@tiens.nguyen/gu-cli 1.0.818 → 1.0.821

package/gonext_agent_chat.py

@@ -7346,6 +7346,477 @@ def _shell_syntax_error(command, argv):
                 "later read of it finds no such file. You already RECEIVE the command's output, "
                 "so just run it; use create_file if you genuinely need the text on disk.")
     return None
+
+
+# ---- a REAL SHELL for run_command, checked per command (task #359, GitHub #139) ----------------
+# The no-shell rule above cost more than it protected. Over 21 days the model wrote a pipe ~207
+# times, `||` 60, `;` 30 — each refused and retried as another full model step — and 51 turns wrote
+# a body file only because `gh … --body` could not take multi-line text. It was never a sandbox
+# either: `python3 -c "import os; os.system('…')"` always ran anything. So on macOS/Linux a command
+# that NEEDS a shell now runs through `bash -c`, the way Claude Code's Bash tool does, and the
+# safety moves to where it can actually work: the line is scanned into its simple commands —
+# including those inside $( ), backticks and heredoc-fed commands — and EACH one goes through the
+# same checks an argv command gets (privilege, deny/allow lists, delete outside the project), plus
+# the two things only a shell can do: write outside the project with a redirect, and pipe text into
+# an interpreter. A command with no shell syntax still runs as argv, exactly as before.
+# Windows keeps the argv path (no bash to rely on there yet).
+_SHELL_OPS = ("&&", "||", ";;", "|&", "<<<", "<<-", "<<", "&>>", "&>", ">>", ">&", "<&", "<>",
+              ">|", ";", "|", "&", "(", ")", ">", "<")
+_SHELL_SEPARATORS = {"&&", "||", ";", ";;", "|", "|&", "&", "\n", "(", ")"}
+_SHELL_WRITE_REDIRECTS = {">", ">>", ">|", "&>", "&>>", "<>"}
+# Runners that execute TEXT as code. Piping into one with no script argument (`curl … | sh`) is the
+# shape a prompt injection takes, so it is blocked when nobody can be asked.
+_SHELL_INTERPRETERS = {"sh", "bash", "zsh", "dash", "ksh", "fish", "python", "python3", "node",
+                       "perl", "ruby", "php", "pwsh", "powershell"}
+_SHELL_EVAL_RUNNERS = {"eval", "source", "."}
+_SHELL_HARMLESS_TARGETS = {"/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty"}
+
+
+def _shell_scan(command):
+    """Tokenise a shell line the way bash reads it. PURE. → dict:
+
+    tokens   — ("word", unquoted text, start, end, quoted) / ("op", text, start, end, False);
+               start/end index the ORIGINAL string, so a word can be edited in place
+    substs   — [{"text", "tokens"}] for every $( ) and backtick body (scanned the same way)
+    heredocs — how many heredocs were read (their bodies are DATA and appear in no token)
+    expands  — True when an unquoted $, glob or leading ~ needs the shell to expand it
+    error    — why the line cannot be run (unbalanced quote, heredoc never closed), or None
+    """
+    out = {"tokens": [], "substs": [], "heredocs": 0, "expands": False, "error": None}
+    try:
+        _shell_scan_into(command or "", 0, out, out["tokens"], nested=False)
+    except ValueError as e:
+        out["error"] = str(e)
+    return out
+
+
+def _shell_scan_into(s, i, out, toks, nested):
+    """Scan from `i` into `toks`. nested=True stops at the `)` closing a $( and returns past it."""
+    n = len(s)
+    st = {"word": None, "start": 0, "quoted": False, "delim_op": None}
+    pending = []  # heredocs whose body starts after the next newline: (delimiter, op)
+    depth = 0
+
+    def start_word(at):
+        if st["word"] is None:
+            st["word"], st["start"] = [], at
+
+    def end_word(at):
+        if st["word"] is None:
+            return
+        text = "".join(st["word"])
+        if st["delim_op"]:
+            pending.append((text, st["delim_op"]))
+            st["delim_op"] = None
+            out["heredocs"] += 1
+        toks.append(("word", text, st["start"], at, st["quoted"]))
+        st["word"], st["quoted"] = None, False
+
+    def subst(j):  # j = index just past "$("
+        inner = []
+        k = _shell_scan_into(s, j, out, inner, nested=True)
+        out["substs"].append({"text": s[j:k - 1], "tokens": inner})
+        out["expands"] = True
+        return k
+
+    def backtick(j):  # j = index of the opening `
+        k = j + 1
+        while k < n and s[k] != "`":
+            k += 2 if s[k] == "\\" else 1
+        if k >= n:
+            raise ValueError("unbalanced backtick")
+        inner = []
+        _shell_scan_into(s[j + 1:k], 0, out, inner, nested=False)
+        out["substs"].append({"text": s[j + 1:k], "tokens": inner})
+        out["expands"] = True
+        return k + 1
+
+    def closing(j, opener, closer):  # j = index of opener's first char → index past its closer
+        k, d = j + len(opener), 1
+        while k < n and d:
+            if s.startswith(opener, k):
+                d, k = d + 1, k + len(opener)
+            elif s.startswith(closer, k):
+                d, k = d - 1, k + len(closer)
+            else:
+                k += 1
+        if d:
+            raise ValueError(f"unbalanced {opener}")
+        return k
+
+    def dollar(j):  # a `$` at j, outside single quotes → index past the expansion, or None
