@tiens.nguyen/gu-cli 1.0.820 → 1.0.822

package/gonext_agent_chat.py

@@ -7346,6 +7346,477 @@ def _shell_syntax_error(command, argv):
                 "later read of it finds no such file. You already RECEIVE the command's output, "
                 "so just run it; use create_file if you genuinely need the text on disk.")
     return None
+
+
+# ---- a REAL SHELL for run_command, checked per command (task #359, GitHub #139) ----------------
+# The no-shell rule above cost more than it protected. Over 21 days the model wrote a pipe ~207
+# times, `||` 60, `;` 30 — each refused and retried as another full model step — and 51 turns wrote
+# a body file only because `gh … --body` could not take multi-line text. It was never a sandbox
+# either: `python3 -c "import os; os.system('…')"` always ran anything. So on macOS/Linux a command
+# that NEEDS a shell now runs through `bash -c`, the way Claude Code's Bash tool does, and the
+# safety moves to where it can actually work: the line is scanned into its simple commands —
+# including those inside $( ), backticks and heredoc-fed commands — and EACH one goes through the
+# same checks an argv command gets (privilege, deny/allow lists, delete outside the project), plus
+# the two things only a shell can do: write outside the project with a redirect, and pipe text into
+# an interpreter. A command with no shell syntax still runs as argv, exactly as before.
+# Windows keeps the argv path (no bash to rely on there yet).
+_SHELL_OPS = ("&&", "||", ";;", "|&", "<<<", "<<-", "<<", "&>>", "&>", ">>", ">&", "<&", "<>",
+              ">|", ";", "|", "&", "(", ")", ">", "<")
+_SHELL_SEPARATORS = {"&&", "||", ";", ";;", "|", "|&", "&", "\n", "(", ")"}
+_SHELL_WRITE_REDIRECTS = {">", ">>", ">|", "&>", "&>>", "<>"}
+# Runners that execute TEXT as code. Piping into one with no script argument (`curl … | sh`) is the
+# shape a prompt injection takes, so it is blocked when nobody can be asked.
+_SHELL_INTERPRETERS = {"sh", "bash", "zsh", "dash", "ksh", "fish", "python", "python3", "node",
+                       "perl", "ruby", "php", "pwsh", "powershell"}
+_SHELL_EVAL_RUNNERS = {"eval", "source", "."}
+_SHELL_HARMLESS_TARGETS = {"/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty"}
+
+
+def _shell_scan(command):
+    """Tokenise a shell line the way bash reads it. PURE. → dict:
+
+    tokens   — ("word", unquoted text, start, end, quoted) / ("op", text, start, end, False);
+               start/end index the ORIGINAL string, so a word can be edited in place
+    substs   — [{"text", "tokens"}] for every $( ) and backtick body (scanned the same way)
+    heredocs — how many heredocs were read (their bodies are DATA and appear in no token)
+    expands  — True when an unquoted $, glob or leading ~ needs the shell to expand it
+    error    — why the line cannot be run (unbalanced quote, heredoc never closed), or None
+    """
+    out = {"tokens": [], "substs": [], "heredocs": 0, "expands": False, "error": None}
+    try:
+        _shell_scan_into(command or "", 0, out, out["tokens"], nested=False)
+    except ValueError as e:
+        out["error"] = str(e)
+    return out
+
+
+def _shell_scan_into(s, i, out, toks, nested):
+    """Scan from `i` into `toks`. nested=True stops at the `)` closing a $( and returns past it."""
