@tiens.nguyen/gonext-local-worker 1.0.227 → 1.0.228

package/gonext-local-worker.mjs

@@ -1848,6 +1848,11 @@ async function runAgentChatJob(job) {
       // the API sends (list or comma/space string); python re-parses either shape.
       runAllowlist: payload?.runAllowlist ?? [],
       runDenylist: payload?.runDenylist ?? [],
+      // Interactive command-approval gate: the jobId lets python register a pending
+      // approval + poll for the user's Yes/No via the API; interactiveApproval is the
+      // REPL's "I can show a picker" signal (else python keeps hard-blocking, as on web).
+      jobId,
+      interactiveApproval: payload?.interactiveApproval === true,
       // Max web_search + fetch_url calls the agent may make per task (user-configurable
       // in web Settings → Agent). Default 10; past it the retrieval tools refuse.
       researchBudget: payload?.researchBudget ?? 10,

package/gonext-repl.mjs

@@ -298,6 +298,14 @@ function drawSlashHint(prefix, sel) {
 }
 if (process.stdin.isTTY) {
   process.stdin.on("keypress", (_ch, key) => {
+    // A command-approval picker is up → arrow keys move the highlight, Enter chooses.
+    if (approvalActive) {
+      onApprovalKey(key);
+      rl.line = "";
+      rl.cursor = 0;
+      rl.historyIndex = -1;
+      return;
+    }
     if (following) {
       rl.line = "";
       rl.cursor = 0;
@@ -604,6 +612,63 @@ let following = false;
 let followAborted = false;
 let currentJobId = null; // the running turn's jobId — so Ctrl+C can cancel it server-side
 let cancelRequested = false; // a cancel POST has been sent for the current turn
+// Interactive command-approval gate: while the agent is paused on a risky command, the
+// terminal shows a Yes/No list picker (↑/↓ + Enter, Yes preselected). approvalActive
+// routes keystrokes to the picker; approvalResolve settles the awaiting promise once.
+let approvalActive = false;
+let approvalSel = 0; // 0 = Yes (default highlighted), 1 = No
+let approvalResolve = null;
+function drawApprovalOptions(redraw) {
+  // Two option lines, redrawn in place. On redraw the cursor sits one row below "No";
+  // step up 2 rows, clear+rewrite both, landing back where we started.
+  const yes = approvalSel === 0 ? green("▸ Yes") : dim("  Yes");
+  const no = approvalSel === 1 ? green("▸ No") : dim("  No");
+  process.stdout.write((redraw ? "\x1b[2A" : "") + "\x1b[K" + yes + "\n\x1b[K" + no + "\n");
+}
+function finishApproval(allow) {
+  if (!approvalActive) return;
+  approvalActive = false;
+  // Settle the picker: overwrite the two option lines with a single result line.
+  process.stdout.write("\x1b[2A\x1b[J" + (allow ? green("  ▸ Yes — running it") : red("  ▸ No — skipped")) + "\n");
+  const r = approvalResolve;
+  approvalResolve = null;
+  if (r) r(!!allow);
+}
+function onApprovalKey(key) {
+  if (!key) return;
+  if (key.name === "up" || key.name === "down") {
+    approvalSel = key.name === "up" ? 0 : 1; // 2 options: up=Yes, down=No
+    drawApprovalOptions(true);
+  } else if (key.name === "return" || key.name === "enter") {
+    finishApproval(approvalSel === 0);
+  }
+  // Ctrl+C is delivered via readline "SIGINT" (onInterrupt), which also denies — see there.
+}
+// Show the picker and resolve to the user's choice. Non-TTY (piped) can't pick → deny
+// (safe). Auto-denies after ~170s so an absent user never hangs the turn (and stays
+// under the python side's 180s wait); Enter is instant since Yes is preselected.
+function approvalPrompt(command) {
+  return new Promise((resolve) => {
+    if (!process.stdin.isTTY) {
+      process.stdout.write(dim(`\n(approval needed for: ${command} — no interactive terminal, skipping)\n`));
+      resolve(false);
+      return;
+    }
+    process.stdout.write(
+      "\n" + yellow("⚠ Allow running this command?") + "\n" + dim("  " + command) + "\n"
+    );
+    approvalSel = 0;
+    approvalResolve = resolve;
+    approvalActive = true;
+    drawApprovalOptions(false);
+    const t = setTimeout(() => finishApproval(false), 170000);
+    const orig = resolve;
+    approvalResolve = (v) => {
+      clearTimeout(t);
+      orig(v);
+    };
+  });
+}
 // Per-session coding-model override chosen via /model (empty = use the account default).
 // Sent to /agent-ask as codingModelOverride; the API validates it against the whitelist.
 let sessionCodingModel = "";
@@ -647,6 +712,9 @@ async function runAgentTurn(history) {
     body: JSON.stringify({
       messages: history,
       cwd: resolve(process.cwd()),
+      // The terminal can show a Yes/No picker → the agent PAUSES on a risky command and
+      // asks instead of hard-blocking it (interactive command-approval gate).
+      interactiveApproval: true,
       ...(sessionCodingModel ? { codingModelOverride: sessionCodingModel } : {}),
     }),
   });
@@ -668,6 +736,7 @@ async function runAgentTurn(history) {
   cancelRequested = false;
   const startedAt = Date.now();
   let shownChars = 0;
+  let lastApprovalId = null; // the last command-approval request we've already answered
   let carry = ""; // trailing partial content line held until its newline arrives
   let statusShown = false; // a transient status line is currently on screen
   let warnedPending = false;
@@ -727,6 +796,7 @@ async function runAgentTurn(history) {
 
