@tiens.nguyen/gu-cli 1.0.768 → 1.0.770

package/gonext_agent_chat.py

@@ -997,6 +997,13 @@ class _AgentConfigError(RuntimeError):
     worth a plain-reply degrade — the user needs the message itself to fix Settings."""
 
 
+class _AgentOffline(_AgentConfigError):
+    """The network was gone for longer than the wait budget (task #302, part 3). Ends the turn
+    as FAILED — never as a stop — with the work so far kept and "continue" as the way on. A
+    subclass of the config error so it takes the same honest exit: no degrade to a plain reply,
+    which would need the network anyway and would answer as if the work had been done."""
+
+
 class _AgentBackendOverloaded(RuntimeError):
     """The coding backend refused every attempt with 429/rate-limit (task #114). Carries
     the user-facing explanation; like a gateway outage it must NOT degrade to a plain
@@ -3539,6 +3546,78 @@ def _retry_delay(attempt: int, overloaded: bool, gateway: bool, err=None) -> flo
     return 1.5 * attempt
 
 
+_OFFLINE_ALWAYS = (
+    # The NAME did not resolve, or there is no route at all: this machine is off the network.
+    "nodename nor servname", "name or service not known", "getaddrinfo failed",
+    "temporary failure in name resolution", "name resolution", "network is unreachable",
+    "no route to host", "network is down", "connection error",
+)
+_OFFLINE_REMOTE = (
+    # Nothing answered at the other end. For a PUBLIC host that is the network (Wi-Fi dropped, a
+    # VPN reconnecting); for a local/LAN box it is the server itself being down, which the
+    # gateway budget already handles — waiting ten minutes for a stopped Ollama would be wrong.
+    "connection refused", "connection reset", "connection aborted",
+    "failed to establish a new connection", "remote end closed connection",
+    "server disconnected", "connecterror",
+)
+_OFFLINE_TYPES = ("APIConnectionError", "ConnectError", "ConnectionError", "RemoteProtocolError",
+                  "ConnectionRefusedError", "ConnectionResetError", "ConnectionAbortedError",
+                  "gaierror", "NewConnectionError")
+
+
+def _is_offline(err, host: str = "") -> bool:
+    """Did this call fail because the NETWORK went away, rather than because a server answered?
+    (task #302, part 3). Such a failure is waited out — the same step is retried when the
+    connection is back — instead of costing the turn a few seconds after the Wi-Fi drops.
+
+    Something that answered with a status is never offline, and a timeout is its own class
+    (openai's APITimeoutError subclasses APIConnectionError, so it is excluded by name)."""
+    if err is None or _http_status_of(err) is not None or _is_request_timeout(err):
+        return False
+    local = _host_locality_is_local(host)
+    cur, depth = err, 0
+    while cur is not None and depth < 6:
+        name = type(cur).__name__
+        text = str(cur or "").lower()
+        if any(w in text for w in _OFFLINE_ALWAYS):
+            return True
+        if not local and (name in _OFFLINE_TYPES or any(w in text for w in _OFFLINE_REMOTE)):
+            return True
+        cur, depth = (getattr(cur, "__cause__", None) or getattr(cur, "__context__", None)), depth + 1
+    return False
+
+
+def _host_locality_is_local(host: str) -> bool:
+    """localhost, 127.x, 10.x, 172.16-31.x, 192.168.x, *.local, a bare name → True."""
+    import re as _re
+    h = str(host or "").strip().lower()
+    h = _re.sub(r"^https?://", "", h).split("/")[0]
+    h = _re.sub(r":\d+$", "", h) if not h.startswith("[") else h
+    if not h:
+        return False
+    if h in ("localhost", "::1", "[::1]") or h.startswith("127."):
+        return True
+    m = _re.match(r"^(\d+)\.(\d+)\.\d+\.\d+$", h)
+    if m:
+        a, b = int(m.group(1)), int(m.group(2))
+        return a == 10 or (a == 172 and 16 <= b <= 31) or (a == 192 and b == 168)
+    return "." not in h or h.endswith((".local", ".lan", ".internal", ".home"))
+
+
+def _offline_wait_budget() -> float:
+    """How long a turn waits for the network before giving up (GONEXT_OFFLINE_WAIT_S, default 10 min)."""
+    try:
+        v = float(os.environ.get("GONEXT_OFFLINE_WAIT_S", "") or 600)
+    except ValueError:
+        v = 600.0
+    return max(0.0, v)
+
+
+def _offline_delay(n: int) -> float:
+    """Seconds before offline retry #n: 2 → 5 → 10 → 15 (capped). Pure."""
+    return (2.0, 5.0, 10.0)[n - 1] if 1 <= n <= 3 else 15.0
+
+
 def _is_backend_unavailable(err) -> bool:
     s = str(err or "").lower()
     # An overload (429) is its own class — never let it fall into the gateway bucket, whose
@@ -3737,6 +3816,12 @@ def _stream_fallback_decision(err, first_token_seen: bool) -> str:
         return "raise"
     if _is_request_timeout(err) or _is_backend_unavailable(err):
         return "raise"
+    # THE NETWORK WENT (task #302, part 3). Found by the mid-turn offline test: "Connection
+    # error." matched nothing above, so a dropped Wi-Fi re-sent the step UNSTREAMED and marked the
+    # server as unable to stream for the rest of the process. A lost connection says nothing about
+    # the request's shape — raise, and the retry loop waits for the network.
+    if _is_offline(err):
+        return "raise"
     return "fallback"
 
