@tiens.nguyen/gonext-local-worker 1.0.225 → 1.0.227

package/gonext-local-worker.mjs

@@ -1842,6 +1842,12 @@ async function runAgentChatJob(job) {
       // workspaces are registered. Passing a literal 5 here would look user-set and
       // block that bump.
       maxSteps: payload?.maxSteps ?? 0,
+      // run_command policy (web Settings → Agent). Both optional: empty = allow every
+      // command except the always-blocked sudo/su. runAllowlist (non-empty) = opt-in
+      // lockdown to exactly those runners; runDenylist = extra blocks. Accept whatever
+      // the API sends (list or comma/space string); python re-parses either shape.
+      runAllowlist: payload?.runAllowlist ?? [],
+      runDenylist: payload?.runDenylist ?? [],
       // Max web_search + fetch_url calls the agent may make per task (user-configurable
       // in web Settings → Agent). Default 10; past it the retrieval tools refuse.
       researchBudget: payload?.researchBudget ?? 10,

package/gonext-repl.mjs

@@ -699,6 +699,21 @@ async function runAgentTurn(history) {
   let thinkWord = pickWord(); // playful word shown UNDER the in-progress line (flavor)
   let almostDone = false; // set from the worker's "…almost completed thinking…" heartbeat
   let runningCmd = null; // the command currently executing (from a "Running → …" event)
+  // The model's CURRENT Thought (task #64): while it streams its reasoning inside the
+  // hidden ~~~ fence, show a one-clause summary on the blinking line so a 300s CPU-bound
+  // step reads as "◑ Adding the nav links to app.component.html… (52s)" instead of a
+  // random word. `fenceThought` accumulates the raw in-fence text for the current step.
+  let liveThought = "";
+  let fenceThought = "";
+  // First non-empty Thought clause: drop the "Thought:" prefix, stop at the <code> block
+  // (we never show code), take the first line, and cap length so it never wraps.
+  const extractThought = (buf) => {
+    let t = String(buf || "");
+    const ci = t.search(/<code[\s>]/i);
+    if (ci >= 0) t = t.slice(0, ci);
+    t = t.replace(/^\s*Thought:\s*/i, "").split(/\n/)[0].trim();
+    return t;
+  };
   const thinkSecs = () => Math.max(1, Math.round((Date.now() - thinkingSince) / 1000));
 
   // The status is TWO in-place lines — the in-progress action, then the playful word
@@ -724,9 +739,12 @@ async function runAgentTurn(history) {
     const glyph = SPINNER[secs % SPINNER.length]; // rotates → reads as "in progress"
     // Line 1 = WHAT is happening now: the running command, else the phase (Thinking /
     // Almost done). Line 2 = the playful word (flavor). Truncate so neither wraps.
+    // Priority: a live command > the model's current Thought clause (task #64, so a
+    // long CPU-bound step reads as what it's actually reasoning about, not "Thinking")
+    // > the "almost done" heartbeat > the bare fallback.
     const primary = runningCmd
       ? `Running ${runningCmd}`
-      : almostDone ? "Almost done" : "Thinking";
+      : liveThought || (almostDone ? "Almost done" : "Thinking");
     const max = Math.max(24, (process.stdout.columns || 80) - 14);
     const fit = (s) => (s.length > max ? s.slice(0, max - 1) + "…" : s);
     clearStatus();
@@ -744,6 +762,10 @@ async function runAgentTurn(history) {
     clearStatus();
     thinking = false;
     runningCmd = null;
+    // A concrete action landed → the Thought that led to it is spent; clear it so the
+    // next step's blinking line starts from "Thinking", not last step's stale clause.
+    liveThought = "";
+    fenceThought = "";
     lastContentAt = Date.now();
   };
 
