@tiens.nguyen/gonext-local-worker 1.0.227 → 1.0.229

package/gonext-local-worker.mjs

@@ -1848,6 +1848,15 @@ async function runAgentChatJob(job) {
       // the API sends (list or comma/space string); python re-parses either shape.
       runAllowlist: payload?.runAllowlist ?? [],
       runDenylist: payload?.runDenylist ?? [],
+      // Interactive command-approval gate: the jobId lets python register a pending
+      // approval + poll for the user's Yes/No via the API; interactiveApproval is the
+      // REPL's "I can show a picker" signal (else python keeps hard-blocking, as on web).
+      jobId,
+      interactiveApproval: payload?.interactiveApproval === true,
+      // Auto-test mode (/test-auto): the agent verifies its work and fixes until it passes.
+      autoTest: payload?.autoTest === true,
+      // Deploy target chosen via the terminal /server picker (task #69). Host/user only.
+      deployServer: payload?.deployServer ?? null,
       // Max web_search + fetch_url calls the agent may make per task (user-configurable
       // in web Settings → Agent). Default 10; past it the retrieval tools refuse.
       researchBudget: payload?.researchBudget ?? 10,

package/gonext-repl.mjs

@@ -163,6 +163,8 @@ if (!workerKey || !apiBase) {
 // unknown-command guard, and /help, so they can never drift.
 const COMMANDS = [
   { name: "/model", desc: "switch the coding model for this session" },
+  { name: "/test-auto", desc: "toggle auto-test (verify & fix until it passes) for this folder" },
+  { name: "/server", desc: "pick a deployment server (host/user) for this session" },
   { name: "/revert", usage: "/revert [runId]", desc: "undo the agent's file edits (latest run)" },
   { name: "/reset", aliases: ["/new"], desc: "forget this folder's saved conversation and start fresh" },
   { name: "/help", desc: "list these commands" },
@@ -298,6 +300,14 @@ function drawSlashHint(prefix, sel) {
 }
 if (process.stdin.isTTY) {
   process.stdin.on("keypress", (_ch, key) => {
+    // A command-approval picker is up → arrow keys move the highlight, Enter chooses.
+    if (approvalActive) {
+      onApprovalKey(key);
+      rl.line = "";
+      rl.cursor = 0;
+      rl.historyIndex = -1;
+      return;
+    }
     if (following) {
       rl.line = "";
       rl.cursor = 0;
@@ -495,6 +505,17 @@ async function loadSession(cwd) {
   }
 }
 
+// The /test-auto choice is remembered per folder (stored alongside history in the same
+// session file). Read it once at startup so the banner and agent-ask reflect it.
+async function loadSessionTestAuto(cwd) {
+  try {
+    const raw = JSON.parse(await readFile(sessionFilePath(cwd), "utf8"));
+    return raw?.testAuto === true;
+  } catch {
+    return false;
+  }
+}
+
 async function saveSession(cwd, history) {
   try {
     await mkdir(SESSIONS_DIR, { recursive: true });
@@ -502,7 +523,7 @@ async function saveSession(cwd, history) {
     await writeFile(
       sessionFilePath(cwd),
       JSON.stringify(
-        { cwd, updatedAt: new Date().toISOString(), history: trimmed },
+        { cwd, updatedAt: new Date().toISOString(), testAuto: sessionTestAuto, history: trimmed },
         null,
         2
       ) + "\n"
@@ -572,6 +593,89 @@ async function chooseModel() {
   console.log(green(`  ✓ coding model → ${chosen}${chosen === def ? " (default)" : ""}\n`));
 }
 
+// Probe whether SSH KEY auth already works for a server (so we can tell the user to run
+// ssh-copy-id if not). BatchMode=yes = never prompt for a password → exit!=0 if no key.
+async function checkServerKeyAuth(s) {
+  try {
+    const ok = await new Promise((resolve) => {
+      const p = spawn(
+        "ssh",
+        [
+          "-o", "BatchMode=yes",
+          "-o", "ConnectTimeout=6",
+          "-o", "StrictHostKeyChecking=accept-new",
+          `${s.user}@${s.host}`,
+          "true",
+        ],
+        { stdio: "ignore" }
+      );
+      p.on("exit", (code) => resolve(code === 0));
+      p.on("error", () => resolve(false));
+    });
+    if (ok) console.log(dim("    ✓ key auth works — deploys will connect without a password."));
+    else
+      console.log(
+        yellow("    key auth not set up yet.") +
+          dim(` Run once in your terminal:  `) +
+          `ssh-copy-id ${s.user}@${s.host}`
+      );
+  } catch {
+    /* best-effort check — never block the picker */
+  }
+}
+
+// /server — pick a deployment target (from the web app's Servers registry) for this
+// session. Host/user only, never a secret; the agent deploys here with KEY auth (#69).