+        if s.startswith("$((", j):
+            out["expands"] = True
+            return _past(j + 1, "(", ")")
+        if s.startswith("$(", j):
+            return subst(j + 2)
+        if s.startswith("${", j):
+            out["expands"] = True
+            return closing(j + 1, "{", "}")
+        if j + 1 < n and (s[j + 1].isalnum() or s[j + 1] in "_@*#?$!-"):
+            out["expands"] = True
+        return None
+
+    def _past(j, o, c):  # j = index of the first o of a balanced o…c run
+        k, d = j, 0
+        while k < n:
+            if s[k] == o:
+                d += 1
+            elif s[k] == c:
+                d -= 1
+                if d == 0:
+                    return k + 1
+            k += 1
+        raise ValueError("unbalanced $((")
+
+    while i < n:
+        c = s[i]
+        w = st["word"]
+        if c in " \t":
+            end_word(i)
+            i += 1
+            continue
+        if c == "\n":
+            end_word(i)
+            toks.append(("op", "\n", i, i + 1, False))
+            i += 1
+            if pending:
+                i = _shell_heredoc_bodies(s, i, pending)
+                pending.clear()
+            continue
+        if c == "#" and w is None:
+            j = s.find("\n", i)
+            i = n if j < 0 else j
+            continue
+        if c == "\\":
+            if i + 1 < n and s[i + 1] == "\n":
+                i += 2
+                continue
+            start_word(i)
+            if i + 1 < n:
+                st["word"].append(s[i + 1])
+            st["quoted"] = True
+            i += 2
+            continue
+        if c == "'":
+            start_word(i)
+            j = s.find("'", i + 1)
+            if j < 0:
+                raise ValueError("unbalanced single quote")
+            st["word"].extend(s[i + 1:j])
+            st["quoted"] = True
+            i = j + 1
+            continue
+        if c == '"':
+            start_word(i)
+            st["quoted"] = True
+            i += 1
+            while True:
+                if i >= n:
+                    raise ValueError("unbalanced double quote")
+                d = s[i]
+                if d == '"':
+                    i += 1
+                    break
+                if d == "\\" and i + 1 < n and s[i + 1] in '"\\$`\n':
+                    if s[i + 1] != "\n":
+                        st["word"].append(s[i + 1])
+                    i += 2
+                    continue
+                if d == "$":
+                    k = dollar(i)
+                    if k is not None:
+                        st["word"].extend(s[i:k])
+                        i = k
+                        continue
+                if d == "`":
+                    k = backtick(i)
+                    st["word"].extend(s[i:k])
+                    i = k
+                    continue
+                st["word"].append(d)
+                i += 1
+            continue
+        if c == "$":
+            k = dollar(i)
+            if k is not None:
+                start_word(i)
+                st["word"].extend(s[i:k])
+                i = k
+                continue
+        if c == "`":
+            start_word(i)
+            k = backtick(i)
+            st["word"].extend(s[i:k])
+            i = k
+            continue
+        if nested and c == ")" and depth == 0:
+            end_word(i)
+            if pending:
+                raise ValueError(f"heredoc '{pending[0][0]}' has no closing {pending[0][0]} line")
+            return i + 1
+        op = next((o for o in _SHELL_OPS if s.startswith(o, i)), None)
+        if op:
+            if op[0] in "<>" and w is not None and not st["quoted"] and "".join(w).isdigit():
+                st["word"] = None  # `2>`: the fd number belongs to the redirect, not the argv
+            end_word(i)
+            depth += 1 if op == "(" else -1 if op == ")" else 0
+            toks.append(("op", op, i, i + len(op), False))
+            if op in ("<<", "<<-"):
+                st["delim_op"] = op
+            i += len(op)
+            continue
+        start_word(i)
+        if c in "*?[" or (c == "~" and not st["word"]):
+            out["expands"] = True
+        st["word"].append(c)
+        i += 1
+    end_word(n)
+    if nested:
+        raise ValueError("unbalanced $(")
+    if pending:
+        raise ValueError(f"heredoc '{pending[0][0]}' has no closing {pending[0][0]} line")
+    return n
+
+
+def _shell_heredoc_bodies(s, i, pending):
+    """Skip the heredoc bodies that start at `i`, in order. → index past the last delimiter line."""
+    n = len(s)
+    for delim, op in pending:
+        while True:
+            if i >= n:
+                raise ValueError(f"heredoc '{delim}' has no closing {delim} line")
+            j = s.find("\n", i)
+            line = s[i:] if j < 0 else s[i:j]
+            i = n if j < 0 else j + 1
+            if (line.lstrip("\t") if op == "<<-" else line) == delim:
+                break
+    return i
+
+
+def _shell_commands(tokens):
+    """Tokens → the simple commands: [{"argv", "spans", "sep", "redirects"}]. Leading VAR=value
+    assignments and redirects (with their target) are not part of argv; `sep` is the operator
+    that came before the command ("" for the first)."""