 
@@ -6875,24 +6960,115 @@ def _ws_kill_tree(pid: int, force: bool = False) -> None:
 # what is still in flight and exits. Servers/apps already left running are not in this set.
 _INFLIGHT_CMDS: set = set()
 
+# A STOP NEVER LANDS INSIDE A FILE WRITE (task #302). The handler used to os._exit at once, and a
+# workspace write was open(path, "w") — which EMPTIES the file first — then write(): a Ctrl+C in
+# between left the user's file empty or cut off. Writes are now atomic (_ws_write_file), and a
+# stop that arrives DURING one only sets `requested`; the writer exits the moment it is done.
+# Anywhere else — a model call, which is most of a turn — the stop is immediate, as before.
+_STOP = {"writing": 0, "requested": False}
 
-def _on_sigterm(signum, frame):  # noqa: ARG001
+
+def _stop_now():
     for pid in list(_INFLIGHT_CMDS):
         _ws_kill_tree(pid, force=True)
     _INFLIGHT_CMDS.clear()
     try:
-        _log("stopped by the worker (SIGTERM) — killed the command in flight")
+        _log("stopped by the worker — killed the command in flight")
     except Exception:  # noqa: BLE001
         pass
     os._exit(143)
 
 
+def _request_stop():
+    if _STOP["writing"] > 0:
+        _STOP["requested"] = True
+        return
+    _stop_now()
+
+
+def _on_sigterm(signum, frame):  # noqa: ARG001
+    _request_stop()
+
+
+def _watch_stop_file(path: str):
+    """WINDOWS HAS NO SIGTERM: the worker's kill there is TerminateProcess, which no handler sees.
+    So the worker creates this file first and kills only after a grace period — and this thread
+    turns the file into the same safe stop the POSIX signal gets."""
+    import threading
+    import time as _t
+
+    def _loop():
+        while True:
+            try:
+                if os.path.exists(path):
+                    _request_stop()
+                    return
+            except Exception:  # noqa: BLE001
+                pass
+            _t.sleep(0.2)
+
+    threading.Thread(target=_loop, name="gu-stop-file", daemon=True).start()
+
+
 def _install_sigterm_handler():
     import signal
     try:
         signal.signal(signal.SIGTERM, _on_sigterm)
     except (ValueError, OSError):  # not the main thread, or a platform without it
         pass
+    stop_file = os.environ.get("GONEXT_STOP_FILE", "").strip()
+    if stop_file:
+        _watch_stop_file(stop_file)
+
+
+def _ws_write_file(path: str, content: str, action: str, backup) -> None:
+    """Write a workspace file SAFELY TO STOP AT ANY MOMENT (task #302).
+
+      1. The change goes on the undo list FIRST — a stop right after the write is still undoable.
+      2. The content goes to a temp file beside the target and is swapped in with os.replace, so
+         the file is always wholly the old version or wholly the new one, even under a hard kill.
+      3. A stop requested meanwhile waits for the swap (see _STOP), then happens.
+
+    A symlink is written THROUGH (its target is replaced, the link stays), as open(path, "w")
+    did. Windows can refuse the swap while another program holds the file; then it falls back to
+    the direct write rather than failing the edit.
+    """
+    import tempfile
+    _ws_record_change(action, path, backup)
+    target = os.path.realpath(path)
+    _STOP["writing"] += 1
+    try:
+        fd, tmp = tempfile.mkstemp(prefix=".gu-write-", suffix=".tmp", dir=os.path.dirname(target) or ".")
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as fh:
+                fh.write(content)
+                fh.flush()
+                os.fsync(fh.fileno())
+            if os.path.exists(target):
+                import shutil
+                shutil.copymode(target, tmp)
+            else:
+                mask = os.umask(0)
+                os.umask(mask)
+                os.chmod(tmp, 0o666 & ~mask)
+            try:
+                os.replace(tmp, target)
+            except PermissionError:
+                if not _IS_WINDOWS:
+                    raise
+                with open(target, "w", encoding="utf-8") as fh:
+                    fh.write(content)
+                os.unlink(tmp)
+        except BaseException:
+            try:
+                os.unlink(tmp)
+            except OSError:
+                pass
+            raise
+    finally:
+        _STOP["writing"] -= 1
+        if _STOP["writing"] == 0 and _STOP["requested"]:
+            _stop_now()
 
