssh/scp/rsync are also allowed for other remote work — always KEY auth "
+        "(`-o BatchMode=yes`), NEVER a password in a command/file/reply (no stdin here), "
+        "no paramiko/expect with hardcoded creds; remote sudo fails without a TTY.\n"
         "    NOTE: plain `import os`/`open()` is blocked — use ONLY these tools for files.\n"
         "    WRITING FILE CONTENT: multi-line content MUST use \\n for newlines (or a "
         "triple-quoted string). NEVER put a raw line break inside a normal \"...\" — it "
@@ -3472,10 +3488,33 @@ def run_agent_chat(cfg):
     # _write_turn_checkpoint (inside step_callback below) — see _load_and_clear_turn_
     # checkpoint above for how a crashed/interrupted turn gets recovered on the next run.
     _turn_steps: list = []
+    # Set right after the agent is built (below) so step_callback can reach the running
+    # agent's memory to trim old observations (task #63, keeps the prompt from growing
+    # O(n²) as big file reads pile up in the step trace).
+    _agent_ref: dict = {"a": None}
 
     def step_callback(step_log):
         step_num = getattr(step_log, "step_number", "?")
 
+        # (B) Trim OLD, LARGE tool observations out of the CodeAgent's step memory so
+        # they aren't re-sent to the model on every subsequent step (the #63 O(n²) token
+        # blow-up: an uncapped read_file_lines dump cost ~5-6k tokens PER remaining step).
+        # Keep the last 2 steps' observations intact (the model just acted on them);
+        # replace older long ones with a short placeholder — the model can re-read.
+        try:
+            _mem = getattr(_agent_ref.get("a"), "memory", None)
+            _steps = getattr(_mem, "steps", None)
+            if _steps and len(_steps) > 2:
+                for _st in _steps[:-2]:
+                    _obs = getattr(_st, "observations", None)
+                    if isinstance(_obs, str) and len(_obs) > 900:
+                        _st.observations = (
+                            _obs[:400].rstrip()
+                            + "\n…[earlier observation trimmed to save context — "
+                            "re-read the file/dir with a small range if you still need it]")
+        except Exception as _e:  # noqa: BLE001
+            _log(f"memory-trim skip: {_e}")
+
         # Log what was sent to the model (last message in the conversation).
         model_input = getattr(step_log, "model_input_messages", None)
         if model_input:
@@ -4102,7 +4141,8 @@ def run_agent_chat(cfg):
                         break
                 entries.sort()
                 more = " …(truncated)" if len(entries) >= 300 else ""
-                out = f"{len(entries)} files under {root}:\n" + "\n".join(entries) + more
+                out = _ws_cap_obs(
+                    f"{len(entries)} files under {root}:\n" + "\n".join(entries) + more)
                 _last_obs["text"] = out
                 return out
             except Exception as e:  # noqa: BLE001
@@ -4131,7 +4171,7 @@ def run_agent_chat(cfg):
                     return msg
                 with open(rp, "r", encoding="utf-8", errors="replace") as fh:
                     data = fh.read(max(500, min(int(max_chars or 20000), 100000)))
-                out = data or "(empty file)"
+                out = _ws_cap_obs(data or "(empty file)")
                 _last_obs["text"] = out
                 return out
             except Exception as e:  # noqa: BLE001
@@ -4317,7 +4357,7 @@ def run_agent_chat(cfg):
                     _last_obs["text"] = msg
                     return msg
                 more = "\n…(capped at 100 hits)" if len(hits) >= 100 else ""
-                out = f"Matches under {root}:\n" + "\n".join(hits) + more
+                out = _ws_cap_obs(f"Matches under {root}:\n" + "\n".join(hits) + more)
                 _last_obs["text"] = out
                 return out
             except Exception as e:  # noqa: BLE001
@@ -4342,7 +4382,7 @@ def run_agent_chat(cfg):
                 e = int(end_line or 0) or len(lines)
                 e = min(e, len(lines), s + 399)
                 body = "".join(f"{i}: {lines[i - 1]}" for i in range(s, e + 1))
-                out = f"{rp} (lines {s}-{e} of {len(lines)}):\n{body}"
+                out = _ws_cap_obs(f"{rp} (lines {s}-{e} of {len(lines)}):\n{body}")
                 _last_obs["text"] = out
                 return out
             except Exception as ex:  # noqa: BLE001
@@ -4725,6 +4765,130 @@ def run_agent_chat(cfg):
                 _last_obs["text"] = msg
                 return msg
 
+        @tool
+        def deploy_web(local_dir: str, host: str, user: str, remote_path: str,
+                       domain: str = "") -> str:
+            """Deploy a built static site to a remote server in ONE step — prefer this over hand-writing scp/ssh/rsync. rsyncs local_dir to user@host:remote_path over SSH KEY auth, and (if domain is given) tries to finish the nginx setup via PASSWORDLESS sudo; if that needs a password it writes a ready-to-run deploy.sh and returns the exact commands for the user. Uses the user's SSH key only — never a password. If key auth isn't set up it returns the one-time `ssh-copy-id` command to run and stops.