+async function chooseServer() {
+  let servers;
+  try {
+    const res = await fetch(`${apiBase}/api/worker/deploy-servers`, {
+      headers: { "X-Worker-Key": workerKey },
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      console.log(red(`  couldn't load servers: ${data?.error || `HTTP ${res.status}`}\n`));
+      return;
+    }
+    servers = Array.isArray(data?.servers) ? data.servers : [];
+  } catch (err) {
+    console.log(red(`  couldn't load servers: ${err.message}\n`));
+    return;
+  }
+  if (servers.length === 0) {
+    console.log(dim("  No deployment servers yet — add them in the web app → Servers.\n"));
+    return;
+  }
+  const activeHost = selectedServer?.host || "";
+  console.log(dim("  Choose a deployment server for this session:"));
+  servers.forEach((s, i) => {
+    const mark = s.host === activeHost ? green(" ●") : "  ";
+    console.log(`   ${mark} ${i + 1}. ${s.name} ${dim(`(${s.user}@${s.host})`)}`);
+  });
+  console.log(`      0. ${dim("none (clear selection)")}`);
+  const pick = (await ask(dim("  number (or Enter to keep current): "))).trim();
+  if (!pick) {
+    console.log("");
+    return;
+  }
+  const n = Number.parseInt(pick, 10);
+  if (n === 0) {
+    selectedServer = null;
+    console.log(dim("  ✓ deployment server cleared.\n"));
+    return;
+  }
+  const idx = n - 1;
+  if (!Number.isInteger(idx) || idx < 0 || idx >= servers.length) {
+    console.log(red("  invalid choice.\n"));
+    return;
+  }
+  const s = servers[idx];
+  selectedServer = { name: s.name, host: s.host, user: s.user };
+  console.log(green(`  ✓ deploy target → ${s.name} (${s.user}@${s.host})`));
+  await checkServerKeyAuth(selectedServer);
+  console.log("");
+}
+
 async function fetchAgentPayload(messages) {
   const res = await fetch(`${apiBase}/api/worker/agent-payload`, {
     method: "POST",
@@ -604,9 +708,73 @@ let following = false;
 let followAborted = false;
 let currentJobId = null; // the running turn's jobId — so Ctrl+C can cancel it server-side
 let cancelRequested = false; // a cancel POST has been sent for the current turn
+// Interactive command-approval gate: while the agent is paused on a risky command, the
+// terminal shows a Yes/No list picker (↑/↓ + Enter, Yes preselected). approvalActive
+// routes keystrokes to the picker; approvalResolve settles the awaiting promise once.
+let approvalActive = false;
+let approvalSel = 0; // 0 = Yes (default highlighted), 1 = No
+let approvalResolve = null;
+function drawApprovalOptions(redraw) {
+  // Two option lines, redrawn in place. On redraw the cursor sits one row below "No";
+  // step up 2 rows, clear+rewrite both, landing back where we started.
+  const yes = approvalSel === 0 ? green("▸ Yes") : dim("  Yes");
+  const no = approvalSel === 1 ? green("▸ No") : dim("  No");
+  process.stdout.write((redraw ? "\x1b[2A" : "") + "\x1b[K" + yes + "\n\x1b[K" + no + "\n");
+}
+function finishApproval(allow) {
+  if (!approvalActive) return;
+  approvalActive = false;
+  // Settle the picker: overwrite the two option lines with a single result line.
+  process.stdout.write("\x1b[2A\x1b[J" + (allow ? green("  ▸ Yes — running it") : red("  ▸ No — skipped")) + "\n");
+  const r = approvalResolve;
+  approvalResolve = null;
+  if (r) r(!!allow);
+}
+function onApprovalKey(key) {
+  if (!key) return;
+  if (key.name === "up" || key.name === "down") {
+    approvalSel = key.name === "up" ? 0 : 1; // 2 options: up=Yes, down=No
+    drawApprovalOptions(true);
+  } else if (key.name === "return" || key.name === "enter") {
+    finishApproval(approvalSel === 0);
+  }
+  // Ctrl+C is delivered via readline "SIGINT" (onInterrupt), which also denies — see there.