   const tick = () => {
     if (!following || followAborted || !jobRunning) return;
+    if (approvalActive) return; // a Yes/No picker owns the screen — don't draw over it
     if (Date.now() - lastContentAt < QUIET_MS) return; // tokens still flowing
     // A plain-reply answer streams onto a line with NO trailing newline until it's fully
     // done — overwriting the ticker there corrupts the visible answer mid-word. Stay
@@ -1030,6 +1100,26 @@ async function runAgentTurn(history) {
         consume(text.slice(shownChars));
         shownChars = text.length;
       }
+      // Interactive command-approval gate: the agent paused on a risky command. Show the
+      // Yes/No picker once per request id, POST the choice, then let the agent resume.
+      if (
+        job.pendingApproval &&
+        job.pendingApproval.id &&
+        job.pendingApproval.id !== lastApprovalId
+      ) {
+        lastApprovalId = job.pendingApproval.id;
+        clearStatus();
+        const allow = await approvalPrompt(job.pendingApproval.command || "");
+        try {
+          await fetch(`${apiBase}/api/worker/jobs/${jobId}/approval`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+            body: JSON.stringify({ id: lastApprovalId, allow }),
+          });
+        } catch {
+          // Best-effort — if the POST fails, the python side times out and treats as deny.
+        }
+      }
       if (job.jobStatus === "cancelled") {
         // User-requested stop (Ctrl+C) — a clean outcome, not an error. The worker has
         // killed the Python agent. Print a quiet note and return an empty, non-persisted
@@ -1102,6 +1192,9 @@ async function main() {
   // the OS delivers a real SIGINT to the process. Attach the same handler to both —
   // only one can ever fire for a given mode, so there's no double-handling.
   const onInterrupt = () => {
+    // Ctrl+C while the approval picker is up = decline it (and fall through to also
+    // cancel the turn) — otherwise the poll loop stays blocked awaiting a choice.
+    if (approvalActive) finishApproval(false);
     if (following) {
       if (!cancelRequested && currentJobId) {
         // First Ctrl+C: actually CANCEL the running turn server-side (stop the model),

package/gonext_agent_chat.py

@@ -2227,6 +2227,85 @@ _WS_RUN_DENY_ALWAYS = {"sudo", "su", "doas"}  # privilege escalation — never r
 _WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
 _WS_RUN_DENYLIST = set()   # extra user blocks from cfg
 