@@ -782,11 +804,26 @@ async function runAgentTurn(history) {
         almostDone = /almost/i.test(line);
         continue;
       }
-      if (isFenceLine(line)) { inStreamFence = !inStreamFence; continue; }
-      // Inside a ~~~ fence = raw model Thought/code stream → suppressed entirely. Do NOT
-      // bump lastContentAt: while the (now hidden) tokens flow, the blinking bullet keeps
-      // ticking so the user sees the step is still being worked on.
-      if (inStreamFence) continue;
+      // A fence opening starts a fresh step's raw stream → reset the harvested Thought
+      // so the blinking line doesn't carry last step's clause into this one.
+      if (isFenceLine(line)) {
+        inStreamFence = !inStreamFence;
+        if (inStreamFence) fenceThought = "";
+        continue;
+      }
+      // Inside a ~~~ fence = raw model Thought/code stream → suppressed from scrollback. Do
+      // NOT bump lastContentAt: while the (now hidden) tokens flow, the blinking bullet keeps
+      // ticking so the user sees the step is still being worked on. But HARVEST the first
+      // Thought clause for the blinking line (task #64) — up to the <code> block, which is
+      // where the prose ends and the tool call begins (we never surface code here).
+      if (inStreamFence) {
+        if (!/<code[\s>]/i.test(fenceThought)) {
+          fenceThought += line + "\n";
+          const th = extractThought(fenceThought);
+          if (th) liveThought = th;
+        }
+        continue;
+      }
       if (isToolStepSummary(line)) { lastContentAt = Date.now(); continue; } // swallow
       if (isRoutingLine(line)) {
         // Swallow the router's play-by-play entirely — the blinking-bullet ticker (which
@@ -914,6 +951,14 @@ async function runAgentTurn(history) {
       answerShownLive = true;
       lastWasBlank = false;
     }
+    // While in the hidden fence, the model's FIRST Thought line often sits in `carry` with
+    // no newline yet (a long reasoning sentence streams token-by-token) — recompute the
+    // live clause from the partial too, so the blinking line updates mid-sentence instead
+    // of only once the line finally breaks (task #64).
+    if (inStreamFence && !/<code[\s>]/i.test(fenceThought)) {
+      const th = extractThought(fenceThought + carry);
+      if (th) liveThought = th;
+    }
     // A non-empty remainder is a partial CONTENT line (heartbeats always arrive whole with
     // a newline), so tokens are actively flowing — keep the ticker asleep.
     if (carry.trim() !== "") lastContentAt = Date.now();

package/gonext_agent_chat.py

@@ -2209,17 +2209,23 @@ def _ws_record_change(action: str, path: str, backup) -> None:
 # the model on productive paths (build/test/deploy), not to contain a hostile one.
 # Still excluded on purpose: bare shells, package publishes, sudo, and bare `pip`
 # (the model must use `python3 -m pip`, which pip itself recommends).
-_WS_RUN_ALLOWED = {
-    "npm", "npx", "yarn", "pnpm", "node", "mvn", "./mvnw", "gradle", "./gradlew",
-    "pytest", "python", "python3", "go", "cargo", "make", "dotnet", "swift",
-    "rspec", "bundle", "php", "composer", "tsc", "jest", "vitest",
-    # Deployment (task #57): transfer files + run remote commands. Auth uses the user's
-    # own SSH key/agent (SSH_AUTH_SOCK passes through _ws_scrubbed_env); the model is
-    # told to use non-interactive KEY auth (BatchMode) and NEVER hardcode passwords (a
-    # stdin password prompt EOFErrors here). No `sftp`: it's interactive by default
-    # (would hang → timeout kill); scp/rsync cover the same ground batch-safely.
-    "ssh", "scp", "rsync",
-}
+# run_command execution policy — ALLOW-BY-DEFAULT.
+# We used to gate on a fixed allowlist (npm/python/go/…). It rejected legitimate DevOps
+# tooling (docker, kubectl, terraform, aws, gh, …) and, because that universe is unbounded
+# and grows constantly, any list was a hardcode that upset the next user. Crucially, the
+# gate was never a SANDBOX: `python3`/`node` are runnable and can subprocess anything, so a
+# restrictive allowlist bought STEERING, not safety — it just added friction. So now: any
+# command runs, with two guards kept:
+#   1. Privilege escalation is ALWAYS blocked (`sudo`/`su`/`doas`) — running the model's
+#      commands as root is the one footgun a run-enabled workspace shouldn't hand over.
+#   2. Commands run via argv (shlex.split + Popen, NO shell), so pipes/redirects/`&&`
+#      /backticks are literal args, never shell operations — the shell-injection guard.
+# The user can still tighten this from web Settings (passed through cfg, both default off):
+#   • runAllowlist — if non-empty, ONLY these runners are permitted (opt-in lockdown).
+#   • runDenylist  — extra runners to block on top of the always-blocked set.
+_WS_RUN_DENY_ALWAYS = {"sudo", "su", "doas"}  # privilege escalation — never runnable
+_WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
+_WS_RUN_DENYLIST = set()   # extra user blocks from cfg
 