+}
+// Show the picker and resolve to the user's choice. Non-TTY (piped) can't pick → deny
+// (safe). Auto-denies after ~170s so an absent user never hangs the turn (and stays
+// under the python side's 180s wait); Enter is instant since Yes is preselected.
+function approvalPrompt(command) {
+  return new Promise((resolve) => {
+    if (!process.stdin.isTTY) {
+      process.stdout.write(dim(`\n(approval needed for: ${command} — no interactive terminal, skipping)\n`));
+      resolve(false);
+      return;
+    }
+    process.stdout.write(
+      "\n" + yellow("⚠ Allow running this command?") + "\n" + dim("  " + command) + "\n"
+    );
+    approvalSel = 0;
+    approvalResolve = resolve;
+    approvalActive = true;
+    drawApprovalOptions(false);
+    const t = setTimeout(() => finishApproval(false), 170000);
+    const orig = resolve;
+    approvalResolve = (v) => {
+      clearTimeout(t);
+      orig(v);
+    };
+  });
+}
 // Per-session coding-model override chosen via /model (empty = use the account default).
 // Sent to /agent-ask as codingModelOverride; the API validates it against the whitelist.
 let sessionCodingModel = "";
+// Auto-test mode (/test-auto): when on, the agent verifies its work (build/run/curl/…)
+// and fixes → re-tests until it passes before finishing. Default off; remembered per
+// folder in the session file; sent to /agent-ask as autoTest so python drives the loop.
+let sessionTestAuto = false;
+// Deploy target chosen via /server (task #69): {name, host, user} or null. Session-scoped;
+// sent to /agent-ask as deployServer so the agent deploys to this host with KEY auth.
+let selectedServer = null;
 
 // While a turn runs, mute readline's own echo/redraws so keystrokes can't corrupt the
 // live status display and there's no way to type a new question — only Ctrl+C works.
@@ -638,6 +806,65 @@ const answerFrom = (s) =>
     .replace(/<think>[\s\S]*$/i, "")
     .trim();
 
+// --- Live-thought normalization (task "agent thought normalizing issue") ---------------
+// The blinking status line names the model's current Thought. But the model often emits
+// <code> with NO "Thought:" prose (or degenerates into a runaway), so the raw stream is
+// a create_file(...) blob / escaped CSS — which used to render verbatim on the line
+// ("◐ , #94a3b8);\n -webkit-background-clip…"). Fix: show a genuine thought ONLY when the
+// model actually wrote prose; otherwise name the TOOL it's calling ("Writing App.js");
+// otherwise show nothing (the line falls back to "Thinking…"). Never raw code/CSS.
+const _baseName = (p) => (String(p || "").split(/[\\/]/).pop() || "").trim();
+const THOUGHT_TOOL_LABELS = {
+  create_file: (a) => `Writing ${_baseName(a) || "a file"}`,
+  create_folder: (a) => `Creating ${_baseName(a) || "a folder"}`,
+  edit_lines: (a) => `Editing ${_baseName(a) || "a file"}`,
+  edit_file: (a) => `Editing ${_baseName(a) || "a file"}`,
+  read_file_lines: (a) => `Reading ${_baseName(a) || "a file"}`,
+  read_text_file: (a) => `Reading ${_baseName(a) || "a file"}`,
+  list_dir: (a) => `Listing ${_baseName(a) || "files"}`,
+  grep_repo: () => "Searching the code",
+  run_command: (a) => `Running ${a || "a command"}`,
+  stop_server: () => "Stopping the server",
+  deploy_web: () => "Deploying",
+  fetch_url: (a) => `Fetching ${_baseName(a) || "a page"}`,
+  web_search: () => "Searching the web",
+  http_request: () => "Calling an API",
+  create_pdf: () => "Building a PDF",
+  rag_search: () => "Searching the knowledge base",
+  rag_index: () => "Indexing the knowledge base",
+  download_file: () => "Downloading a file",
+  unzip_file: () => "Unzipping",
+  send_email: () => "Preparing an email",
+  open_url: (a) => `Opening ${a || "a link"}`,
+  final_answer: () => "Composing the answer",
+};
+// Does this candidate look like CODE / a data blob rather than a human thought? (Escaped
+// newlines, braces, hex colors, -webkit-, a leading function call, or too few spaces.)
+const _thoughtLooksCodey = (s) =>
+  /\\n|[{}]|=>|="|#[0-9a-fA-F]{3,6}\b|-webkit-|;\s*$|^\s*[<([]/.test(s) ||
+  /^\s*[a-z_]\w*\s*\(/i.test(s) ||
+  (s.length > 24 && (s.split(" ").length - 1) / s.length < 0.06);
+// Raw in-fence stream → a short, meaningful status: a real Thought clause if the model
+// wrote one, else a friendly label from the tool it's calling, else "" (→ "Thinking…").