+# Privilege escalation, scanned on the RAW command (not just argv[0]) so it also catches
+# `bash -c "sudo …"` / `env sudo …` — the naive shell-wrap bypass a model reaches for.
+_WS_PRIV_RE = re.compile(r"\b(sudo|doas|su)\b", re.IGNORECASE)
+# Destructive: mass delete, disk wipe, or power-off. Allowed by default (allow-by-default
+# policy) but worth a confirmation when we CAN ask the user (interactive terminal).
+_WS_DESTRUCTIVE_RE = re.compile(
+    r"(^|[\s;&|])rm\b[^|;&\n]*\s-[a-z]*[rf]"          # rm with -r / -f (any order)
+    r"|(^|[\s;&|])(dd|shred|wipefs|mkfs(\.\w+)?)\b"   # disk destroyers
+    r"|(^|[\s;&|])(shutdown|reboot|halt|poweroff)\b", # power
+    re.IGNORECASE,
+)
+
+
+def _ws_command_risk(command, argv, denyset):
+    """Classify a command for the run policy. Returns (hard_reason, ask_reason), either
+    None when N/A:
+    - hard_reason: block outright when we CAN'T ask (web / non-interactive) — privilege
+      escalation or a user-denylisted runner.
+    - ask_reason: prompt the user when we CAN (interactive terminal) — the above PLUS
+      destructive filesystem/power commands (which are otherwise allowed by default)."""
+    import os as _os
+    cmd = command or ""
+    runner = argv[0] if argv else ""
+    rbase = _os.path.basename(runner)
+    if _WS_PRIV_RE.search(cmd):
+        r = "privilege escalation (sudo/su)"
+        return (r, r)
+    if denyset and (runner in denyset or rbase in denyset):
+        r = f"'{runner}' is on your blocked-commands list"
+        return (r, r)
+    if _WS_DESTRUCTIVE_RE.search(cmd):
+        return (None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None)
+
+
+def _ws_request_approval(api_base, worker_key, job_id, command, reason):
+    """Pause and ask the user (via the terminal REPL's Yes/No picker) to allow a risky
+    command. Registers a pending approval on the job through the API, then polls the job
+    for the user's decision. Returns True (allow) or False (deny / timeout / cancelled).
+    Mirrors _pdf_upload_via_api's worker-key auth — no new creds on the worker."""
+    import urllib.request as _u
+    import uuid as _uuid
+    import time as _t
+    base = (api_base or "").rstrip("/")
+    if not base or not worker_key or not job_id:
+        return False
+    rid = _uuid.uuid4().hex[:12]
+    ctx = _ssl_context()
+    try:
+        req = _u.Request(
+            f"{base}/api/worker/jobs/{job_id}/approval-request",
+            data=json.dumps({"id": rid, "command": command}).encode("utf-8"),
+            headers={"Content-Type": "application/json", "X-Worker-Key": worker_key},
+            method="POST",
+        )
+        with _u.urlopen(req, timeout=20, context=ctx) as resp:
+            resp.read()
+    except Exception as e:  # noqa: BLE001
+        _log(f"approval-request failed: {e} — treating as deny")
+        return False
+    _emit({"type": "step", "text": f"Awaiting your approval to run: {command[:70]}"})
+    deadline = _t.time() + 180  # 3 min; absent user → deny (never auto-run something risky)
+    while _t.time() < deadline:
+        _t.sleep(1.2)
+        try:
+            g = _u.Request(f"{base}/api/worker/jobs/{job_id}",
+                           headers={"X-Worker-Key": worker_key}, method="GET")
+            with _u.urlopen(g, timeout=15, context=ctx) as resp:
+                data = json.loads(resp.read().decode("utf-8"))
+        except Exception as e:  # noqa: BLE001
+            _log(f"approval poll error: {e}")
+            continue
+        if data.get("jobStatus") in ("cancelled", "failed", "completed"):
+            return False  # Ctrl+C or the job ended → treat as declined
+        dec = data.get("approvalDecision") or {}
+        if dec.get("id") == rid:
+            return bool(dec.get("allow"))
+    return False
+
 # ---- background servers (behavior-detected, command-agnostic) ----
 # run_command classifies a command by OBSERVED BEHAVIOR, never by its text: if the
 # process keeps running AND starts LISTENing on a TCP port, it IS a server — npm start,
@@ -2414,6 +2493,11 @@ def run_agent_chat(cfg):
     # For the create_pdf tool: API base + worker key to request a presigned S3 upload.
