@tiens.nguyen/gonext-local-worker 1.0.226 → 1.0.228

package/gonext-local-worker.mjs

@@ -1842,6 +1842,17 @@ async function runAgentChatJob(job) {
       // workspaces are registered. Passing a literal 5 here would look user-set and
       // block that bump.
       maxSteps: payload?.maxSteps ?? 0,
+      // run_command policy (web Settings → Agent). Both optional: empty = allow every
+      // command except the always-blocked sudo/su. runAllowlist (non-empty) = opt-in
+      // lockdown to exactly those runners; runDenylist = extra blocks. Accept whatever
+      // the API sends (list or comma/space string); python re-parses either shape.
+      runAllowlist: payload?.runAllowlist ?? [],
+      runDenylist: payload?.runDenylist ?? [],
+      // Interactive command-approval gate: the jobId lets python register a pending
+      // approval + poll for the user's Yes/No via the API; interactiveApproval is the
+      // REPL's "I can show a picker" signal (else python keeps hard-blocking, as on web).
+      jobId,
+      interactiveApproval: payload?.interactiveApproval === true,
       // Max web_search + fetch_url calls the agent may make per task (user-configurable
       // in web Settings → Agent). Default 10; past it the retrieval tools refuse.
       researchBudget: payload?.researchBudget ?? 10,

package/gonext-repl.mjs

@@ -298,6 +298,14 @@ function drawSlashHint(prefix, sel) {
 }
 if (process.stdin.isTTY) {
   process.stdin.on("keypress", (_ch, key) => {
+    // A command-approval picker is up → arrow keys move the highlight, Enter chooses.
+    if (approvalActive) {
+      onApprovalKey(key);
+      rl.line = "";
+      rl.cursor = 0;
+      rl.historyIndex = -1;
+      return;
+    }
     if (following) {
       rl.line = "";
       rl.cursor = 0;
@@ -604,6 +612,63 @@ let following = false;
 let followAborted = false;
 let currentJobId = null; // the running turn's jobId — so Ctrl+C can cancel it server-side
 let cancelRequested = false; // a cancel POST has been sent for the current turn
+// Interactive command-approval gate: while the agent is paused on a risky command, the
+// terminal shows a Yes/No list picker (↑/↓ + Enter, Yes preselected). approvalActive
+// routes keystrokes to the picker; approvalResolve settles the awaiting promise once.
+let approvalActive = false;
+let approvalSel = 0; // 0 = Yes (default highlighted), 1 = No
+let approvalResolve = null;
+function drawApprovalOptions(redraw) {
+  // Two option lines, redrawn in place. On redraw the cursor sits one row below "No";
+  // step up 2 rows, clear+rewrite both, landing back where we started.
+  const yes = approvalSel === 0 ? green("▸ Yes") : dim("  Yes");
+  const no = approvalSel === 1 ? green("▸ No") : dim("  No");
+  process.stdout.write((redraw ? "\x1b[2A" : "") + "\x1b[K" + yes + "\n\x1b[K" + no + "\n");
+}
+function finishApproval(allow) {
+  if (!approvalActive) return;
+  approvalActive = false;
+  // Settle the picker: overwrite the two option lines with a single result line.
+  process.stdout.write("\x1b[2A\x1b[J" + (allow ? green("  ▸ Yes — running it") : red("  ▸ No — skipped")) + "\n");
+  const r = approvalResolve;
+  approvalResolve = null;
+  if (r) r(!!allow);
+}
+function onApprovalKey(key) {
+  if (!key) return;
+  if (key.name === "up" || key.name === "down") {
+    approvalSel = key.name === "up" ? 0 : 1; // 2 options: up=Yes, down=No
+    drawApprovalOptions(true);
+  } else if (key.name === "return" || key.name === "enter") {
+    finishApproval(approvalSel === 0);
+  }
+  // Ctrl+C is delivered via readline "SIGINT" (onInterrupt), which also denies — see there.
+}
+// Show the picker and resolve to the user's choice. Non-TTY (piped) can't pick → deny
+// (safe). Auto-denies after ~170s so an absent user never hangs the turn (and stays
+// under the python side's 180s wait); Enter is instant since Yes is preselected.
+function approvalPrompt(command) {
+  return new Promise((resolve) => {
+    if (!process.stdin.isTTY) {
+      process.stdout.write(dim(`\n(approval needed for: ${command} — no interactive terminal, skipping)\n`));
+      resolve(false);
+      return;
+    }
+    process.stdout.write(
+      "\n" + yellow("⚠ Allow running this command?") + "\n" + dim("  " + command) + "\n"
+    );
+    approvalSel = 0;
+    approvalResolve = resolve;
+    approvalActive = true;
+    drawApprovalOptions(false);
+    const t = setTimeout(() => finishApproval(false), 170000);
+    const orig = resolve;
+    approvalResolve = (v) => {
+      clearTimeout(t);
+      orig(v);
+    };
+  });
+}
 // Per-session coding-model override chosen via /model (empty = use the account default).
 // Sent to /agent-ask as codingModelOverride; the API validates it against the whitelist.
 let sessionCodingModel = "";
@@ -647,6 +712,9 @@ async function runAgentTurn(history) {
     body: JSON.stringify({
       messages: history,
       cwd: resolve(process.cwd()),
+      // The terminal can show a Yes/No picker → the agent PAUSES on a risky command and
+      // asks instead of hard-blocking it (interactive command-approval gate).
+      interactiveApproval: true,
       ...(sessionCodingModel ? { codingModelOverride: sessionCodingModel } : {}),
     }),
   });
@@ -668,6 +736,7 @@ async function runAgentTurn(history) {
   cancelRequested = false;
   const startedAt = Date.now();
   let shownChars = 0;
+  let lastApprovalId = null; // the last command-approval request we've already answered
   let carry = ""; // trailing partial content line held until its newline arrives
   let statusShown = false; // a transient status line is currently on screen
   let warnedPending = false;
@@ -727,6 +796,7 @@ async function runAgentTurn(history) {
 