+    cmds, cur, sep, i = [], None, "", 0
+    while i < len(tokens):
+        kind, text, a, b, quoted = tokens[i]
+        if kind == "op" and text in _SHELL_SEPARATORS:
+            if cur and (cur["argv"] or cur["redirects"]):
+                cmds.append(cur)
+            cur, sep = None, text
+            i += 1
+            continue
+        if cur is None:
+            cur = {"argv": [], "spans": [], "sep": sep, "redirects": []}
+        if kind == "op":
+            nxt = tokens[i + 1] if i + 1 < len(tokens) else None
+            tgt = nxt[1] if nxt and nxt[0] == "word" else ""
+            cur["redirects"].append((text, tgt))
+            i += 2 if tgt or (nxt and nxt[0] == "word") else 1
+            continue
+        if not cur["argv"] and re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", text):
+            i += 1
+            continue
+        cur["argv"].append(text)
+        cur["spans"].append((a, b))
+        i += 1
+    if cur and (cur["argv"] or cur["redirects"]):
+        cmds.append(cur)
+    return cmds
+
+
+def _shell_needed(scan):
+    """Does this line need a shell to mean what it says? False → run it as argv, as before."""
+    return bool(scan["heredocs"] or scan["substs"] or scan["expands"]
+                or any(t[0] == "op" for t in scan["tokens"]))
+
+
+def _shell_all_commands(scan):
+    """(top-level commands, commands inside $( ) / backticks)."""
+    top = _shell_commands(scan["tokens"])
+    inner = [c for sub in scan["substs"] for c in _shell_commands(sub["tokens"])]
+    return top, inner
+
+
+def _shell_background_error(scan):
+    """A line that puts a command in the background (`npm run dev &`), or None. bash would exit at
+    once and leave that process running where stop_server cannot see it, and the model would read
+    "EXITED 0" as the server having started. run_command already keeps a server running."""
+    if any(t[0] == "op" and t[1] == "&" for t in scan["tokens"]):
+        return ("Error: that command did NOT run. Do not use `&` to background it — run_command "
+                "already leaves a server or app RUNNING when it starts listening or opens a window, "
+                "and reports its URL. Send the same command without the `&`.")
+    return None
+
+
+def _shell_priv_reason(scan):
+    """_ws_priv_reason over every simple command — NOT the raw line, so a heredoc body that merely
+    mentions sudo (an issue comment about it) is data, while `bash -c "sudo …"` is still caught."""
+    top, inner = _shell_all_commands(scan)
+    for c in top + inner:
+        r = _ws_priv_reason(" ".join(c["argv"]))
+        if r:
+            return r
+    return None
+
+
+def _ws_write_outside_reason(redirects, wd, roots=None):
+    """Why a redirect needs the user's yes: it writes a file OUTSIDE every workspace and the temp
+    folder. The shell's counterpart of _ws_delete_outside_reason."""
+    import tempfile
+    targets = [t for op, t in redirects
+               if op in _SHELL_WRITE_REDIRECTS and t and not t.startswith("&")
+               and t not in _SHELL_HARMLESS_TARGETS]
+    if not targets:
+        return None
+    ws = [os.path.realpath(r["path"]) for r in (_WS_ROOTS if roots is None else roots) if r.get("path")]
+    if not ws:
+        return None
+    temp = [os.path.realpath(p) for p in {tempfile.gettempdir(), "/tmp", "/var/tmp"} if p]
+    outside = []
+    for t in targets:
+        p = os.path.expanduser(t)
+        p = os.path.realpath(p if os.path.isabs(p) else os.path.join(wd or os.getcwd(), p))
+        if not (_ws_is_inside(p, ws) or _ws_is_inside(p, temp)):
+            outside.append(t)
+    if not outside:
+        return None
+    return "it writes a file OUTSIDE the project (" + ", ".join(outside[:3]) + ")"
+
+
+def _ws_shell_command_risk(scan, denyset, wd="", allowset=None, roots=None):
+    """The run policy for a SHELL line, applied to each simple command in it.
+
+    → (refuse, hard_reason, ask_reason): `refuse` is a finished error message (allowlist — never
+    asked, same as argv); hard/ask follow _ws_command_risk's contract (hard = block when nobody can
+    be asked, ask = confirm when someone can)."""
+    top, inner = _shell_all_commands(scan)
+    every = top + inner
+    if allowset:
+        for c in every:
+            r = c["argv"][0] if c["argv"] else ""
+            if r and r not in allowset and os.path.basename(r) not in allowset:
+                return (f"Error: '{r}' is not in your run allowlist. Add it in web Settings → Agent, "
+                        "or clear the allowlist to allow all commands.", None, None)
+    priv = _shell_priv_reason(scan)
+    if priv:
+        return (None, priv, priv)
+    for c in every:
+        r = c["argv"][0] if c["argv"] else ""
+        if r and denyset and (r in denyset or os.path.basename(r) in denyset):
+            msg = f"'{r}' is on your blocked-commands list"
+            return (None, msg, msg)
+    # Deletes and redirect-writes outside the project, following `cd` the way the shell will.
