@tiens.nguyen/gonext-local-worker 1.0.226 → 1.0.227

package/gonext-local-worker.mjs

@@ -1842,6 +1842,12 @@ async function runAgentChatJob(job) {
       // workspaces are registered. Passing a literal 5 here would look user-set and
       // block that bump.
       maxSteps: payload?.maxSteps ?? 0,
+      // run_command policy (web Settings → Agent). Both optional: empty = allow every
+      // command except the always-blocked sudo/su. runAllowlist (non-empty) = opt-in
+      // lockdown to exactly those runners; runDenylist = extra blocks. Accept whatever
+      // the API sends (list or comma/space string); python re-parses either shape.
+      runAllowlist: payload?.runAllowlist ?? [],
+      runDenylist: payload?.runDenylist ?? [],
       // Max web_search + fetch_url calls the agent may make per task (user-configurable
       // in web Settings → Agent). Default 10; past it the retrieval tools refuse.
       researchBudget: payload?.researchBudget ?? 10,

package/gonext_agent_chat.py

@@ -2209,17 +2209,23 @@ def _ws_record_change(action: str, path: str, backup) -> None:
 # the model on productive paths (build/test/deploy), not to contain a hostile one.
 # Still excluded on purpose: bare shells, package publishes, sudo, and bare `pip`
 # (the model must use `python3 -m pip`, which pip itself recommends).
-_WS_RUN_ALLOWED = {
-    "npm", "npx", "yarn", "pnpm", "node", "mvn", "./mvnw", "gradle", "./gradlew",
-    "pytest", "python", "python3", "go", "cargo", "make", "dotnet", "swift",
-    "rspec", "bundle", "php", "composer", "tsc", "jest", "vitest",
-    # Deployment (task #57): transfer files + run remote commands. Auth uses the user's
-    # own SSH key/agent (SSH_AUTH_SOCK passes through _ws_scrubbed_env); the model is
-    # told to use non-interactive KEY auth (BatchMode) and NEVER hardcode passwords (a
-    # stdin password prompt EOFErrors here). No `sftp`: it's interactive by default
-    # (would hang → timeout kill); scp/rsync cover the same ground batch-safely.
-    "ssh", "scp", "rsync",
-}
+# run_command execution policy — ALLOW-BY-DEFAULT.
+# We used to gate on a fixed allowlist (npm/python/go/…). It rejected legitimate DevOps
+# tooling (docker, kubectl, terraform, aws, gh, …) and, because that universe is unbounded
+# and grows constantly, any list was a hardcode that upset the next user. Crucially, the
+# gate was never a SANDBOX: `python3`/`node` are runnable and can subprocess anything, so a
+# restrictive allowlist bought STEERING, not safety — it just added friction. So now: any
+# command runs, with two guards kept:
+#   1. Privilege escalation is ALWAYS blocked (`sudo`/`su`/`doas`) — running the model's
+#      commands as root is the one footgun a run-enabled workspace shouldn't hand over.
+#   2. Commands run via argv (shlex.split + Popen, NO shell), so pipes/redirects/`&&`
+#      /backticks are literal args, never shell operations — the shell-injection guard.
+# The user can still tighten this from web Settings (passed through cfg, both default off):
+#   • runAllowlist — if non-empty, ONLY these runners are permitted (opt-in lockdown).
+#   • runDenylist  — extra runners to block on top of the always-blocked set.
+_WS_RUN_DENY_ALWAYS = {"sudo", "su", "doas"}  # privilege escalation — never runnable
+_WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
+_WS_RUN_DENYLIST = set()   # extra user blocks from cfg
 