+    n = len(s)
+    st = {"word": None, "start": 0, "quoted": False, "delim_op": None}
+    pending = []  # heredocs whose body starts after the next newline: (delimiter, op)
+    depth = 0
+
+    def start_word(at):
+        if st["word"] is None:
+            st["word"], st["start"] = [], at
+
+    def end_word(at):
+        if st["word"] is None:
+            return
+        text = "".join(st["word"])
+        if st["delim_op"]:
+            pending.append((text, st["delim_op"]))
+            st["delim_op"] = None
+            out["heredocs"] += 1
+        toks.append(("word", text, st["start"], at, st["quoted"]))
+        st["word"], st["quoted"] = None, False
+
+    def subst(j):  # j = index just past "$("
+        inner = []
+        k = _shell_scan_into(s, j, out, inner, nested=True)
+        out["substs"].append({"text": s[j:k - 1], "tokens": inner})
+        out["expands"] = True
+        return k
+
+    def backtick(j):  # j = index of the opening `
+        k = j + 1
+        while k < n and s[k] != "`":
+            k += 2 if s[k] == "\\" else 1
+        if k >= n:
+            raise ValueError("unbalanced backtick")
+        inner = []
+        _shell_scan_into(s[j + 1:k], 0, out, inner, nested=False)
+        out["substs"].append({"text": s[j + 1:k], "tokens": inner})
+        out["expands"] = True
+        return k + 1
+
+    def closing(j, opener, closer):  # j = index of opener's first char → index past its closer
+        k, d = j + len(opener), 1
+        while k < n and d:
+            if s.startswith(opener, k):
+                d, k = d + 1, k + len(opener)
+            elif s.startswith(closer, k):
+                d, k = d - 1, k + len(closer)
+            else:
+                k += 1
+        if d:
+            raise ValueError(f"unbalanced {opener}")
+        return k
+
+    def dollar(j):  # a `$` at j, outside single quotes → index past the expansion, or None
+        if s.startswith("$((", j):
+            out["expands"] = True
+            return _past(j + 1, "(", ")")
+        if s.startswith("$(", j):
+            return subst(j + 2)
+        if s.startswith("${", j):
+            out["expands"] = True
+            return closing(j + 1, "{", "}")
+        if j + 1 < n and (s[j + 1].isalnum() or s[j + 1] in "_@*#?$!-"):
+            out["expands"] = True
+        return None
+
+    def _past(j, o, c):  # j = index of the first o of a balanced o…c run
+        k, d = j, 0
+        while k < n:
+            if s[k] == o:
+                d += 1
+            elif s[k] == c:
+                d -= 1
+                if d == 0:
+                    return k + 1
+            k += 1
+        raise ValueError("unbalanced $((")
+
+    while i < n:
+        c = s[i]
+        w = st["word"]
+        if c in " \t":
+            end_word(i)
+            i += 1
+            continue
+        if c == "\n":
+            end_word(i)
+            toks.append(("op", "\n", i, i + 1, False))
+            i += 1
+            if pending:
+                i = _shell_heredoc_bodies(s, i, pending)
+                pending.clear()
+            continue
+        if c == "#" and w is None:
+            j = s.find("\n", i)
+            i = n if j < 0 else j
+            continue
+        if c == "\\":
+            if i + 1 < n and s[i + 1] == "\n":
+                i += 2
+                continue
+            start_word(i)
+            if i + 1 < n:
+                st["word"].append(s[i + 1])
+            st["quoted"] = True
+            i += 2
+            continue
+        if c == "'":
+            start_word(i)
+            j = s.find("'", i + 1)
+            if j < 0:
+                raise ValueError("unbalanced single quote")
+            st["word"].extend(s[i + 1:j])
+            st["quoted"] = True
+            i = j + 1
+            continue
+        if c == '"':
+            start_word(i)
+            st["quoted"] = True
+            i += 1
+            while True:
+                if i >= n:
+                    raise ValueError("unbalanced double quote")
+                d = s[i]
+                if d == '"':
+                    i += 1
+                    break
+                if d == "\\" and i + 1 < n and s[i + 1] in '"\\$`\n':
+                    if s[i + 1] != "\n":
+                        st["word"].append(s[i + 1])
+                    i += 2
+                    continue
+                if d == "$":
+                    k = dollar(i)
+                    if k is not None:
+                        st["word"].extend(s[i:k])
+                        i = k
+                        continue
+                if d == "`":
+                    k = backtick(i)
+                    st["word"].extend(s[i:k])