 
 def _ws_pgroup_pids(pgid: int) -> list:
@@ -10328,10 +10504,15 @@ def run_agent_chat(cfg):
                 # tries a normal error gets. The attempt count is decided per-error: we start
                 # with the generic budget and extend it the moment we see a gateway error.
                 attempt, max_attempts = 0, 3
+                # Task #302 part 3: when the network went away. None = online.
+                offline = {"since": None, "n": 0, "said": 0.0}
                 while attempt < max_attempts:
                     try:
                         msg = self._generate_once(*args, **kwargs)
                         last_err = None
+                        if offline["since"] is not None:
+                            _emit({"type": "step", "text": "Connection back — continuing"})
+                            _log(f"connection back after {time.monotonic() - offline['since']:.0f}s")
                         break
                     except Exception as e:  # noqa: BLE001
                         emsg = str(e)
@@ -10395,6 +10576,37 @@ def run_agent_chat(cfg):
                                 "names (for Ollama use the tag, e.g. qwen3:14b)."
                             ) from e
                         last_err = e
+                        # THE NETWORK WENT AWAY (task #302, part 3). Not an attempt: the same
+                        # step waits for the connection and is sent again — everything this turn
+                        # did so far is still in this process, so nothing is redone and nothing is
+                        # undone. Only a wait past the budget ends the turn, as FAILED (never as a
+                        # stop), with "continue" as the way on.
+                        if _is_offline(e, _host_of(coding_base_url)):
+                            _host = _host_of(coding_base_url)
+                            now = time.monotonic()
+                            if offline["since"] is None:
+                                offline.update(since=now, n=0, said=now)
+                                _emit({"type": "step", "text": (
+                                    f"Lost the connection to {_host} — waiting for it to come back…")})
+                            waited = now - offline["since"]
+                            budget = _offline_wait_budget()
+                            if waited < budget:
+                                offline["n"] += 1
+                                if now - offline["said"] >= 60:
+                                    offline["said"] = now
+                                    _emit({"type": "step", "text": (
+                                        f"Still waiting for the connection to {_host}… "
+                                        f"({waited / 60:.0f} min)")})
+                                delay = min(_offline_delay(offline["n"]), max(1.0, budget - waited))
+                                _log(f"offline ({_clip(emsg, 120)}) — waited {waited:.0f}s, "
+                                     f"retrying the same step in {delay:.0f}s")
+                                time.sleep(delay)
+                                continue
+                            raise _AgentOffline(
+                                f"Lost the connection to {_host} for {budget / 60:.0f} minutes, so "
+                                "the turn could not go on. The work so far is kept — nothing was "
+                                "undone. Type continue to pick up once you are back online."
+                            ) from e
                         # An OVERLOAD (429/rate limit, task #114) is its own class: the
                         # server answered and told us to slow down, so it needs a PATIENT,
                         # jittered backoff rather than the gateway policy's prompt re-send.
@@ -11997,9 +12209,7 @@ def run_agent_chat(cfg):
                     new_lines[-1] += "\n"
                 old_lines = lines[s - 1:e]
                 lines[s - 1:e] = new_lines
-                with open(rp, "w", encoding="utf-8") as fh:
-                    fh.writelines(lines)
-                _ws_record_change("edit", rp, backup)
+                _ws_write_file(rp, "".join(lines), "edit", backup)
                 _emit({"type": "step", "text": _render_edit_card(
                     "Update", rp,
                     f"Replaced lines {s}-{e} with {len(new_lines)} line(s)",
@@ -12046,9 +12256,7 @@ def run_agent_chat(cfg):
                     _last_obs["text"] = msg
                     return msg
                 backup = _ws_snapshot(rp)
-                with open(rp, "w", encoding="utf-8") as fh:
-                    fh.write(text.replace(old_string, new_string, 1))
-                _ws_record_change("edit", rp, backup)
+                _ws_write_file(rp, text.replace(old_string, new_string, 1), "edit", backup)
                 start_no = text[:text.index(old_string)].count("\n") + 1
                 old_ls = old_string.splitlines() or [""]
                 new_ls = new_string.splitlines() or [""]
@@ -12114,9 +12322,7 @@ def run_agent_chat(cfg):
                     return msg
                 backup = _ws_snapshot(rp) if existed else ""
                 os.makedirs(os.path.dirname(rp) or ".", exist_ok=True)
-                with open(rp, "w", encoding="utf-8") as fh:
-                    fh.write(content)
-                _ws_record_change("edit" if existed else "create", rp, backup or None)
+                _ws_write_file(rp, content, "edit" if existed else "create", backup or None)
                 content_ls = content.splitlines() or [""]
                 _emit({"type": "step", "text": _render_edit_card(
                     "Update" if existed else "Create", rp,