+
+            Args:
+                local_dir: the built folder to upload (e.g. 'my-react-app/build') inside the workspace.
+                host: server hostname (e.g. 'example.com').
+                user: SSH username.
+                remote_path: destination dir on the server (e.g. '/home/<user>/site' or '/var/www/site').
+                domain: optional site domain — when set, also generate/apply the nginx server block.
+            """
+            try:
+                import os
+                import subprocess
+                src = _rag_read_allowed((local_dir or "").strip())
+                if not os.path.isdir(src):
+                    msg = (f"Error: local_dir '{local_dir}' is not a folder — build first "
+                           "(e.g. run_command('npm run build')) so the output dir exists.")
+                    _last_obs["text"] = msg
+                    return msg
+                host = (host or "").strip()
+                user = (user or "").strip()
+                remote_path = (remote_path or "").strip()
+                if not host or not user or not remote_path:
+                    msg = "Error: host, user and remote_path are all required."
+                    _last_obs["text"] = msg
+                    return msg
+                target = f"{user}@{host}"
+                sshopts = ["-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new",
+                           "-o", "ConnectTimeout=8"]
+                env = _ws_scrubbed_env()
+                _emit({"type": "step", "text": f"Deploying → {target}:{remote_path}"})
+                # 1) KEY-auth probe. No password is ever used or requested.
+                probe = subprocess.run(["ssh", *sshopts, target, "true"], env=env,
+                                       capture_output=True, text=True, timeout=25)
+                if probe.returncode != 0:
+                    msg = (
+                        f"Can't deploy yet: SSH key auth to {target} isn't set up "
+                        f"({(probe.stderr or '').strip()[:160]}). Run this ONCE in your "
+                        f"OWN terminal (it will ask for the password a final time):\n"
+                        f"    ssh-copy-id {target}\n"
+                        "Then ask me to deploy again — I'll use the key (no password needed)."
+                    )
+                    _last_obs["text"] = msg
+                    return msg
+                # 2) rsync the build over the key.
+                rsync = subprocess.run(
+                    ["rsync", "-az", "--delete", "-e", "ssh " + " ".join(sshopts),
+                     src.rstrip("/") + "/", f"{target}:{remote_path.rstrip('/')}/"],
+                    env=env, capture_output=True, text=True, timeout=600)
+                if rsync.returncode != 0:
+                    msg = (f"Error: rsync to {target}:{remote_path} failed "
+                           f"({(rsync.stderr or rsync.stdout or '').strip()[:200]}).")
+                    _last_obs["text"] = msg
+                    return msg
+                uploaded = f"Uploaded {os.path.basename(src)} → {target}:{remote_path}."
+                if not domain.strip():
+                    _last_obs["text"] = uploaded
+                    return uploaded + " No domain given, so nothing was served — pass domain= to configure nginx."
+                dom = domain.strip()
+                webroot = f"/var/www/{dom}"
+                nginx_conf = (
+                    f"server {{\n    listen 80;\n    server_name {dom};\n"
+                    f"    root {webroot};\n    index index.html;\n"
+                    f"    location / {{ try_files $uri $uri/ /index.html; }}\n}}\n"
+                )
+                # Remote setup script: move the upload into the webroot + wire up nginx.