+const normalizeThought = (buf) => {
+  const t = String(buf || "");
+  const ci = t.search(/<code[\s>]/i);
+  const head = ci >= 0 ? t.slice(0, ci) : t;
+  // 1) a genuine Thought prose line (before the code) — only if it isn't itself code.
+  const prose = head
+    .replace(/^\s*Thought:\s*/i, "")
+    .split(/\n/)
+    .map((x) => x.trim())
+    .find(Boolean);
+  if (prose && !_thoughtLooksCodey(prose)) return prose.slice(0, 100);
+  // 2) otherwise name the tool being called (from the code part).
+  const codePart = ci >= 0 ? t.slice(ci) : t;
+  const m = /(?:<code>\s*)?\b([a-z_]\w*)\s*\(\s*(?:path\s*=\s*)?["']?([^"'\n,)]*)/i.exec(codePart);
+  if (m && THOUGHT_TOOL_LABELS[m[1]]) return THOUGHT_TOOL_LABELS[m[1]](m[2].trim()).slice(0, 100);
+  // 3) nothing human to show.
+  return "";
+};
+
 async function runAgentTurn(history) {
   const res = await fetch(`${apiBase}/api/worker/agent-ask`, {
     method: "POST",
@@ -647,6 +874,13 @@ async function runAgentTurn(history) {
     body: JSON.stringify({
       messages: history,
       cwd: resolve(process.cwd()),
+      // The terminal can show a Yes/No picker → the agent PAUSES on a risky command and
+      // asks instead of hard-blocking it (interactive command-approval gate).
+      interactiveApproval: true,
+      // Auto-test mode (/test-auto): the agent verifies its work and fixes until it passes.
+      ...(sessionTestAuto ? { autoTest: true } : {}),
+      // Deploy target chosen via /server — host/user only (no secret), for key-auth deploys.
+      ...(selectedServer ? { deployServer: selectedServer } : {}),
       ...(sessionCodingModel ? { codingModelOverride: sessionCodingModel } : {}),
     }),
   });
@@ -668,6 +902,7 @@ async function runAgentTurn(history) {
   cancelRequested = false;
   const startedAt = Date.now();
   let shownChars = 0;
+  let lastApprovalId = null; // the last command-approval request we've already answered
   let carry = ""; // trailing partial content line held until its newline arrives
   let statusShown = false; // a transient status line is currently on screen
   let warnedPending = false;
@@ -705,15 +940,6 @@ async function runAgentTurn(history) {
   // random word. `fenceThought` accumulates the raw in-fence text for the current step.
   let liveThought = "";
   let fenceThought = "";
-  // First non-empty Thought clause: drop the "Thought:" prefix, stop at the <code> block
-  // (we never show code), take the first line, and cap length so it never wraps.
-  const extractThought = (buf) => {
-    let t = String(buf || "");
-    const ci = t.search(/<code[\s>]/i);
-    if (ci >= 0) t = t.slice(0, ci);
-    t = t.replace(/^\s*Thought:\s*/i, "").split(/\n/)[0].trim();
-    return t;
-  };
   const thinkSecs = () => Math.max(1, Math.round((Date.now() - thinkingSince) / 1000));
 
   // The status is TWO in-place lines — the in-progress action, then the playful word
@@ -727,6 +953,7 @@ async function runAgentTurn(history) {
 
   const tick = () => {
     if (!following || followAborted || !jobRunning) return;
+    if (approvalActive) return; // a Yes/No picker owns the screen — don't draw over it
     if (Date.now() - lastContentAt < QUIET_MS) return; // tokens still flowing
     // A plain-reply answer streams onto a line with NO trailing newline until it's fully
     // done — overwriting the ticker there corrupts the visible answer mid-word. Stay
@@ -817,9 +1044,12 @@ async function runAgentTurn(history) {
       // Thought clause for the blinking line (task #64) — up to the <code> block, which is
       // where the prose ends and the tool call begins (we never surface code here).
       if (inStreamFence) {
-        if (!/<code[\s>]/i.test(fenceThought)) {
+        // Accumulate a bounded head of the stream (enough to see the Thought prose OR the
+        // tool call), capped so a 16k-char runaway can't grow the buffer. normalizeThought
+        // yields a clean label — never raw code/CSS.