   const tick = () => {
     if (!following || followAborted || !jobRunning) return;
+    if (approvalActive) return; // a Yes/No picker owns the screen — don't draw over it
     if (Date.now() - lastContentAt < QUIET_MS) return; // tokens still flowing
     // A plain-reply answer streams onto a line with NO trailing newline until it's fully
     // done — overwriting the ticker there corrupts the visible answer mid-word. Stay
@@ -1030,6 +1100,26 @@ async function runAgentTurn(history) {
         consume(text.slice(shownChars));
         shownChars = text.length;
       }
+      // Interactive command-approval gate: the agent paused on a risky command. Show the
+      // Yes/No picker once per request id, POST the choice, then let the agent resume.
+      if (
+        job.pendingApproval &&
+        job.pendingApproval.id &&
+        job.pendingApproval.id !== lastApprovalId
+      ) {
+        lastApprovalId = job.pendingApproval.id;
+        clearStatus();
+        const allow = await approvalPrompt(job.pendingApproval.command || "");
+        try {
+          await fetch(`${apiBase}/api/worker/jobs/${jobId}/approval`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+            body: JSON.stringify({ id: lastApprovalId, allow }),
+          });
+        } catch {
+          // Best-effort — if the POST fails, the python side times out and treats as deny.
+        }
+      }
       if (job.jobStatus === "cancelled") {
         // User-requested stop (Ctrl+C) — a clean outcome, not an error. The worker has
         // killed the Python agent. Print a quiet note and return an empty, non-persisted
@@ -1102,6 +1192,9 @@ async function main() {
   // the OS delivers a real SIGINT to the process. Attach the same handler to both —
   // only one can ever fire for a given mode, so there's no double-handling.
   const onInterrupt = () => {
+    // Ctrl+C while the approval picker is up = decline it (and fall through to also
+    // cancel the turn) — otherwise the poll loop stays blocked awaiting a choice.
+    if (approvalActive) finishApproval(false);
     if (following) {
       if (!cancelRequested && currentJobId) {
         // First Ctrl+C: actually CANCEL the running turn server-side (stop the model),