+                    i = k
+                    continue
+                st["word"].append(d)
+                i += 1
+            continue
+        if c == "$":
+            k = dollar(i)
+            if k is not None:
+                start_word(i)
+                st["word"].extend(s[i:k])
+                i = k
+                continue
+        if c == "`":
+            start_word(i)
+            k = backtick(i)
+            st["word"].extend(s[i:k])
+            i = k
+            continue
+        if nested and c == ")" and depth == 0:
+            end_word(i)
+            if pending:
+                raise ValueError(f"heredoc '{pending[0][0]}' has no closing {pending[0][0]} line")
+            return i + 1
+        op = next((o for o in _SHELL_OPS if s.startswith(o, i)), None)
+        if op:
+            if op[0] in "<>" and w is not None and not st["quoted"] and "".join(w).isdigit():
+                st["word"] = None  # `2>`: the fd number belongs to the redirect, not the argv
+            end_word(i)
+            depth += 1 if op == "(" else -1 if op == ")" else 0
+            toks.append(("op", op, i, i + len(op), False))
+            if op in ("<<", "<<-"):
+                st["delim_op"] = op
+            i += len(op)
+            continue
+        start_word(i)
+        if c in "*?[" or (c == "~" and not st["word"]):
+            out["expands"] = True
+        st["word"].append(c)
+        i += 1
+    end_word(n)
+    if nested:
+        raise ValueError("unbalanced $(")
+    if pending:
+        raise ValueError(f"heredoc '{pending[0][0]}' has no closing {pending[0][0]} line")
+    return n
+
+
+def _shell_heredoc_bodies(s, i, pending):
+    """Skip the heredoc bodies that start at `i`, in order. → index past the last delimiter line."""
+    n = len(s)
+    for delim, op in pending:
+        while True:
+            if i >= n:
+                raise ValueError(f"heredoc '{delim}' has no closing {delim} line")
+            j = s.find("\n", i)
+            line = s[i:] if j < 0 else s[i:j]
+            i = n if j < 0 else j + 1
+            if (line.lstrip("\t") if op == "<<-" else line) == delim:
+                break
+    return i
+
+
+def _shell_commands(tokens):
+    """Tokens → the simple commands: [{"argv", "spans", "sep", "redirects"}]. Leading VAR=value
+    assignments and redirects (with their target) are not part of argv; `sep` is the operator
+    that came before the command ("" for the first)."""
+    cmds, cur, sep, i = [], None, "", 0
+    while i < len(tokens):
+        kind, text, a, b, quoted = tokens[i]
+        if kind == "op" and text in _SHELL_SEPARATORS:
+            if cur and (cur["argv"] or cur["redirects"]):
+                cmds.append(cur)
+            cur, sep = None, text
+            i += 1
+            continue
+        if cur is None:
+            cur = {"argv": [], "spans": [], "sep": sep, "redirects": []}
+        if kind == "op":
+            nxt = tokens[i + 1] if i + 1 < len(tokens) else None
+            tgt = nxt[1] if nxt and nxt[0] == "word" else ""
+            cur["redirects"].append((text, tgt))
+            i += 2 if tgt or (nxt and nxt[0] == "word") else 1
+            continue
+        if not cur["argv"] and re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", text):
+            i += 1
+            continue
+        cur["argv"].append(text)
+        cur["spans"].append((a, b))
+        i += 1
+    if cur and (cur["argv"] or cur["redirects"]):
+        cmds.append(cur)
+    return cmds
+
+
+def _shell_needed(scan):
+    """Does this line need a shell to mean what it says? False → run it as argv, as before."""
+    return bool(scan["heredocs"] or scan["substs"] or scan["expands"]
+                or any(t[0] == "op" for t in scan["tokens"]))
+
+
+def _shell_all_commands(scan):
+    """(top-level commands, commands inside $( ) / backticks)."""
+    top = _shell_commands(scan["tokens"])
+    inner = [c for sub in scan["substs"] for c in _shell_commands(sub["tokens"])]
+    return top, inner
+
+
+def _shell_background_error(scan):
+    """A line that puts a command in the background (`npm run dev &`), or None. bash would exit at
+    once and leave that process running where stop_server cannot see it, and the model would read
+    "EXITED 0" as the server having started. run_command already keeps a server running."""
+    if any(t[0] == "op" and t[1] == "&" for t in scan["tokens"]):
+        return ("Error: that command did NOT run. Do not use `&` to background it — run_command "
+                "already leaves a server or app RUNNING when it starts listening or opens a window, "
+                "and reports its URL. Send the same command without the `&`.")