+                remote_sh = (
+                    "set -e\n"
+                    f"mkdir -p {webroot}\n"
+                    f"cp -r {remote_path.rstrip('/')}/* {webroot}/\n"
+                    f"cat > /etc/nginx/sites-available/{dom} <<'NGINX'\n{nginx_conf}NGINX\n"
+                    f"ln -sf /etc/nginx/sites-available/{dom} /etc/nginx/sites-enabled/{dom}\n"
+                    "nginx -t\n"
+                    "systemctl reload nginx\n"
+                )
+                # 3) Try to finish via PASSWORDLESS sudo (sudo -n succeeds only w/ NOPASSWD).
+                fin = subprocess.run(["ssh", *sshopts, target, "sudo -n bash -s"],
+                                     input=remote_sh, env=env, capture_output=True,
+                                     text=True, timeout=120)
+                if fin.returncode == 0:
+                    out = f"{uploaded} Configured nginx and reloaded — the site is live at http://{dom}/."
+                    _emit({"type": "step", "text": f"Site live → http://{dom}/"})
+                    _last_obs["text"] = out
+                    return out
+                # 4) sudo needs a password (no TTY here) → write a runnable deploy.sh
+                #    (SAME sudo commands as the printed steps) and hand it over.
+                sudo_sh = (
+                    "#!/usr/bin/env bash\nset -e\n"
+                    f"sudo mkdir -p {webroot}\n"
+                    f"sudo cp -r {remote_path.rstrip('/')}/* {webroot}/\n"
+                    f"sudo tee /etc/nginx/sites-available/{dom} >/dev/null <<'NGINX'\n"
+                    f"{nginx_conf}NGINX\n"
+                    f"sudo ln -sf /etc/nginx/sites-available/{dom} /etc/nginx/sites-enabled/{dom}\n"
+                    "sudo nginx -t && sudo systemctl reload nginx\n"
+                )
+                sh_local = os.path.join(_default_ws_root(), "deploy.sh")
+                try:
+                    with open(sh_local, "w", encoding="utf-8") as fh:
+                        fh.write(sudo_sh)
+                    _ws_record_change("create", sh_local, None)
+                    where = sh_local
+                except OSError:
+                    where = "(could not write deploy.sh)"
+                out = (
+                    f"{uploaded} The nginx/webroot step needs sudo (no password prompt is "
+                    f"possible over SSH). I wrote a runnable script to {where} — copy it to "
+                    f"the server and run it (`scp deploy.sh {target}:` then `ssh {target} "
+                    f"'bash deploy.sh'`), OR run these on the server yourself:\n"
+                    + "\n".join("    " + ln for ln in sudo_sh.splitlines()[2:])
+                    + f"\nThen {dom} serves the site."
+                )
+                _last_obs["text"] = out
+                return out
+            except subprocess.TimeoutExpired:
+                msg = f"Error: deploy to {host} timed out (server unreachable or slow)."
+                _last_obs["text"] = msg
+                return msg
+            except Exception as ex:  # noqa: BLE001
+                msg = f"Error: deploy_web failed: {type(ex).__name__}: {ex}"
+                _last_obs["text"] = msg
+                return msg
+
         agent_tools = [http_request, web_search, fetch_url, calculate,
                        get_current_datetime, create_pdf]
         # Only register the PDF reader / email / RAG tools when available — the model
@@ -4739,7 +4903,8 @@ def run_agent_chat(cfg):
                             rag_index, rag_add, rag_search]
         if _WS_AVAILABLE:
             agent_tools += [grep_repo, read_file_lines, edit_lines, edit_file,
-                            create_file, create_folder, run_command, stop_server]
+                            create_file, create_folder, run_command, stop_server,
+                            deploy_web]
             # list_dir/read_text_file are needed for workspace browsing even when RAG
             # (S3 indexing) isn't configured.
             if not _RAG_AVAILABLE:
@@ -4778,6 +4943,7 @@ def run_agent_chat(cfg):
             except Exception as _e:  # noqa: BLE001
                 _log(f"compact system prompt unavailable ({_e}); using smolagents default")
         agent = _ToolAgent(**agent_kwargs)
+        _agent_ref["a"] = agent  # let step_callback trim this agent's step memory (#63)
         with contextlib.redirect_stdout(sys.stderr):
             result = agent.run(task_with_hint)
         # Final formatting — NO extra summarizer model call. In multi-step mode the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.224",
+  "version": "1.0.225",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",