+    cur = wd
+    for c in top:
+        a = c["argv"]
+        if a and a[0] == "cd" and len(a) >= 2 and c["sep"] not in ("|", "|&"):
+            cur = os.path.normpath(os.path.join(cur or os.getcwd(), os.path.expanduser(a[1])))
+            continue
+        why = (_ws_delete_outside_reason(a, cur, roots)
+               or _ws_write_outside_reason(c["redirects"], cur, roots))
+        if why:
+            return (None, why, why)
+    for c in inner:
+        why = _ws_delete_outside_reason(c["argv"], wd, roots)
+        if why:
+            return (None, why, why)
+    for c in top:
+        a = c["argv"]
+        r = os.path.basename(a[0]).lower() if a else ""
+        if c["sep"] in ("|", "|&") and r in _SHELL_INTERPRETERS \
+                and all(x.startswith("-") for x in a[1:]):
+            msg = f"it pipes text into {r}, which runs that text as code"
+            return (None, msg, msg)
+    for c in every:
+        a = c["argv"]
+        if not a:
+            continue
+        if a[0] in _SHELL_EVAL_RUNNERS:
+            return (None, None, f"it runs text as code ({a[0]})")
+        if "$" in a[0] or "`" in a[0]:
+            return (None, None, f"the program to run is only known at run time ({a[0][:40]})")
+    for c in every:
+        if _WS_DESTRUCTIVE_RE.search(" ".join(c["argv"])):
+            return (None, None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None, None)
+
+
+def _with_attribution_text(command, scan, settings):
+    """_with_attribution for a SHELL line: the co-author trailer is inserted into the text right
+    after each top-level `git … commit` word. → (command, note). A gh pr create body written as a
+    heredoc cannot be appended to safely, so it is left alone and said so in the note."""
+    import shlex as _shlex
+    name = str(settings.get("name") or "").strip()
+    email = str(settings.get("email") or "").strip()
+    cmds = _shell_commands(scan["tokens"])
+    notes = []
+    if settings.get("commit") and name and email and email.lower() not in command.lower():
+        at = []
+        for c in cmds:
+            i, sub = _git_subcommand(c["argv"])
+            if sub == "commit":
+                at.append(c["spans"][i][1])
+        if at:
+            trailer = " --trailer " + _shlex.quote(f"Co-Authored-By: {name} <{email}>")
+            for pos in sorted(at, reverse=True):
+                command = command[:pos] + trailer + command[pos:]
+            notes.append(f"co-author trailer added ({name})")
+    if settings.get("pr") and any(c["argv"][:3] == ["gh", "pr", "create"] for c in cmds):
+        notes.append("PR footer not added (shell form)")
+    return command, "; ".join(notes)
+
+
+_RUN_SHELL_BIN = None
+
+
+def _run_shell_bin():
+    """bash (else sh) for run_command's shell lines, or "" for the argv-only path: Windows, or
+    GU_RUN_NO_SHELL=1 (the way back if a shell line ever misbehaves for a user)."""
+    global _RUN_SHELL_BIN
+    if os.name == "nt" or os.environ.get("GU_RUN_NO_SHELL") == "1":
+        return ""
+    if _RUN_SHELL_BIN is None:
+        import shutil as _sh
+        _RUN_SHELL_BIN = next((p for p in (_sh.which("bash"), "/bin/bash", "/bin/sh")
+                               if p and os.path.exists(p)), "")
+    return _RUN_SHELL_BIN
+
+
+def _run_command_prompt_line(shell):
+    """The system prompt's run_command rule. With a shell it carries the git and GitHub recipes,
+    the way Claude Code's Bash tool description does: told how to batch, the model does (#359)."""
+    if not shell:
+        return (
+            "    run_command CHAINS: put dependent commands in ONE call with && — e.g. "
+            "run_command(\"cd app && ./gradlew assembleDebug && adb install -r app/build/outputs/apk/debug/app-debug.apk\") "
+            "— they run in order, `cd` sets the folder for the rest, and the first failure stops the "
+            "chain. There is NO shell otherwise: pipes `|`, redirects `>`, `;`, `||` and backticks do "
+            "NOT work (use python3 for anything that composes). `sudo`/`su` are blocked; an "
+            "interactive input() CLI fails with EOFError. A server or GUI app is left RUNNING — "
+            "stop_server closes it.\n")
+    return (
+        "    run_command IS A SHELL (bash): pipes, redirects, `;`, `||`, `$( )`, globs and heredocs "
+        "work, so put a whole sequence in ONE call — dependent steps with &&, independent ones with "
+        "`;` (e.g. `cd app && npm test 2>&1 | tail -40`); a multi-line command goes in a "
+        "triple-quoted string.\n"
+        "    GIT in one call each: look (`git status -sb; git diff --stat; git log --oneline -5`), "
+        "commit (`git add a.py b.py && git commit -m \"msg\" && git log --oneline -1`).\n"
+        "    GITHUB: use `gh`. Multi-line text goes as a heredoc on stdin — "
+        "`gh issue comment 12 --body-file - <<'EOF'` … `EOF` (same for gh issue create / gh pr "
+        "create) — never write a body file first, and do not run `gh auth status` first.\n"
+        "    Read and search FILES with read_file_lines / grep_repo, not cat/grep/sed. `sudo`/`su` "
+        "are blocked; piping into sh/python and writing or deleting outside the project ask the "
+        "user first; an interactive input() CLI fails with EOFError. A server or GUI app is left "
+        "RUNNING — stop_server closes it.\n")
+
+
+_RUN_DOC_ARGV = ("No other shell syntax (no pipes/redirects/;). sudo/su are blocked.")