+    return None
+
+
+def _shell_priv_reason(scan):
+    """_ws_priv_reason over every simple command — NOT the raw line, so a heredoc body that merely
+    mentions sudo (an issue comment about it) is data, while `bash -c "sudo …"` is still caught."""
+    top, inner = _shell_all_commands(scan)
+    for c in top + inner:
+        r = _ws_priv_reason(" ".join(c["argv"]))
+        if r:
+            return r
+    return None
+
+
+def _ws_write_outside_reason(redirects, wd, roots=None):
+    """Why a redirect needs the user's yes: it writes a file OUTSIDE every workspace and the temp
+    folder. The shell's counterpart of _ws_delete_outside_reason."""
+    import tempfile
+    targets = [t for op, t in redirects
+               if op in _SHELL_WRITE_REDIRECTS and t and not t.startswith("&")
+               and t not in _SHELL_HARMLESS_TARGETS]
+    if not targets:
+        return None
+    ws = [os.path.realpath(r["path"]) for r in (_WS_ROOTS if roots is None else roots) if r.get("path")]
+    if not ws:
+        return None
+    temp = [os.path.realpath(p) for p in {tempfile.gettempdir(), "/tmp", "/var/tmp"} if p]
+    outside = []
+    for t in targets:
+        p = os.path.expanduser(t)
+        p = os.path.realpath(p if os.path.isabs(p) else os.path.join(wd or os.getcwd(), p))
+        if not (_ws_is_inside(p, ws) or _ws_is_inside(p, temp)):
+            outside.append(t)
+    if not outside:
+        return None
+    return "it writes a file OUTSIDE the project (" + ", ".join(outside[:3]) + ")"
+
+
+def _ws_shell_command_risk(scan, denyset, wd="", allowset=None, roots=None):
+    """The run policy for a SHELL line, applied to each simple command in it.
+
+    → (refuse, hard_reason, ask_reason): `refuse` is a finished error message (allowlist — never
+    asked, same as argv); hard/ask follow _ws_command_risk's contract (hard = block when nobody can
+    be asked, ask = confirm when someone can)."""
+    top, inner = _shell_all_commands(scan)
+    every = top + inner
+    if allowset:
+        for c in every:
+            r = c["argv"][0] if c["argv"] else ""
+            if r and r not in allowset and os.path.basename(r) not in allowset:
+                return (f"Error: '{r}' is not in your run allowlist. Add it in web Settings → Agent, "
+                        "or clear the allowlist to allow all commands.", None, None)
+    priv = _shell_priv_reason(scan)
+    if priv:
+        return (None, priv, priv)
+    for c in every:
+        r = c["argv"][0] if c["argv"] else ""
+        if r and denyset and (r in denyset or os.path.basename(r) in denyset):
+            msg = f"'{r}' is on your blocked-commands list"
+            return (None, msg, msg)
+    # Deletes and redirect-writes outside the project, following `cd` the way the shell will.
+    cur = wd
+    for c in top:
+        a = c["argv"]
+        if a and a[0] == "cd" and len(a) >= 2 and c["sep"] not in ("|", "|&"):
+            cur = os.path.normpath(os.path.join(cur or os.getcwd(), os.path.expanduser(a[1])))
+            continue
+        why = (_ws_delete_outside_reason(a, cur, roots)
+               or _ws_write_outside_reason(c["redirects"], cur, roots))
+        if why:
+            return (None, why, why)
+    for c in inner:
+        why = _ws_delete_outside_reason(c["argv"], wd, roots)
+        if why:
+            return (None, why, why)
+    for c in top:
+        a = c["argv"]
+        r = os.path.basename(a[0]).lower() if a else ""
+        if c["sep"] in ("|", "|&") and r in _SHELL_INTERPRETERS \
+                and all(x.startswith("-") for x in a[1:]):
+            msg = f"it pipes text into {r}, which runs that text as code"
+            return (None, msg, msg)
+    for c in every:
+        a = c["argv"]
+        if not a:
+            continue
+        if a[0] in _SHELL_EVAL_RUNNERS:
+            return (None, None, f"it runs text as code ({a[0]})")
+        if "$" in a[0] or "`" in a[0]:
+            return (None, None, f"the program to run is only known at run time ({a[0][:40]})")
+    for c in every:
+        if _WS_DESTRUCTIVE_RE.search(" ".join(c["argv"])):
+            return (None, None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None, None)
+
+
+def _with_attribution_text(command, scan, settings):
+    """_with_attribution for a SHELL line: the co-author trailer is inserted into the text right
+    after each top-level `git … commit` word. → (command, note). A gh pr create body written as a
+    heredoc cannot be appended to safely, so it is left alone and said so in the note."""