package/gu-cli.mjs

@@ -17,7 +17,8 @@ import { accent } from "./accent.mjs";
 requireSupportedNode();
 import { mkdir, mkdtemp, readFile, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { execFile as execFileCallback, spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { writeFileSync, unlinkSync } from "node:fs";
 import { createTaskPool, createFolderQueue } from "./job-pools.mjs";
 import { NO_STEP, foldStepTokens, withStepTokens } from "./step-tokens.mjs";
 import { agentStoppedLine, jobEnded, jobStatusFrom409, stopGracefully } from "./agent-stop.mjs";
@@ -1743,6 +1744,39 @@ async function workerFetch(path, init = {}) {
   return fetch(url, { ...init, headers });
 }
 
+/**
+ * workerFetch that WAITS OUT A LOST NETWORK (task #302, part 3) — for the writes that must land,
+ * like a finished turn's result. A remote API unreachable is usually this machine being offline for
+ * a moment; the work is done and only its report is waiting, so it is retried with backoff for the
+ * offline budget (GONEXT_OFFLINE_WAIT_S, default 10 min) rather than lost. Only NETWORK errors are
+ * retried — an HTTP answer, even an error, is returned as it is — and a local API is not waited for
+ * (unreachable there means the API process is gone).
+ */
+async function workerFetchPatient(path, init = {}, { sleep = (ms) => new Promise((r) => setTimeout(r, ms)) } = {}) {
+  let local = false;
+  try {
+    const h = new URL(apiBase).hostname;
+    local = h === "localhost" || h === "::1" || h.startsWith("127.");
+  } catch {
+    /* no base — the plain call will say so */
+  }
+  const budgetMs = (() => {
+    const v = Number(process.env.GONEXT_OFFLINE_WAIT_S);
+    return (Number.isFinite(v) && v >= 0 ? v : 600) * 1000;
+  })();
+  const started = Date.now();
+  for (let n = 1; ; n++) {
+    try {
+      return await workerFetch(path, init);
+    } catch (err) {
+      const network = err instanceof TypeError || /fetch failed|ECONN|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|socket hang up/i.test(String(err?.message ?? err));
+      if (local || !network || Date.now() - started >= budgetMs) throw err;
+      if (n === 1) console.log(`[gu-worker] ${path}: the API is unreachable (${String(err?.message ?? err).slice(0, 80)}) — waiting for the network`);
+      await sleep(Math.min(2000 * n, 15000));
+    }
+  }
+}
+
 async function ensureWorkerOk(res, context) {
   if (res.ok) return;
   const snippet = (await res.text().catch(() => "")).trim().slice(0, 500);
@@ -1887,29 +1921,12 @@ if (args[0] === "workspace") {
       console.error(`[gu-worker] workspace revert: no manifest for run ${runId} (${manifestPath})`);
       process.exit(1);
     }
-    let restored = 0, deleted = 0, failed = 0;
-    for (const c of manifest?.changes ?? []) {
-      try {
-        if (c.action === "edit" && c.backup && ex(c.backup)) {
-          await copyFile(c.backup, c.path);
-          restored += 1;
-          console.log(`  restored ${c.path}`);
-        } else if (c.action === "create" && ex(c.path)) {
-          await unlink(c.path);
-          deleted += 1;
-          console.log(`  deleted  ${c.path}`);
-        } else if (c.action === "create_dir" && ex(c.path)) {
-          // rmdir only removes an EMPTY dir — a revert must never destroy content
-          // the user (or a later run) put inside the created folder afterwards.
-          await rmdir(c.path);
-          deleted += 1;
-          console.log(`  removed  ${c.path}/`);
-        }
-      } catch (err) {
-        failed += 1;
-        console.error(`  FAILED   ${c.path}: ${err.message}`);
-      }
-    }
+    // One step per path from its EARLIEST entry (workspace-revert.mjs, #302): replaying the log