 # ---- background servers (behavior-detected, command-agnostic) ----
 # run_command classifies a command by OBSERVED BEHAVIOR, never by its text: if the
@@ -2597,6 +2603,18 @@ def run_agent_chat(cfg):
         except Exception:  # noqa: BLE001
             continue
     _WS_AVAILABLE = bool(_WS_ROOTS)
+    # run_command policy overrides from Settings (both optional, default = allow all but
+    # sudo). Accept either a list or a comma/space-separated string; basenames so a user
+    # can write "git" and match "/usr/bin/git".
+    global _WS_RUN_ALLOWLIST, _WS_RUN_DENYLIST
+
+    def _split_cmds(v):
+        import re as _re
+        items = v if isinstance(v, (list, tuple)) else _re.split(r"[,\s]+", str(v or ""))
+        return {str(c).strip() for c in items if str(c).strip()}
+
+    _WS_RUN_ALLOWLIST = _split_cmds(cfg.get("runAllowlist"))
+    _WS_RUN_DENYLIST = _split_cmds(cfg.get("runDenylist"))
     # Active terminal workspace: the folder the `gonext` REPL was launched from (sent as
     # payload.activeWorkspace = the terminal's cwd). download_file / unzip_file put their
     # output HERE instead of the shared ~/.gonext/rag-work cache, so files land where the
@@ -2960,9 +2978,10 @@ def run_agent_chat(cfg):
         "left RUNNING (its window opens on the user's Mac); stop_server closes it. An "
         "interactive input() CLI can't be driven here (EOFError) — make it non-interactive "
         "or give the user the command.\n"
-        f"      ALLOWED runners (first word only): {', '.join(sorted(_WS_RUN_ALLOWED))}. "
-        "Anything else is rejected — do NOT retry a blocked command a different way. "
-        "For Python packages use `python3 -m pip install <pkg>` (bare `pip` is NOT allowed).\n"
+        "      Most commands run directly — build/test/package tools, git, docker, kubectl, "
+        "terraform, aws/gcloud/az, and so on. Two limits: `sudo`/`su` are blocked (no root); "
+        "and there is NO shell, so pipes `|`, redirects `>`, `&&`, and backticks do NOT work "
+        "— run one command per call, or use python3 for anything that needs composition.\n"
         "    - deploy_web(local_dir, host, user, remote_path, domain='') — DEPLOY a built "
         "static site in ONE call: build first (run_command('npm run build')), then "
         "deploy_web('my-app/build', host, user, remote_path, domain). It rsyncs over your "
@@ -4568,7 +4587,7 @@ def run_agent_chat(cfg):
             """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Also allows DEPLOY commands (ssh/scp/rsync) — use non-interactive KEY auth (-o BatchMode=yes); never put a password in the command (there is no stdin). Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
 
             Args:
-                command: the command line (allowlisted runners only; no shells or sudo).
+                command: the command line. Most commands run; no shell (so no pipes/redirects/&&), and sudo/su are blocked.
                 workdir: directory to run in. Empty = first registered workspace.
                 timeout_seconds: give up after this many seconds if the command neither exits nor starts a server (max 600).
             """
@@ -4610,9 +4629,24 @@ def run_agent_chat(cfg):
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
                     return msg
-                if argv[0] not in _WS_RUN_ALLOWED:
-                    msg = (f"Error: '{argv[0]}' is not an allowed runner. Allowed: "
-                           + ", ".join(sorted(_WS_RUN_ALLOWED)))
+                # Allow-by-default policy (see _WS_RUN_DENY_ALWAYS). Match on the runner's
+                # basename too, so `/usr/bin/sudo` can't slip past a bare-name block.
+                _runner = argv[0]
+                _rbase = os.path.basename(_runner)
+                if _runner in _WS_RUN_DENY_ALWAYS or _rbase in _WS_RUN_DENY_ALWAYS:
+                    msg = (f"Error: '{_runner}' is blocked (privilege escalation is never "
+                           "run by the agent). Run that step yourself, or tell the user the "
+                           "exact command to run.")
+                    _last_obs["text"] = msg
+                    return msg
+                if _WS_RUN_DENYLIST and (_runner in _WS_RUN_DENYLIST or _rbase in _WS_RUN_DENYLIST):
+                    msg = (f"Error: '{_runner}' is blocked by your run denylist "
+                           "(change it in web Settings → Agent).")
+                    _last_obs["text"] = msg
+                    return msg
+                if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
+                    msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
+                           "Settings → Agent, or clear the allowlist to allow all commands.")
                     _last_obs["text"] = msg
                     return msg
                 _emit({"type": "step", "text": f"Running → {command[:70]}"})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.225",
+  "version": "1.0.227",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",