+    import shlex as _shlex
+    name = str(settings.get("name") or "").strip()
+    email = str(settings.get("email") or "").strip()
+    cmds = _shell_commands(scan["tokens"])
+    notes = []
+    if settings.get("commit") and name and email and email.lower() not in command.lower():
+        at = []
+        for c in cmds:
+            i, sub = _git_subcommand(c["argv"])
+            if sub == "commit":
+                at.append(c["spans"][i][1])
+        if at:
+            trailer = " --trailer " + _shlex.quote(f"Co-Authored-By: {name} <{email}>")
+            for pos in sorted(at, reverse=True):
+                command = command[:pos] + trailer + command[pos:]
+            notes.append(f"co-author trailer added ({name})")
+    if settings.get("pr") and any(c["argv"][:3] == ["gh", "pr", "create"] for c in cmds):
+        notes.append("PR footer not added (shell form)")
+    return command, "; ".join(notes)
+
+
+_RUN_SHELL_BIN = None
+
+
+def _run_shell_bin():
+    """bash (else sh) for run_command's shell lines, or "" for the argv-only path: Windows, or
+    GU_RUN_NO_SHELL=1 (the way back if a shell line ever misbehaves for a user)."""
+    global _RUN_SHELL_BIN
+    if os.name == "nt" or os.environ.get("GU_RUN_NO_SHELL") == "1":
+        return ""
+    if _RUN_SHELL_BIN is None:
+        import shutil as _sh
+        _RUN_SHELL_BIN = next((p for p in (_sh.which("bash"), "/bin/bash", "/bin/sh")
+                               if p and os.path.exists(p)), "")
+    return _RUN_SHELL_BIN
+
+
+def _run_command_prompt_line(shell):
+    """The system prompt's run_command rule. With a shell it carries the git and GitHub recipes,
+    the way Claude Code's Bash tool description does: told how to batch, the model does (#359)."""
+    if not shell:
+        return (
+            "    run_command CHAINS: put dependent commands in ONE call with && — e.g. "
+            "run_command(\"cd app && ./gradlew assembleDebug && adb install -r app/build/outputs/apk/debug/app-debug.apk\") "
+            "— they run in order, `cd` sets the folder for the rest, and the first failure stops the "
+            "chain. There is NO shell otherwise: pipes `|`, redirects `>`, `;`, `||` and backticks do "
+            "NOT work (use python3 for anything that composes). `sudo`/`su` are blocked; an "
+            "interactive input() CLI fails with EOFError. A server or GUI app is left RUNNING — "
+            "stop_server closes it.\n")
+    return (
+        "    run_command IS A SHELL (bash): pipes, redirects, `;`, `||`, `$( )`, globs and heredocs "
+        "work, so put a whole sequence in ONE call — dependent steps with &&, independent ones with "
+        "`;` (e.g. `cd app && npm test 2>&1 | tail -40`); a multi-line command goes in a "
+        "triple-quoted string.\n"
+        "    GIT in one call each: look (`git status -sb; git diff --stat; git log --oneline -5`), "
+        "commit (`git add a.py b.py && git commit -m \"msg\" && git log --oneline -1`).\n"
+        "    GITHUB: use `gh`. Multi-line text goes as a heredoc on stdin — "
+        "`gh issue comment 12 --body-file - <<'EOF'` … `EOF` (same for gh issue create / gh pr "
+        "create) — never write a body file first, and do not run `gh auth status` first.\n"
+        "    Read and search FILES with read_file_lines / grep_repo, not cat/grep/sed. `sudo`/`su` "
+        "are blocked; piping into sh/python and writing or deleting outside the project ask the "
+        "user first; an interactive input() CLI fails with EOFError. A server or GUI app is left "
+        "RUNNING — stop_server closes it.\n")
+
+
+_RUN_DOC_ARGV = ("No other shell syntax (no pipes/redirects/;). sudo/su are blocked.")