package/gonext_agent_chat.py

@@ -2209,17 +2209,102 @@ def _ws_record_change(action: str, path: str, backup) -> None:
 # the model on productive paths (build/test/deploy), not to contain a hostile one.
 # Still excluded on purpose: bare shells, package publishes, sudo, and bare `pip`
 # (the model must use `python3 -m pip`, which pip itself recommends).
-_WS_RUN_ALLOWED = {
-    "npm", "npx", "yarn", "pnpm", "node", "mvn", "./mvnw", "gradle", "./gradlew",
-    "pytest", "python", "python3", "go", "cargo", "make", "dotnet", "swift",
-    "rspec", "bundle", "php", "composer", "tsc", "jest", "vitest",
-    # Deployment (task #57): transfer files + run remote commands. Auth uses the user's
-    # own SSH key/agent (SSH_AUTH_SOCK passes through _ws_scrubbed_env); the model is
-    # told to use non-interactive KEY auth (BatchMode) and NEVER hardcode passwords (a
-    # stdin password prompt EOFErrors here). No `sftp`: it's interactive by default
-    # (would hang → timeout kill); scp/rsync cover the same ground batch-safely.
-    "ssh", "scp", "rsync",
-}
+# run_command execution policy — ALLOW-BY-DEFAULT.
+# We used to gate on a fixed allowlist (npm/python/go/…). It rejected legitimate DevOps
+# tooling (docker, kubectl, terraform, aws, gh, …) and, because that universe is unbounded
+# and grows constantly, any list was a hardcode that upset the next user. Crucially, the
+# gate was never a SANDBOX: `python3`/`node` are runnable and can subprocess anything, so a
+# restrictive allowlist bought STEERING, not safety — it just added friction. So now: any
+# command runs, with two guards kept:
+#   1. Privilege escalation is ALWAYS blocked (`sudo`/`su`/`doas`) — running the model's
+#      commands as root is the one footgun a run-enabled workspace shouldn't hand over.
+#   2. Commands run via argv (shlex.split + Popen, NO shell), so pipes/redirects/`&&`
+#      /backticks are literal args, never shell operations — the shell-injection guard.
+# The user can still tighten this from web Settings (passed through cfg, both default off):
+#   • runAllowlist — if non-empty, ONLY these runners are permitted (opt-in lockdown).
+#   • runDenylist  — extra runners to block on top of the always-blocked set.
+_WS_RUN_DENY_ALWAYS = {"sudo", "su", "doas"}  # privilege escalation — never runnable
+_WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
+_WS_RUN_DENYLIST = set()   # extra user blocks from cfg
+
+# Privilege escalation, scanned on the RAW command (not just argv[0]) so it also catches
+# `bash -c "sudo …"` / `env sudo …` — the naive shell-wrap bypass a model reaches for.
+_WS_PRIV_RE = re.compile(r"\b(sudo|doas|su)\b", re.IGNORECASE)
+# Destructive: mass delete, disk wipe, or power-off. Allowed by default (allow-by-default
+# policy) but worth a confirmation when we CAN ask the user (interactive terminal).
+_WS_DESTRUCTIVE_RE = re.compile(
+    r"(^|[\s;&|])rm\b[^|;&\n]*\s-[a-z]*[rf]"          # rm with -r / -f (any order)
+    r"|(^|[\s;&|])(dd|shred|wipefs|mkfs(\.\w+)?)\b"   # disk destroyers
+    r"|(^|[\s;&|])(shutdown|reboot|halt|poweroff)\b", # power
+    re.IGNORECASE,
+)
+
+
+def _ws_command_risk(command, argv, denyset):
+    """Classify a command for the run policy. Returns (hard_reason, ask_reason), either
+    None when N/A:
+    - hard_reason: block outright when we CAN'T ask (web / non-interactive) — privilege
+      escalation or a user-denylisted runner.
+    - ask_reason: prompt the user when we CAN (interactive terminal) — the above PLUS
+      destructive filesystem/power commands (which are otherwise allowed by default)."""
+    import os as _os
+    cmd = command or ""
+    runner = argv[0] if argv else ""
+    rbase = _os.path.basename(runner)
+    if _WS_PRIV_RE.search(cmd):
+        r = "privilege escalation (sudo/su)"
+        return (r, r)
+    if denyset and (runner in denyset or rbase in denyset):
+        r = f"'{runner}' is on your blocked-commands list"
+        return (r, r)
+    if _WS_DESTRUCTIVE_RE.search(cmd):
+        return (None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None)
+
+
+def _ws_request_approval(api_base, worker_key, job_id, command, reason):
+    """Pause and ask the user (via the terminal REPL's Yes/No picker) to allow a risky
+    command. Registers a pending approval on the job through the API, then polls the job
+    for the user's decision. Returns True (allow) or False (deny / timeout / cancelled).
+    Mirrors _pdf_upload_via_api's worker-key auth — no new creds on the worker."""
+    import urllib.request as _u
+    import uuid as _uuid
+    import time as _t
+    base = (api_base or "").rstrip("/")
+    if not base or not worker_key or not job_id:
+        return False
+    rid = _uuid.uuid4().hex[:12]
+    ctx = _ssl_context()
+    try:
+        req = _u.Request(
+            f"{base}/api/worker/jobs/{job_id}/approval-request",
+            data=json.dumps({"id": rid, "command": command}).encode("utf-8"),
+            headers={"Content-Type": "application/json", "X-Worker-Key": worker_key},
+            method="POST",
+        )
+        with _u.urlopen(req, timeout=20, context=ctx) as resp:
+            resp.read()
+    except Exception as e:  # noqa: BLE001
+        _log(f"approval-request failed: {e} — treating as deny")
+        return False
+    _emit({"type": "step", "text": f"Awaiting your approval to run: {command[:70]}"})
+    deadline = _t.time() + 180  # 3 min; absent user → deny (never auto-run something risky)
+    while _t.time() < deadline:
+        _t.sleep(1.2)
+        try:
+            g = _u.Request(f"{base}/api/worker/jobs/{job_id}",
+                           headers={"X-Worker-Key": worker_key}, method="GET")
+            with _u.urlopen(g, timeout=15, context=ctx) as resp:
+                data = json.loads(resp.read().decode("utf-8"))
+        except Exception as e:  # noqa: BLE001
+            _log(f"approval poll error: {e}")
+            continue
+        if data.get("jobStatus") in ("cancelled", "failed", "completed"):
+            return False  # Ctrl+C or the job ended → treat as declined
+        dec = data.get("approvalDecision") or {}
+        if dec.get("id") == rid:
+            return bool(dec.get("allow"))
+    return False
 