+        if (fenceThought.length < 400) {
           fenceThought += line + "\n";
-          const th = extractThought(fenceThought);
+          const th = normalizeThought(fenceThought);
           if (th) liveThought = th;
         }
         continue;
@@ -955,8 +1185,8 @@ async function runAgentTurn(history) {
     // no newline yet (a long reasoning sentence streams token-by-token) — recompute the
     // live clause from the partial too, so the blinking line updates mid-sentence instead
     // of only once the line finally breaks (task #64).
-    if (inStreamFence && !/<code[\s>]/i.test(fenceThought)) {
-      const th = extractThought(fenceThought + carry);
+    if (inStreamFence && fenceThought.length < 400) {
+      const th = normalizeThought(fenceThought + carry);
       if (th) liveThought = th;
     }
     // A non-empty remainder is a partial CONTENT line (heartbeats always arrive whole with
@@ -1030,6 +1260,26 @@ async function runAgentTurn(history) {
         consume(text.slice(shownChars));
         shownChars = text.length;
       }
+      // Interactive command-approval gate: the agent paused on a risky command. Show the
+      // Yes/No picker once per request id, POST the choice, then let the agent resume.
+      if (
+        job.pendingApproval &&
+        job.pendingApproval.id &&
+        job.pendingApproval.id !== lastApprovalId
+      ) {
+        lastApprovalId = job.pendingApproval.id;
+        clearStatus();
+        const allow = await approvalPrompt(job.pendingApproval.command || "");
+        try {
+          await fetch(`${apiBase}/api/worker/jobs/${jobId}/approval`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+            body: JSON.stringify({ id: lastApprovalId, allow }),
+          });
+        } catch {
+          // Best-effort — if the POST fails, the python side times out and treats as deny.
+        }
+      }
       if (job.jobStatus === "cancelled") {
         // User-requested stop (Ctrl+C) — a clean outcome, not an error. The worker has
         // killed the Python agent. Print a quiet note and return an empty, non-persisted
@@ -1071,6 +1321,8 @@ async function runAgentTurn(history) {
 async function main() {
   console.log(cyan("GoNext agent REPL") + dim(` · API ${apiBase} · key ${workerKey.slice(0, 8)}…`));
   await ensureWorkspace();
+  // Restore this folder's remembered auto-test choice so the banner + agent-ask reflect it.
+  sessionTestAuto = await loadSessionTestAuto(resolve(process.cwd()));
   // Show which models will answer, straight from user settings (also validates auth).
   try {
     const probe = await fetchAgentPayload([{ role: "user", content: "ping" }]);
@@ -1079,8 +1331,9 @@ async function main() {
       dim(
         `agent model: ${p.agentModelId || probe?.modelKey || "?"}` +
           (p.codingModelId ? ` · coder: ${p.codingModelId}` : "") +
-          (p.ragEnabled ? " · RAG on" : "")
-      )
+          (p.ragEnabled ? " · RAG on" : "") +
+          ` · auto-test: ${sessionTestAuto ? "on" : "off"}`
+      ) + (sessionTestAuto ? "" : dim(" (/test-auto to enable)"))
     );
   } catch (err) {
     console.error(red(`gonext: ${err.message}`));
@@ -1102,6 +1355,9 @@ async function main() {
   // the OS delivers a real SIGINT to the process. Attach the same handler to both —
   // only one can ever fire for a given mode, so there's no double-handling.
   const onInterrupt = () => {
+    // Ctrl+C while the approval picker is up = decline it (and fall through to also
+    // cancel the turn) — otherwise the poll loop stays blocked awaiting a choice.
+    if (approvalActive) finishApproval(false);
     if (following) {
       if (!cancelRequested && currentJobId) {
         // First Ctrl+C: actually CANCEL the running turn server-side (stop the model),
@@ -1157,6 +1413,23 @@ async function main() {
       await chooseModel();
       continue;
     }
+    if (line === "/server") {
+      await chooseServer();
+      continue;
+    }
+    if (line === "/test-auto") {
+      sessionTestAuto = !sessionTestAuto;
+      await saveSession(cwd, history); // persist the choice for this folder
+      console.log(
+        (sessionTestAuto ? green("auto-test: ON") : dim("auto-test: OFF")) +
+          dim(
+            sessionTestAuto
+              ? " — the agent will verify its work and fix until it passes, for this folder.\n"
+              : " for this folder.\n"
+          )
+      );
+      continue;
+    }
     if (line === "/reset" || line === "/new") {
       history.length = 0;
       await clearSession(cwd);

package/gonext_agent_chat.py

@@ -2227,6 +2227,85 @@ _WS_RUN_DENY_ALWAYS = {"sudo", "su", "doas"}  # privilege escalation — never r
 _WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
 _WS_RUN_DENYLIST = set()   # extra user blocks from cfg
 
+# Privilege escalation, scanned on the RAW command (not just argv[0]) so it also catches
+# `bash -c "sudo …"` / `env sudo …` — the naive shell-wrap bypass a model reaches for.