     pdf_api_base = (cfg.get("apiBaseURL") or "").strip()
     pdf_worker_key = (cfg.get("workerKey") or "").strip()
+    # Interactive command-approval gate: this job's id + whether the client (terminal
+    # REPL) can show a Yes/No picker. When both are present, run_command PAUSES on a
+    # risky command and asks the user via the API instead of hard-blocking it.
+    _job_id = (cfg.get("jobId") or "").strip()
+    _interactive_approval = bool(cfg.get("interactiveApproval"))
     # Optional dedicated coding/reasoning model for the CodeAgent's tool-use loop.
     # Routing, plain replies and summarization stay on the chat model (better at
     # natural language); the code model only drives http_request reasoning.
@@ -4629,26 +4713,36 @@ def run_agent_chat(cfg):
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
                     return msg
-                # Allow-by-default policy (see _WS_RUN_DENY_ALWAYS). Match on the runner's
-                # basename too, so `/usr/bin/sudo` can't slip past a bare-name block.
+                # Allow-by-default policy. Match on the runner's basename too, so
+                # `/usr/bin/<x>` can't slip past a bare-name rule.
                 _runner = argv[0]
                 _rbase = os.path.basename(_runner)
-                if _runner in _WS_RUN_DENY_ALWAYS or _rbase in _WS_RUN_DENY_ALWAYS:
-                    msg = (f"Error: '{_runner}' is blocked (privilege escalation is never "
-                           "run by the agent). Run that step yourself, or tell the user the "
-                           "exact command to run.")
-                    _last_obs["text"] = msg
-                    return msg
-                if _WS_RUN_DENYLIST and (_runner in _WS_RUN_DENYLIST or _rbase in _WS_RUN_DENYLIST):
-                    msg = (f"Error: '{_runner}' is blocked by your run denylist "
-                           "(change it in web Settings → Agent).")
-                    _last_obs["text"] = msg
-                    return msg
+                # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
                 if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
                     msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
                            "Settings → Agent, or clear the allowlist to allow all commands.")
                     _last_obs["text"] = msg
                     return msg
+                # Risk gate: privilege escalation / denylisted / destructive. When the
+                # client can approve interactively (terminal), PAUSE and ask the user;
+                # otherwise (web) keep hard-blocking the privilege/denylist cases.
+                _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST)
+                if _ask_reason:
+                    if _interactive_approval and _job_id and pdf_api_base and pdf_worker_key:
+                        if not _ws_request_approval(pdf_api_base, pdf_worker_key,
+                                                    _job_id, command, _ask_reason):
+                            msg = (f"Error: the user declined to run '{command[:80]}' "
+                                   f"({_ask_reason}). Do NOT retry it — choose another "
+                                   "approach or ask the user what to do.")
+                            _last_obs["text"] = msg
+                            return msg
+                        # approved → fall through and run it
+                    elif _hard_reason:
+                        msg = (f"Error: '{command[:80]}' is blocked ({_hard_reason}). Run "
+                               "that step yourself, or tell the user the exact command.")
+                        _last_obs["text"] = msg
+                        return msg
+                    # else: destructive but non-interactive → allowed by default (unchanged)
                 _emit({"type": "step", "text": f"Running → {command[:70]}"})
                 t = max(5, min(int(timeout_seconds or 180), 600))
                 # Own process group (start_new_session) + output to a log file. This is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.227",
+  "version": "1.0.228",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",