 # ---- background servers (behavior-detected, command-agnostic) ----
 # run_command classifies a command by OBSERVED BEHAVIOR, never by its text: if the
@@ -2408,6 +2493,11 @@ def run_agent_chat(cfg):
     # For the create_pdf tool: API base + worker key to request a presigned S3 upload.
     pdf_api_base = (cfg.get("apiBaseURL") or "").strip()
     pdf_worker_key = (cfg.get("workerKey") or "").strip()
+    # Interactive command-approval gate: this job's id + whether the client (terminal
+    # REPL) can show a Yes/No picker. When both are present, run_command PAUSES on a
+    # risky command and asks the user via the API instead of hard-blocking it.
+    _job_id = (cfg.get("jobId") or "").strip()
+    _interactive_approval = bool(cfg.get("interactiveApproval"))
     # Optional dedicated coding/reasoning model for the CodeAgent's tool-use loop.
     # Routing, plain replies and summarization stay on the chat model (better at
     # natural language); the code model only drives http_request reasoning.
@@ -2597,6 +2687,18 @@ def run_agent_chat(cfg):
         except Exception:  # noqa: BLE001
             continue
     _WS_AVAILABLE = bool(_WS_ROOTS)
+    # run_command policy overrides from Settings (both optional, default = allow all but
+    # sudo). Accept either a list or a comma/space-separated string; basenames so a user
+    # can write "git" and match "/usr/bin/git".
+    global _WS_RUN_ALLOWLIST, _WS_RUN_DENYLIST
+
+    def _split_cmds(v):
+        import re as _re
+        items = v if isinstance(v, (list, tuple)) else _re.split(r"[,\s]+", str(v or ""))
+        return {str(c).strip() for c in items if str(c).strip()}
+
+    _WS_RUN_ALLOWLIST = _split_cmds(cfg.get("runAllowlist"))
+    _WS_RUN_DENYLIST = _split_cmds(cfg.get("runDenylist"))
     # Active terminal workspace: the folder the `gonext` REPL was launched from (sent as
     # payload.activeWorkspace = the terminal's cwd). download_file / unzip_file put their
     # output HERE instead of the shared ~/.gonext/rag-work cache, so files land where the
@@ -2960,9 +3062,10 @@ def run_agent_chat(cfg):
         "left RUNNING (its window opens on the user's Mac); stop_server closes it. An "
         "interactive input() CLI can't be driven here (EOFError) — make it non-interactive "
         "or give the user the command.\n"
-        f"      ALLOWED runners (first word only): {', '.join(sorted(_WS_RUN_ALLOWED))}. "
-        "Anything else is rejected — do NOT retry a blocked command a different way. "
-        "For Python packages use `python3 -m pip install <pkg>` (bare `pip` is NOT allowed).\n"
+        "      Most commands run directly — build/test/package tools, git, docker, kubectl, "
+        "terraform, aws/gcloud/az, and so on. Two limits: `sudo`/`su` are blocked (no root); "
+        "and there is NO shell, so pipes `|`, redirects `>`, `&&`, and backticks do NOT work "
+        "— run one command per call, or use python3 for anything that needs composition.\n"
         "    - deploy_web(local_dir, host, user, remote_path, domain='') — DEPLOY a built "
         "static site in ONE call: build first (run_command('npm run build')), then "
         "deploy_web('my-app/build', host, user, remote_path, domain). It rsyncs over your "
@@ -4568,7 +4671,7 @@ def run_agent_chat(cfg):
             """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Also allows DEPLOY commands (ssh/scp/rsync) — use non-interactive KEY auth (-o BatchMode=yes); never put a password in the command (there is no stdin). Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
 