+_WS_PRIV_RE = re.compile(r"\b(sudo|doas|su)\b", re.IGNORECASE)
+# Destructive: mass delete, disk wipe, or power-off. Allowed by default (allow-by-default
+# policy) but worth a confirmation when we CAN ask the user (interactive terminal).
+_WS_DESTRUCTIVE_RE = re.compile(
+    r"(^|[\s;&|])rm\b[^|;&\n]*\s-[a-z]*[rf]"          # rm with -r / -f (any order)
+    r"|(^|[\s;&|])(dd|shred|wipefs|mkfs(\.\w+)?)\b"   # disk destroyers
+    r"|(^|[\s;&|])(shutdown|reboot|halt|poweroff)\b", # power
+    re.IGNORECASE,
+)
+
+
+def _ws_command_risk(command, argv, denyset):
+    """Classify a command for the run policy. Returns (hard_reason, ask_reason), either
+    None when N/A:
+    - hard_reason: block outright when we CAN'T ask (web / non-interactive) — privilege
+      escalation or a user-denylisted runner.
+    - ask_reason: prompt the user when we CAN (interactive terminal) — the above PLUS
+      destructive filesystem/power commands (which are otherwise allowed by default)."""
+    import os as _os
+    cmd = command or ""
+    runner = argv[0] if argv else ""
+    rbase = _os.path.basename(runner)
+    if _WS_PRIV_RE.search(cmd):
+        r = "privilege escalation (sudo/su)"
+        return (r, r)
+    if denyset and (runner in denyset or rbase in denyset):
+        r = f"'{runner}' is on your blocked-commands list"
+        return (r, r)
+    if _WS_DESTRUCTIVE_RE.search(cmd):
+        return (None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None)
+
+
+def _ws_request_approval(api_base, worker_key, job_id, command, reason):
+    """Pause and ask the user (via the terminal REPL's Yes/No picker) to allow a risky
+    command. Registers a pending approval on the job through the API, then polls the job
+    for the user's decision. Returns True (allow) or False (deny / timeout / cancelled).
+    Mirrors _pdf_upload_via_api's worker-key auth — no new creds on the worker."""
+    import urllib.request as _u
+    import uuid as _uuid
+    import time as _t
+    base = (api_base or "").rstrip("/")
+    if not base or not worker_key or not job_id:
+        return False
+    rid = _uuid.uuid4().hex[:12]
+    ctx = _ssl_context()
+    try:
+        req = _u.Request(
+            f"{base}/api/worker/jobs/{job_id}/approval-request",
+            data=json.dumps({"id": rid, "command": command}).encode("utf-8"),
+            headers={"Content-Type": "application/json", "X-Worker-Key": worker_key},
+            method="POST",
+        )
+        with _u.urlopen(req, timeout=20, context=ctx) as resp:
+            resp.read()
+    except Exception as e:  # noqa: BLE001
+        _log(f"approval-request failed: {e} — treating as deny")
+        return False
+    _emit({"type": "step", "text": f"Awaiting your approval to run: {command[:70]}"})
+    deadline = _t.time() + 180  # 3 min; absent user → deny (never auto-run something risky)
+    while _t.time() < deadline:
+        _t.sleep(1.2)
+        try:
+            g = _u.Request(f"{base}/api/worker/jobs/{job_id}",
+                           headers={"X-Worker-Key": worker_key}, method="GET")
+            with _u.urlopen(g, timeout=15, context=ctx) as resp:
+                data = json.loads(resp.read().decode("utf-8"))
+        except Exception as e:  # noqa: BLE001
+            _log(f"approval poll error: {e}")
+            continue
+        if data.get("jobStatus") in ("cancelled", "failed", "completed"):
+            return False  # Ctrl+C or the job ended → treat as declined
+        dec = data.get("approvalDecision") or {}
+        if dec.get("id") == rid:
+            return bool(dec.get("allow"))
+    return False
+
 # ---- background servers (behavior-detected, command-agnostic) ----
 # run_command classifies a command by OBSERVED BEHAVIOR, never by its text: if the
 # process keeps running AND starts LISTENing on a TCP port, it IS a server — npm start,
@@ -2414,6 +2493,18 @@ def run_agent_chat(cfg):