+    // in order deleted a file the run created and then brought it back from its "edit" backup.
+    const { planRevert, applyRevert } = await import("./workspace-revert.mjs");
+    const r = await applyRevert(planRevert(manifest?.changes ?? []), { exists: ex });
+    for (const l of r.lines) (l.startsWith("FAILED") ? console.error : console.log)(`  ${l}`);
+    const { restored, deleted, failed } = r;
     console.log(
       `[gu-worker] workspace revert ${runId}: ${restored} restored, ${deleted} created-file(s) deleted` +
         (failed ? `, ${failed} FAILED` : "") +
@@ -2452,7 +2469,11 @@ function runProcessWithStreamingStdout(cmd, cmdArgs, stdinStr, timeoutMs, onLine
     // lone surrogates and only blows up later, encoding the model request. gonext_agent_chat.py
     // also reconfigures its own streams; this covers the scripts that don't.
     const spawnOpts = { stdio: ["pipe", "pipe", "pipe"] };
-    spawnOpts.env = { ...process.env, PYTHONUTF8: "1", ...(extraEnv ?? {}) };
+    // Task #302: where to ask the agent to stop on Windows (see stopGracefully) — a file it
+    // watches, so a stop waits for a file write in progress instead of cutting it in half.
+    const stopFile = join(tmpdir(), `gu-agent-stop-${randomUUID()}`);
+    spawnOpts.env = { ...process.env, PYTHONUTF8: "1", GONEXT_STOP_FILE: stopFile, ...(extraEnv ?? {}) };
+    const requestStop = () => writeFileSync(stopFile, "stop");
     const child = spawn(cmd, cmdArgs, spawnOpts);
     let stderr = "";
     let lineBuffer = "";
@@ -2470,7 +2491,7 @@ function runProcessWithStreamingStdout(cmd, cmdArgs, stdinStr, timeoutMs, onLine
       if (typeof onTimeout !== "function") {
         timedOut = true;
         timerLive = false;
-        cancelHardKill = stopGracefully(child);
+        cancelHardKill = stopGracefully(child, { requestStop });
         return;
       }
       let extend = false;
@@ -2486,7 +2507,7 @@ function runProcessWithStreamingStdout(cmd, cmdArgs, stdinStr, timeoutMs, onLine
       }
       timedOut = true;
       timerLive = false;
-      cancelHardKill = stopGracefully(child);
+      cancelHardKill = stopGracefully(child, { requestStop });
     };
     const timer = setTimeout(fireTimeout, timeoutMs);
     // User-requested cancel (gu Ctrl+C): kill the Python agent so it stops burning
@@ -2497,7 +2518,7 @@ function runProcessWithStreamingStdout(cmd, cmdArgs, stdinStr, timeoutMs, onLine
     const onAbort = () => {
       if (aborted) return;
       aborted = true;
-      cancelHardKill = stopGracefully(child);
+      cancelHardKill = stopGracefully(child, { requestStop });
     };
     if (abortSignal) {
       if (abortSignal.aborted) onAbort();
@@ -2532,6 +2553,11 @@ function runProcessWithStreamingStdout(cmd, cmdArgs, stdinStr, timeoutMs, onLine
       timerLive = false;
       clearTimeout(timer);
       cancelHardKill();
+      try {
+        unlinkSync(stopFile);
+      } catch {
+        /* never asked to stop — no file */
+      }
       if (abortSignal) abortSignal.removeEventListener?.("abort", onAbort);
       // Drain any remaining buffered line
       const remaining = lineBuffer.trim();
@@ -4257,7 +4283,8 @@ async function runAgentChatJob(job) {
     await flushChunks();
 
     const totalTimeSeconds = (Date.now() - start) / 1000;
-    const doneRes = await workerFetch(`/api/worker/jobs/${jobId}`, {
+    // Patient (#302 part 3): the turn is DONE; a network blip now must not throw its result away.
+    const doneRes = await workerFetchPatient(`/api/worker/jobs/${jobId}`, {
       method: "PATCH",
       body: JSON.stringify({
         jobStatus: "completed",