+_RUN_DOC_SHELL = ("It runs in bash, so pipes, redirects, ;, ||, $( ), globs and heredocs work too "
+                  "(e.g. 'npm test 2>&1 | tail -40'). sudo/su are blocked.")
+
+
 # The terminal's "accept edits" toggle (task #179). True = today's behaviour, where only risky
 # commands are confirmed. False = confirm every command. Module-level default so the tool body
 # reads a real boolean even on a path where run() never set it.
@@ -9579,13 +10050,7 @@ def run_agent_chat(cfg):
         "and reads do not pile up here and are not re-sent on every later step. Then read only "
         "the exact ranges you will edit. Use grep_repo/read_file_lines directly when you already "
         "know the file or the exact string.\n"
-        "    run_command CHAINS: put dependent commands in ONE call with && — e.g. "
-        "run_command(\"cd app && ./gradlew assembleDebug && adb install -r app/build/outputs/apk/debug/app-debug.apk\") "
-        "— they run in order, `cd` sets the folder for the rest, and the first failure stops the "
-        "chain. There is NO shell otherwise: pipes `|`, redirects `>`, `;`, `||` and backticks do "
-        "NOT work (use python3 for anything that composes). `sudo`/`su` are blocked; an "
-        "interactive input() CLI fails with EOFError. A server or GUI app is left RUNNING — "
-        "stop_server closes it.\n"
+        + _run_command_prompt_line(bool(_run_shell_bin())) +
         "    DEPLOY: prefer deploy_web(local_dir, host, user, remote_path, domain) over "
         "hand-written scp/ssh/rsync (it rsyncs over your SSH key and finishes nginx when it "
         "can, else writes deploy.sh and returns the exact commands). KEY auth ONLY "
@@ -13529,7 +13994,6 @@ def run_agent_chat(cfg):
                 _last_obs["text"] = msg
                 return msg
 
-        @tool
         def run_command(command: str, workdir: str = "", timeout_seconds: int = 180) -> str:
             """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Also allows DEPLOY commands (ssh/scp/rsync) — use non-interactive KEY auth (-o BatchMode=yes); never put a password in the command (there is no stdin). Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
 
@@ -13579,7 +14043,21 @@ def run_agent_chat(cfg):
                            "gu-local-worker workspace add <path> --allow-run)")
                     _last_obs["text"] = msg
                     return msg
-                argv = shlex.split(command or "")
+                # A REAL SHELL WHEN THE LINE NEEDS ONE (task #359). Scanned BEFORE shlex.split,
+                # which raises on a heredoc body with an apostrophe in it ("don't").
+                _shell_bin = _run_shell_bin()
+                _scan = _shell_scan(command) if _shell_bin else None
+                if _scan and _scan["error"]:
+                    msg = (f"Error: that command did NOT run — {_scan['error']}. Nothing was "
+                           "executed; fix the quoting and send it again.")
+                    _last_obs["text"] = msg
+                    return msg
+                _use_shell = bool(_scan) and _shell_needed(_scan)
+                _bg_err = _shell_background_error(_scan) if _use_shell else None
+                if _bg_err:
+                    _last_obs["text"] = _bg_err
+                    return _bg_err
+                argv =[_shell_bin, "-c", command] if _use_shell else shlex.split(command or "")
                 if not argv:
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
@@ -13637,7 +14115,7 @@ def run_agent_chat(cfg):
                 # executes the `cd` PROGRAM — which exits 0 with no output — and the step is
                 # reported as a success that did nothing. Refusing costs one step; the observed
                 # alternative cost two hour-long turns and a false report to the user.
-                _shell_err = _shell_syntax_error(command, argv)
+                _shell_err = None if _use_shell else _shell_syntax_error(command, argv)
                 if _shell_err:
                     _log(f"run_command refused shell syntax: {_c(_clip(command, 120))}")
                     _last_obs["text"] = _shell_err
@@ -13646,16 +14124,26 @@ def run_agent_chat(cfg):
                 # `/usr/bin/<x>` can't slip past a bare-name rule.
                 _runner = argv[0]
                 _rbase = os.path.basename(_runner)
-                # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
-                if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
-                    msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
-                           "Settings → Agent, or clear the allowlist to allow all commands.")