     # For the create_pdf tool: API base + worker key to request a presigned S3 upload.
     pdf_api_base = (cfg.get("apiBaseURL") or "").strip()
     pdf_worker_key = (cfg.get("workerKey") or "").strip()
+    # Interactive command-approval gate: this job's id + whether the client (terminal
+    # REPL) can show a Yes/No picker. When both are present, run_command PAUSES on a
+    # risky command and asks the user via the API instead of hard-blocking it.
+    _job_id = (cfg.get("jobId") or "").strip()
+    _interactive_approval = bool(cfg.get("interactiveApproval"))
+    # Auto-test mode (/test-auto): after making changes the agent must VERIFY them and
+    # fix → re-test until they pass before finishing. Drives a prompt directive + a
+    # slightly higher step budget (the verify loop needs room). Terminal-only.
+    _auto_test = bool(cfg.get("autoTest"))
+    # Deploy target chosen via the terminal /server picker (task #69): {name, host, user}
+    # or None. Host/user only — never a secret; deploys use SSH KEY auth to this host.
+    _deploy_server = cfg.get("deployServer") if isinstance(cfg.get("deployServer"), dict) else None
     # Optional dedicated coding/reasoning model for the CodeAgent's tool-use loop.
     # Routing, plain replies and summarization stay on the chat model (better at
     # natural language); the code model only drives http_request reasoning.
@@ -2647,6 +2738,12 @@ def run_agent_chat(cfg):
         if not cfg.get("maxSteps") and max_steps < 12:
             max_steps = 12
             _log("workspace registered → step budget raised to 12 (no explicit maxSteps)")
+        # Auto-test adds a verify → fix → re-test cycle on top of the work itself, so give
+        # it more room (unless the user pinned a budget). Kept modest so a stuck test loop
+        # still terminates rather than burning a huge budget.
+        if _auto_test and not cfg.get("maxSteps") and max_steps < 16:
+            max_steps = 16
+            _log("auto-test on → step budget raised to 16 (no explicit maxSteps)")
 
     def _rag_s3_and_loc():
         client = _rag_s3_client(rag_region, rag_akid, rag_secret)
@@ -3014,6 +3111,43 @@ def run_agent_chat(cfg):
         "- 'email …' / 'send an email to …' -> send_email(to, subject, body) "
         "(previews first, then sends on confirm).\n"
     ) if _EMAIL_AVAILABLE else ""
+    # Auto-test mode (/test-auto): a directive that makes the agent VERIFY its changes
+    # and fix → re-test until they pass. Only meaningful for workspace code work; empty
+    # otherwise so it costs no prompt-eval when off. Climbs the cheapest-sufficient
+    # verification ladder and bakes in the guardrails (freeze the pass criterion, ignore
+    # flakes, prove the test ran, cap retries) so it converges instead of chasing green.
+    _auto_test_block = (
+        "\nAUTO-TEST MODE (ON): after you CHANGE code you MUST verify it before "
+        "final_answer — never finish on an untested change. Use the CHEAPEST check that "
+        "proves the change, climbing only as needed:\n"
+        "  1. grep_repo the edited file to confirm the change landed (and the old code is gone).\n"
+        "  2. build / typecheck (e.g. run_command('npm run build') / 'tsc --noEmit' / 'go build').\n"
+        "  3. run the project's tests (npm test / pytest / …) if they exist.\n"
+        "  4. if it's a running app, start it and curl/fetch_url it, then check the response "
+        "contains what the change should produce.\n"
+        "DECIDE what 'passes' BEFORE you fix — do NOT weaken the check to make it green. If a "
+        "check FAILS: read the error, make ONE fix, then RE-TEST the SAME way. If it passes only "
+        "after re-running with no change, it was flaky — stop, don't keep editing. Give up after "
+        "3 fix attempts on the same failure and final_answer honestly what still fails. Confirm a "
+        "test actually exercised the change (e.g. the asserted text was really present), not an "
+        "empty/no-op pass.\n"
+        if (_auto_test and _WS_AVAILABLE) else ""
+    )
+    # Deploy target (/server): when the user picked one, tell the agent to deploy THERE
+    # with key auth. Host/user only — the block never contains a password.