+_RUN_DOC_SHELL = ("It runs in bash, so pipes, redirects, ;, ||, $( ), globs and heredocs work too "
+                  "(e.g. 'npm test 2>&1 | tail -40'). sudo/su are blocked.")
+
+
 # The terminal's "accept edits" toggle (task #179). True = today's behaviour, where only risky
 # commands are confirmed. False = confirm every command. Module-level default so the tool body
 # reads a real boolean even on a path where run() never set it.
@@ -9579,13 +10050,7 @@ def run_agent_chat(cfg):
         "and reads do not pile up here and are not re-sent on every later step. Then read only "
         "the exact ranges you will edit. Use grep_repo/read_file_lines directly when you already "
         "know the file or the exact string.\n"
-        "    run_command CHAINS: put dependent commands in ONE call with && — e.g. "
-        "run_command(\"cd app && ./gradlew assembleDebug && adb install -r app/build/outputs/apk/debug/app-debug.apk\") "
-        "— they run in order, `cd` sets the folder for the rest, and the first failure stops the "
-        "chain. There is NO shell otherwise: pipes `|`, redirects `>`, `;`, `||` and backticks do "
-        "NOT work (use python3 for anything that composes). `sudo`/`su` are blocked; an "
-        "interactive input() CLI fails with EOFError. A server or GUI app is left RUNNING — "
-        "stop_server closes it.\n"
+        + _run_command_prompt_line(bool(_run_shell_bin())) +
         "    DEPLOY: prefer deploy_web(local_dir, host, user, remote_path, domain) over "
         "hand-written scp/ssh/rsync (it rsyncs over your SSH key and finishes nginx when it "
         "can, else writes deploy.sh and returns the exact commands). KEY auth ONLY "
@@ -13529,7 +13994,6 @@ def run_agent_chat(cfg):
                 _last_obs["text"] = msg
                 return msg
 
-        @tool
         def run_command(command: str, workdir: str = "", timeout_seconds: int = 180) -> str:
             """Run a command inside a workspace that has run permission (e.g. 'npm test', 'npm run build', 'npm start', 'mvn test', 'python3 app.py'). One-shot commands return their output when they exit. If the command turns out to be a SERVER (keeps running and listens on a port), it is left RUNNING and its URL is reported. If it is a DESKTOP/GUI app (opens a window — tkinter, pygame, PyQt…), it is LAUNCHED and left running: its window appears on the user's Mac; tell them it's open. Both are stoppable via stop_server. Also allows DEPLOY commands (ssh/scp/rsync) — use non-interactive KEY auth (-o BatchMode=yes); never put a password in the command (there is no stdin). Note: an interactive CLI that reads stdin (input()) cannot be driven here — it will fail with EOFError; make it non-interactive or give the user the command to run themselves.
 
@@ -13579,7 +14043,21 @@ def run_agent_chat(cfg):
                            "gu-local-worker workspace add <path> --allow-run)")
                     _last_obs["text"] = msg
                     return msg
-                argv = shlex.split(command or "")
+                # A REAL SHELL WHEN THE LINE NEEDS ONE (task #359). Scanned BEFORE shlex.split,
+                # which raises on a heredoc body with an apostrophe in it ("don't").
+                _shell_bin = _run_shell_bin()
+                _scan = _shell_scan(command) if _shell_bin else None
+                if _scan and _scan["error"]:
+                    msg = (f"Error: that command did NOT run — {_scan['error']}. Nothing was "
+                           "executed; fix the quoting and send it again.")
+                    _last_obs["text"] = msg
+                    return msg
+                _use_shell = bool(_scan) and _shell_needed(_scan)
+                _bg_err = _shell_background_error(_scan) if _use_shell else None
+                if _bg_err:
+                    _last_obs["text"] = _bg_err
+                    return _bg_err
+                argv =[_shell_bin, "-c", command] if _use_shell else shlex.split(command or "")
                 if not argv:
                     msg = "Error: empty command."