-                    _last_obs["text"] = msg
-                    return msg
-                # Risk gate: privilege escalation / denylisted / destructive. When the
-                # client can approve interactively (terminal), PAUSE and ask the user;
-                # otherwise (web) keep hard-blocking the privilege/denylist cases.
-                _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST, wd)
+                if _use_shell:
+                    # Every simple command in the line, including those inside $( ), gets the
+                    # checks an argv command gets — allowlist, privilege, denylist, deletes —
+                    # plus the shell-only ones (redirect outside the project, `| sh`).
+                    _refuse, _hard_reason, _ask_reason = _ws_shell_command_risk(
+                        _scan, _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
+                    if _refuse:
+                        _last_obs["text"] = _refuse
+                        return _refuse
+                else:
+                    # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
+                    if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
+                        msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
+                               "Settings → Agent, or clear the allowlist to allow all commands.")
+                        _last_obs["text"] = msg
+                        return msg
+                    # Risk gate: privilege escalation / denylisted / destructive. When the
+                    # client can approve interactively (terminal), PAUSE and ask the user;
+                    # otherwise (web) keep hard-blocking the privilege/denylist cases.
+                    _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST, wd)
                 # Shift+Tab may have switched it since the turn started (#47).
                 global _accept_edits
                 if _interactive_approval and _job_id:
@@ -13671,7 +14159,7 @@ def run_agent_chat(cfg):
                 # states it. "this needs root and sudo needs a password we cannot type" is a
                 # different question from "sudo is passwordless here", and the user can only
                 # answer the one they are shown.
-                _priv = _ws_priv_reason(command)
+                _priv = _shell_priv_reason(_scan) if _use_shell else _ws_priv_reason(command)
                 _facts = _ws_access_facts() if _priv else None
                 if _priv and _facts and not _facts["can_elevate"]:
                     # REFUSE BEFORE SPAWNING (requirement 5). With no tty, `sudo x` dies with
@@ -13734,13 +14222,21 @@ def run_agent_chat(cfg):
                 log_fh = open(log_path, "wb")
                 # gu as a co-author on the commits it makes (task #289) — after every check
                 # above, which judged the command as the model wrote it.
-                argv, _attrib_note = _with_attribution(argv, _attribution_settings(wd))
+                if _use_shell:
+                    _cmd_text, _attrib_note = _with_attribution_text(
+                        command, _scan, _attribution_settings(wd))
+                    argv = [_shell_bin, "-c", _cmd_text]
+                else:
+                    argv, _attrib_note = _with_attribution(argv, _attribution_settings(wd))
                 if _attrib_note:
                     _log(f"run_command: {_attrib_note}")
-                # Scrubbed env: repo scripts must never see worker secrets.
+                # Scrubbed env: repo scripts must never see worker secrets. A shell line gets an
+                # empty stdin: a heredoc feeds its own, and `--body-file -` without one must
+                # end at EOF rather than wait on the worker's pipe.
                 proc = subprocess.Popen(
                     argv, cwd=wd, env=_ws_scrubbed_env(),
                     stdout=log_fh, stderr=subprocess.STDOUT,
+                    **({"stdin": subprocess.DEVNULL} if _use_shell else {}),
                     **_ws_spawn_kwargs(),
                 )
                 _INFLIGHT_CMDS.add(proc.pid)  # killed with the agent until it is classified
@@ -13866,6 +14362,12 @@ def run_agent_chat(cfg):
                 except Exception:  # noqa: BLE001
                     pass
 
+        # The description says what the command line may contain, which depends on the machine:
+        # bash here, argv only on Windows (#359). Set before tool() reads the docstring.
+        if _run_shell_bin():
+            run_command.__doc__ = run_command.__doc__.replace(_RUN_DOC_ARGV, _RUN_DOC_SHELL)
+        run_command = tool(run_command)
+
         @tool
         def stop_server(port_or_pid: str = "") -> str:
             """Stop a background server OR desktop app previously started by run_command (closes its window). Use when the user asks to stop/kill/close it.

package/gu-repl.mjs

@@ -154,6 +154,7 @@ import {
   parseModelFallback,
 } from "./model-fallback.mjs";
 import { codingChoiceTags, coderDisplayName, coderWhere, whereOfActiveCoder } from "./coding-choice-tags.mjs";
+import { TITLE_POP, TITLE_PUSH, idleTitle, needsSummary, summariseForTitle, titleSeq, trimTitle } from "./terminal-title.mjs";
 import { IMAGE_NEEDS_CLAUDE, coderTakesImagesFor, clipboardImageToFile, fitImageNotice, imageMarkersForDisplay, createImageStore, imagePasteKey, imagePathFromPaste, isClaudeCoderUrl, isImagePasteKey, storeImageFile } from "./image-paste.mjs";
 import {
   isDoubleClick,
@@ -1603,6 +1604,40 @@ if (IS_TTY) {
   process.on("exit", () => _stdoutWrite(PASTE_MODE_OFF));
 }
 
+// THE TAB SAYS WHAT IS BEING WORKED ON (task #357) — see terminal-title.mjs. Until the first
+// question it names the folder, which is already more than the `node /opt/homebrew/…/gu` a
+// terminal shows for a program that never names itself.