+    _deploy_block = ""
+    if _deploy_server and _deploy_server.get("host") and _deploy_server.get("user"):
+        _dh = str(_deploy_server.get("host")).strip()
+        _du = str(_deploy_server.get("user")).strip()
+        _dn = str(_deploy_server.get("name") or _dh).strip()
+        _deploy_block = (
+            f"\nDEPLOY TARGET (the user selected server '{_dn}'): host {_dh}, user {_du}. "
+            f"When the task is about DEPLOYING, deploy to THIS server — deploy_web(local_dir, "
+            f"host='{_dh}', user='{_du}', remote_path=...) or ssh/scp/rsync to {_du}@{_dh}. "
+            "KEY auth ONLY (-o BatchMode=yes); NEVER ask for or type a password. If key auth "
+            f"isn't set up (Permission denied publickey,password), STOP and tell the user to "
+            f"run 'ssh-copy-id {_du}@{_dh}' once, then retry.\n"
+        )
     tool_hint = (
         f"Solve the TASK step by step (up to {max_steps} steps). At EACH step write a "
         "brief Thought, then ONE code block that calls a SINGLE tool. You will SEE that "
@@ -3024,7 +3158,7 @@ def run_agent_chat(cfg):
         "{{TOOL_LIST}}\n"  # filled in below, once from the REAL registered tool objects
         f"(Current date/time: {now_str} — pass a timezone to get_current_datetime() only "
         "if the task needs a DIFFERENT one.)\n"
-        + _rag_tool_block + _ws_tool_block +
+        + _rag_tool_block + _ws_tool_block + _auto_test_block + _deploy_block +
         "\n"
         "http_request RETURN FORMAT: 'HTTP 200\\n{body}' — first line is 'HTTP <code>', body follows.\n"
         "\n"
@@ -4629,26 +4763,36 @@ def run_agent_chat(cfg):
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
                     return msg
-                # Allow-by-default policy (see _WS_RUN_DENY_ALWAYS). Match on the runner's
-                # basename too, so `/usr/bin/sudo` can't slip past a bare-name block.
+                # Allow-by-default policy. Match on the runner's basename too, so
+                # `/usr/bin/<x>` can't slip past a bare-name rule.
                 _runner = argv[0]
                 _rbase = os.path.basename(_runner)
-                if _runner in _WS_RUN_DENY_ALWAYS or _rbase in _WS_RUN_DENY_ALWAYS:
-                    msg = (f"Error: '{_runner}' is blocked (privilege escalation is never "
-                           "run by the agent). Run that step yourself, or tell the user the "
-                           "exact command to run.")
-                    _last_obs["text"] = msg
-                    return msg
-                if _WS_RUN_DENYLIST and (_runner in _WS_RUN_DENYLIST or _rbase in _WS_RUN_DENYLIST):
-                    msg = (f"Error: '{_runner}' is blocked by your run denylist "
-                           "(change it in web Settings → Agent).")
-                    _last_obs["text"] = msg
-                    return msg
+                # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
                 if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
                     msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
                            "Settings → Agent, or clear the allowlist to allow all commands.")
                     _last_obs["text"] = msg
                     return msg
+                # Risk gate: privilege escalation / denylisted / destructive. When the
+                # client can approve interactively (terminal), PAUSE and ask the user;
+                # otherwise (web) keep hard-blocking the privilege/denylist cases.
+                _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST)
+                if _ask_reason:
+                    if _interactive_approval and _job_id and pdf_api_base and pdf_worker_key:
+                        if not _ws_request_approval(pdf_api_base, pdf_worker_key,
+                                                    _job_id, command, _ask_reason):
+                            msg = (f"Error: the user declined to run '{command[:80]}' "
+                                   f"({_ask_reason}). Do NOT retry it — choose another "
+                                   "approach or ask the user what to do.")
+                            _last_obs["text"] = msg
+                            return msg
+                        # approved → fall through and run it
+                    elif _hard_reason:
+                        msg = (f"Error: '{command[:80]}' is blocked ({_hard_reason}). Run "
+                               "that step yourself, or tell the user the exact command.")
+                        _last_obs["text"] = msg
+                        return msg
+                    # else: destructive but non-interactive → allowed by default (unchanged)
                 _emit({"type": "step", "text": f"Running → {command[:70]}"})
                 t = max(5, min(int(timeout_seconds or 180), 600))
                 # Own process group (start_new_session) + output to a log file. This is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gonext-local-worker",
-  "version": "1.0.227",
+  "version": "1.0.229",
   "description": "Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac",
   "type": "module",
   "license": "MIT",