                     _last_obs["text"] = msg
@@ -13637,7 +14115,7 @@ def run_agent_chat(cfg):
                 # executes the `cd` PROGRAM — which exits 0 with no output — and the step is
                 # reported as a success that did nothing. Refusing costs one step; the observed
                 # alternative cost two hour-long turns and a false report to the user.
-                _shell_err = _shell_syntax_error(command, argv)
+                _shell_err = None if _use_shell else _shell_syntax_error(command, argv)
                 if _shell_err:
                     _log(f"run_command refused shell syntax: {_c(_clip(command, 120))}")
                     _last_obs["text"] = _shell_err
@@ -13646,16 +14124,26 @@ def run_agent_chat(cfg):
                 # `/usr/bin/<x>` can't slip past a bare-name rule.
                 _runner = argv[0]
                 _rbase = os.path.basename(_runner)
-                # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
-                if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
-                    msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
-                           "Settings → Agent, or clear the allowlist to allow all commands.")
-                    _last_obs["text"] = msg
-                    return msg
-                # Risk gate: privilege escalation / denylisted / destructive. When the
-                # client can approve interactively (terminal), PAUSE and ask the user;
-                # otherwise (web) keep hard-blocking the privilege/denylist cases.
-                _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST, wd)
+                if _use_shell:
+                    # Every simple command in the line, including those inside $( ), gets the
+                    # checks an argv command gets — allowlist, privilege, denylist, deletes —
+                    # plus the shell-only ones (redirect outside the project, `| sh`).
+                    _refuse, _hard_reason, _ask_reason = _ws_shell_command_risk(
+                        _scan, _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
+                    if _refuse:
+                        _last_obs["text"] = _refuse
+                        return _refuse
+                else:
+                    # Opt-in allowlist lockdown: outside the set = hard refuse, never asked.
+                    if _WS_RUN_ALLOWLIST and _runner not in _WS_RUN_ALLOWLIST and _rbase not in _WS_RUN_ALLOWLIST:
+                        msg = (f"Error: '{_runner}' is not in your run allowlist. Add it in web "
+                               "Settings → Agent, or clear the allowlist to allow all commands.")
+                        _last_obs["text"] = msg
+                        return msg
+                    # Risk gate: privilege escalation / denylisted / destructive. When the
+                    # client can approve interactively (terminal), PAUSE and ask the user;
+                    # otherwise (web) keep hard-blocking the privilege/denylist cases.
+                    _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST, wd)
                 # Shift+Tab may have switched it since the turn started (#47).
                 global _accept_edits
                 if _interactive_approval and _job_id:
@@ -13671,7 +14159,7 @@ def run_agent_chat(cfg):
                 # states it. "this needs root and sudo needs a password we cannot type" is a
                 # different question from "sudo is passwordless here", and the user can only
                 # answer the one they are shown.
-                _priv = _ws_priv_reason(command)
+                _priv = _shell_priv_reason(_scan) if _use_shell else _ws_priv_reason(command)
                 _facts = _ws_access_facts() if _priv else None
                 if _priv and _facts and not _facts["can_elevate"]:
                     # REFUSE BEFORE SPAWNING (requirement 5). With no tty, `sudo x` dies with
@@ -13734,13 +14222,21 @@ def run_agent_chat(cfg):
                 log_fh = open(log_path, "wb")
                 # gu as a co-author on the commits it makes (task #289) — after every check
                 # above, which judged the command as the model wrote it.
-                argv, _attrib_note = _with_attribution(argv, _attribution_settings(wd))
+                if _use_shell:
+                    _cmd_text, _attrib_note = _with_attribution_text(
+                        command, _scan, _attribution_settings(wd))
+                    argv = [_shell_bin, "-c", _cmd_text]
+                else:
+                    argv, _attrib_note = _with_attribution(argv, _attribution_settings(wd))
                 if _attrib_note:
                     _log(f"run_command: {_attrib_note}")
-                # Scrubbed env: repo scripts must never see worker secrets.