+const TITLE_ON = IS_TTY && process.env.GU_NO_TITLE !== "1";
+let _titleSeq = 0; // which question the title belongs to; a late summary for an older one is dropped
+const writeTitle = (text) => {
+  if (TITLE_ON) ui(titleSeq(text));
+};
+if (TITLE_ON) {
+  ui(TITLE_PUSH);
+  writeTitle(idleTitle(process.cwd()));
+  // Hand the title back: restore the one that was there where the terminal keeps a stack, and
+  // clear ours where it does not, so the shell is not left wearing the last question.
+  process.on("exit", () => _stdoutWrite(titleSeq("") + TITLE_POP));
+}
+
+/**
+ * A new question: the trimmed text now, and — only when it had to be cut — the agent model's
+ * few-word summary whenever it arrives. Fire-and-forget by design: it never delays the turn,
+ * never prints, and a summary that lands after the NEXT question is thrown away.
+ */
+function showQuestionInTitle(question) {
+  if (!TITLE_ON) return;
+  const mine = ++_titleSeq;
+  writeTitle(trimTitle(question));
+  if (!needsSummary(question)) return;
+  void (async () => {
+    const settings = await fetchWorkerSettings();
+    if (!settings || mine !== _titleSeq) return;
+    const title = await summariseForTitle(question, settings, { fetchImpl: doctorFetch });
+    if (title && mine === _titleSeq) writeTitle(title);
+  })().catch(() => {});
+}
+
 // ">>" is a MARGIN MARKER like the ● bullets — it hangs in the gutter (no leading gutter) so
 // the user's typed input lands on the SAME text column (GUTTER+1) as the agent's bullets and
 // answer. ">> " is exactly GUTTER-wide, so input aligns; the ">>" right-edge sits at the same
@@ -14348,6 +14383,9 @@ async function main() {
       history.push({ role: "user", content: taskLine });
     }
     await saveSession(cwd, history, { unfinishedTask: isResumeWord(taskLine) ? "" : taskLine });
+    // #357: the tab is this question until the next one. A bare "continue" with nothing to
+    // resume says nothing about the work, so the title it follows stays.
+    if (!isResumeWord(taskLine)) showQuestionInTitle(taskLine);
     try {
       const turnStartMs = Date.now();
       // #323: priced by the coder this turn STARTS on — a /model switch afterwards must not put

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.818",
+  "version": "1.0.821",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -115,6 +115,7 @@
     "model-doctor.mjs",
     "coding-key-prompt.mjs",
     "model-fallback.mjs",
+    "terminal-title.mjs",
     "server-keys.mjs",
     "add-server.mjs",
     "powershell-alias.mjs",

package/terminal-title.mjs

@@ -0,0 +1,165 @@
+/**
+ * THE TERMINAL'S TITLE IS THE QUESTION BEING WORKED ON (task #357).
+ *
+ * Reported: the tab said `node /opt/homebrew/…/gu` — where the gu bin lives, which is what a
+ * terminal shows when the program inside never names itself. With several gu tabs open that is
+ * the same useless string on every one. The ask: show the current turn's question instead,
+ * shortened, and keep it there until the next question.
+ *
+ * TWO STEPS, AND THE FIRST NEVER WAITS FOR THE SECOND. The trimmed question goes up the moment
+ * the turn starts. Only a question too long to fit is then sent to the agent model for a
+ * few-word summary, which replaces the trimmed one if — and only if — it arrives usable and the
+ * user has not asked something else in the meantime. Every way that call can fail (no model
+ * configured, a provider that wants a key this side does not hold, a timeout, a model that
+ * answers with an essay) ends the same way: the trimmed question stays.
+ *
+ * WHY SHORT QUESTIONS ARE NOT SUMMARISED. The agent model is the one the turn itself is about to
+ * use, and a single-GPU Ollama queues requests rather than running them side by side — a summary
+ * of "fix the login test" would cost the turn its first seconds to say the same thing in fewer
+ * words. A question that already fits is its own best title.
+ *
+ * Pure: no terminal and no network of its own. `fetchImpl` is injected, and the caller writes
+ * the bytes.
+ */
+
+/** What fits on a tab next to its neighbours. Terminals clip a title; they do not wrap it. */
+export const TITLE_MAX = 60;
+
+/** How much of a long question the summary is given — the ask is in the opening lines. */
+export const SUMMARY_INPUT_MAX = 1200;
+
+const ELLIPSIS = "…";
+
+/**
+ * One line of plain text, safe to put inside an escape sequence.