             Args:
-                command: the command line (allowlisted runners only; no shells or sudo).
+                command: the command line. Most commands run; no shell (so no pipes/redirects/&&), and sudo/su are blocked.
                 workdir: directory to run in. Empty = first registered workspace.
                 timeout_seconds: give up after this many seconds if the command neither exits nor starts a server (max 600).
             """
@@ -4610,11 +4713,36 @@ def run_agent_chat(cfg):
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
                     return msg
-                if argv[0] not in _WS_RUN_ALLOWED:
-                    msg = (f"Error: '{argv[0]}' is not an allowed runner. Allowed: "
-                           + ", ".join(sorted(_WS_RUN_ALLOWED)))
+                # Allow-by-default policy. Match on the runner's basename too, so
+                # `/usr/bin/<x>` can't slip past a bare-name rule.
+                _runner = argv[0]
+                _rbase = os.path.basename(_runner)
+                # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
+                if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
+                    msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
+                           "Settings → Agent, or clear the allowlist to allow all commands.")
                     _last_obs["text"] = msg
                     return msg
+                # Risk gate: privilege escalation / denylisted / destructive. When the
+                # client can approve interactively (terminal), PAUSE and ask the user;
+                # otherwise (web) keep hard-blocking the privilege/denylist cases.
+                _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST)
+                if _ask_reason:
+                    if _interactive_approval and _job_id and pdf_api_base and pdf_worker_key:
+                        if not _ws_request_approval(pdf_api_base, pdf_worker_key,
+                                                    _job_id, command, _ask_reason):
+                            msg = (f"Error: the user declined to run '{command[:80]}' "
+                                   f"({_ask_reason}). Do NOT retry it — choose another "
+                                   "approach or ask the user what to do.")
+                            _last_obs["text"] = msg
+                            return msg
+                        # approved → fall through and run it
+                    elif _hard_reason:
+                        msg = (f"Error: '{command[:80]}' is blocked ({_hard_reason}). Run "
+                               "that step yourself, or tell the user the exact command.")
+                        _last_obs["text"] = msg
+                        return msg
+                    # else: destructive but non-interactive → allowed by default (unchanged)
                 _emit({"type": "step", "text": f"Running → {command[:70]}"})
                 t = max(5, min(int(timeout_seconds or 180), 600))
                 # Own process group (start_new_session) + output to a log file. This is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.226",
+  "version": "1.0.228",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",