 # ---- background servers (behavior-detected, command-agnostic) ----
 # run_command classifies a command by OBSERVED BEHAVIOR, never by its text: if the
@@ -2597,6 +2603,18 @@ def run_agent_chat(cfg):
         except Exception:  # noqa: BLE001
             continue
     _WS_AVAILABLE = bool(_WS_ROOTS)
+    # run_command policy overrides from Settings (both optional, default = allow all but
+    # sudo). Accept either a list or a comma/space-separated string; basenames so a user
+    # can write "git" and match "/usr/bin/git".
+    global _WS_RUN_ALLOWLIST, _WS_RUN_DENYLIST
+
+    def _split_cmds(v):
+        import re as _re
+        items = v if isinstance(v, (list, tuple)) else _re.split(r"[,\s]+", str(v or ""))
+        return {str(c).strip() for c in items if str(c).strip()}
+
+    _WS_RUN_ALLOWLIST = _split_cmds(cfg.get("runAllowlist"))
+    _WS_RUN_DENYLIST = _split_cmds(cfg.get("runDenylist"))
     # Active terminal workspace: the folder the `gonext` REPL was launched from (sent as
     # payload.activeWorkspace = the terminal's cwd). download_file / unzip_file put their
     # output HERE instead of the shared ~/.gonext/rag-work cache, so files land where the
@@ -2960,9 +2978,10 @@ def run_agent_chat(cfg):
         "left RUNNING (its window opens on the user's Mac); stop_server closes it. An "
         "interactive input() CLI can't be driven here (EOFError) — make it non-interactive "
         "or give the user the command.\n"
-        f"      ALLOWED runners (first word only): {', '.join(sorted(_WS_RUN_ALLOWED))}. "
-        "Anything else is rejected — do NOT retry a blocked command a different way. "
-        "For Python packages use `python3 -m pip install <pkg>` (bare `pip` is NOT allowed).\n"
+        "      Most commands run directly — build/test/package tools, git, docker, kubectl, "
+        "terraform, aws/gcloud/az, and so on. Two limits: `sudo`/`su` are blocked (no root); "
+        "and there is NO shell, so pipes `|`, redirects `>`, `&&`, and backticks do NOT work "
+        "— run one command per call, or use python3 for anything that needs composition.\n"
         "    - deploy_web(local_dir, host, user, remote_path, domain='') — DEPLOY a built "
         "static site in ONE call: build first (run_command('npm run build')), then "
         "deploy_web('my-app/build', host, user, remote_path, domain). It rsyncs over your "
@@ -4568,7 +4587,7 @@ def run_agent_chat(cfg):
             """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Also allows DEPLOY commands (ssh/scp/rsync) — use non-interactive KEY auth (-o BatchMode=yes); never put a password in the command (there is no stdin). Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
 
             Args:
-                command: the command line (allowlisted runners only; no shells or sudo).
+                command: the command line. Most commands run; no shell (so no pipes/redirects/&&), and sudo/su are blocked.
                 workdir: directory to run in. Empty = first registered workspace.
                 timeout_seconds: give up after this many seconds if the command neither exits nor starts a server (max 600).
             """
@@ -4610,9 +4629,24 @@ def run_agent_chat(cfg):
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
                     return msg
-                if argv[0] not in _WS_RUN_ALLOWED:
-                    msg = (f"Error: '{argv[0]}' is not an allowed runner. Allowed: "
-                           + ", ".join(sorted(_WS_RUN_ALLOWED)))
+                # Allow-by-default policy (see _WS_RUN_DENY_ALWAYS). Match on the runner's
+                # basename too, so `/usr/bin/sudo` can't slip past a bare-name block.
+                _runner = argv[0]
+                _rbase = os.path.basename(_runner)
+                if _runner in _WS_RUN_DENY_ALWAYS or _rbase in _WS_RUN_DENY_ALWAYS:
+                    msg = (f"Error: '{_runner}' is blocked (privilege escalation is never "
+                           "run by the agent). Run that step yourself, or tell the user the "
+                           "exact command to run.")
+                    _last_obs["text"] = msg
+                    return msg
+                if _WS_RUN_DENYLIST and (_runner in _WS_RUN_DENYLIST or _rbase in _WS_RUN_DENYLIST):
+                    msg = (f"Error: '{_runner}' is blocked by your run denylist "
+                           "(change it in web Settings → Agent).")
+                    _last_obs["text"] = msg
+                    return msg
+                if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
+                    msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
+                           "Settings → Agent, or clear the allowlist to allow all commands.")
                     _last_obs["text"] = msg
                     return msg
                 _emit({"type": "step", "text": f"Running → {command[:70]}"})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.226",
+  "version": "1.0.227",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",