+ *
+ * NOT COSMETIC. The title is written as `ESC ] 0 ; <text> BEL`, so a BEL or ESC inside the text
+ * ends the sequence early and the rest is read by the terminal as commands — and the text is
+ * whatever was typed or PASTED as a question. Every C0/C1 control character goes, newlines
+ * included (as spaces: a pasted stack trace is one title, not twenty).
+ */
+export function cleanTitleText(text) {
+  return String(text ?? "")
+    .replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+/** The question cut to fit, on a word boundary when there is one in the last third. */
+export function trimTitle(text, max = TITLE_MAX) {
+  const s = cleanTitleText(text);
+  const chars = Array.from(s); // by code point: never half of an emoji or a Vietnamese letter
+  if (chars.length <= max) return s;
+  const cut = chars.slice(0, max - 1).join("");
+  const space = cut.lastIndexOf(" ");
+  const head = space >= Math.floor((max * 2) / 3) ? cut.slice(0, space) : cut;
+  return head.replace(/[\s,;:.\-–—]+$/u, "") + ELLIPSIS;
+}
+
+/** Only a question that had to be cut is worth a model call (see the header). */
+export function needsSummary(text, max = TITLE_MAX) {
+  return Array.from(cleanTitleText(text)).length > max;
+}
+
+/** The bytes that set the window and tab title. "" hands the title back to the terminal. */
+export function titleSeq(text) {
+  return `\x1b]0;${cleanTitleText(text)}\x07`;
+}
+
+/** xterm's title stack: remember the title that was there, and put it back on the way out.
+ *  Terminals that do not have one ignore both. */
+export const TITLE_PUSH = "\x1b[22;0t";
+export const TITLE_POP = "\x1b[23;0t";
+
+/** What the tab says before anything has been asked. */
+export function idleTitle(folder) {
+  const name = cleanTitleText(String(folder ?? "").split(/[\\/]/).filter(Boolean).pop() ?? "");
+  return name ? `gu · ${trimTitle(name, TITLE_MAX - 5)}` : "gu";
+}
+
+/** Where the agent model answers chat, from a base that may or may not already end in /v1. */
+export function chatEndpoint(url) {
+  const root = String(url ?? "").trim().replace(/\/+$/, "");
+  if (!root) return "";
+  return /\/v1$/i.test(root) ? `${root}/chat/completions` : `${root}/v1/chat/completions`;
+}
+
+/**
+ * The agent model this machine is set to use, from the settings row.
+ *
+ * With a direct URL and no name the API itself sends the literal "default_model" (an MLX server
+ * answers to anything), so the same is sent here rather than skipping the summary on every MLX
+ * host.
+ */
+export function agentModelFromSettings(settings) {
+  const str = (v) => String(v ?? "").trim();
+  const url = str(settings?.agentModelUrl);
+  if (!url) return null;
+  return { url, model: str(settings?.agentModelName) || "default_model" };
+}
+
+export function summaryRequest(model, question) {
+  const q = Array.from(cleanTitleText(question)).slice(0, SUMMARY_INPUT_MAX).join("");
+  return {
+    model,
+    stream: false,
+    max_tokens: 200, // room for a reasoning model to think briefly and still answer
+    messages: [
+      {
+        role: "system",
+        content:
+          "You write window titles. Reply with ONLY a title of at most 8 words that says what " +
+          "the user's request is about, in the language the request is written in. No quotes, " +
+          "no trailing punctuation, no explanation. Do not answer or carry out the request.",
+      },
+      { role: "user", content: `Request:\n${q}` },
+    ],
+  };
+}
+
+/**
+ * The title out of the model's reply, or "" when the reply is not one.
+ *
+ * A model that ignores the instruction and starts answering the question must not get its first
+ * paragraph into the tab, so anything that is not a single short line is refused, and the caller
+ * keeps the trimmed question.
+ */
+export function pickSummary(body, max = TITLE_MAX) {
+  let raw = body?.choices?.[0]?.message?.content;
+  if (typeof raw !== "string") return "";
+  raw = raw.replace(/<think>[\s\S]*?<\/think>/gi, "").trim();
+  const lines = raw.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  if (lines.length !== 1) return "";
+  const line = cleanTitleText(lines[0])
+    .replace(/^title\s*:\s*/i, "")
+    .replace(/^["'“”‘’`*]+|["'“”‘’`*]+$/gu, "")
+    .replace(/[.。!?]+$/u, "")
+    .trim();
+  const n = Array.from(line).length;
+  return n > 0 && n <= max ? line : "";
+}
+
+/**
+ * Ask the agent model for a title. → the title, or "" for every reason there is not one.
+ * Never throws: this runs beside a turn and must not be able to disturb it.
+ */
+export async function summariseForTitle(
+  question,
+  settings,
+  { fetchImpl = fetch, timeoutMs = 20_000 } = {},
+) {
+  const agent = agentModelFromSettings(settings);
+  if (!agent || !needsSummary(question)) return "";
+  try {
+    const res = await fetchImpl(chatEndpoint(agent.url), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(summaryRequest(agent.model, question)),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res?.ok) return "";
+    return pickSummary(await res.json());
+  } catch {
+    return "";
+  }
+}