+                # Scrubbed env: repo scripts must never see worker secrets. A shell line gets an
+                # empty stdin: a heredoc feeds its own, and `--body-file -` without one must
+                # end at EOF rather than wait on the worker's pipe.
                 proc = subprocess.Popen(
                     argv, cwd=wd, env=_ws_scrubbed_env(),
                     stdout=log_fh, stderr=subprocess.STDOUT,
+                    **({"stdin": subprocess.DEVNULL} if _use_shell else {}),
                     **_ws_spawn_kwargs(),
                 )
                 _INFLIGHT_CMDS.add(proc.pid)  # killed with the agent until it is classified
@@ -13866,6 +14362,12 @@ def run_agent_chat(cfg):
                 except Exception:  # noqa: BLE001
                     pass
 
+        # The description says what the command line may contain, which depends on the machine:
+        # bash here, argv only on Windows (#359). Set before tool() reads the docstring.
+        if _run_shell_bin():
+            run_command.__doc__ = run_command.__doc__.replace(_RUN_DOC_ARGV, _RUN_DOC_SHELL)
+        run_command = tool(run_command)
+
         @tool
         def stop_server(port_or_pid: str = "") -> str:
             """Stop a background server OR desktop app previously started by run_command (closes its window). Use when the user asks to stop/kill/close it.

package/gu-repl.mjs

@@ -154,7 +154,7 @@ import {
   parseModelFallback,
 } from "./model-fallback.mjs";
 import { codingChoiceTags, coderDisplayName, coderWhere, whereOfActiveCoder } from "./coding-choice-tags.mjs";
-import { TITLE_POP, TITLE_PUSH, idleTitle, needsSummary, summariseForTitle, titleSeq, trimTitle } from "./terminal-title.mjs";
+import { TITLE_POP, TITLE_PUSH, idleTitle, needsSummary, summariseForTitle, titleModel, titleSeq, trimTitle } from "./terminal-title.mjs";
 import { IMAGE_NEEDS_CLAUDE, coderTakesImagesFor, clipboardImageToFile, fitImageNotice, imageMarkersForDisplay, createImageStore, imagePasteKey, imagePathFromPaste, isClaudeCoderUrl, isImagePasteKey, storeImageFile } from "./image-paste.mjs";
 import {
   isDoubleClick,
@@ -1633,7 +1633,17 @@ function showQuestionInTitle(question) {
   void (async () => {
     const settings = await fetchWorkerSettings();
     if (!settings || mine !== _titleSeq) return;
-    const title = await summariseForTitle(question, settings, { fetchImpl: doctorFetch });
+    // #358: the coder this turn runs on, with the key bound to its server — not the agent-model
+    // setting, which can name a model the turns never use, called with no key at all.
+    const target = titleModel(settings, { url: activeCodingUrl(), model: activeCodingModelId() });
+    if (!target) return;
+    const key = target.backendId ? await fetchKeyForBackend(target.backendId) : null;
+    if (mine !== _titleSeq) return;
+    const title = await summariseForTitle(question, settings, {
+      fetchImpl: doctorFetch,
+      target,
+      apiKey: key?.apiKey ?? "",
+    });
     if (title && mine === _titleSeq) writeTitle(title);
   })().catch(() => {});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.820",
+  "version": "1.0.822",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",

package/terminal-title.mjs

@@ -7,8 +7,8 @@
  * shortened, and keep it there until the next question.
  *
  * TWO STEPS, AND THE FIRST NEVER WAITS FOR THE SECOND. The trimmed question goes up the moment
- * the turn starts. Only a question too long to fit is then sent to the agent model for a
- * few-word summary, which replaces the trimmed one if — and only if — it arrives usable and the
+ * the turn starts. Only a question too long to fit is then sent to the coder the turn runs on
+ * (with its server's key — see titleModel) for a few-word summary, which replaces the trimmed one if — and only if — it arrives usable and the
  * user has not asked something else in the meantime. Every way that call can fail (no model
  * configured, a provider that wants a key this side does not hold, a timeout, a model that
  * answers with an essay) ends the same way: the trimmed question stays.
@@ -98,6 +98,30 @@ export function agentModelFromSettings(settings) {
   return { url, model: str(settings?.agentModelName) || "default_model" };
 }
 
+/** A server URL reduced to what identifies it: no case, no trailing slash, no trailing /v1. */
+function serverOf(url) {
+  return String(url ?? "").trim().toLowerCase().replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
+/**
+ * WHICH MODEL WRITES THE TITLE (#358): the coder this turn runs on, and the server row its key
+ * is bound to. → { url, model, backendId } or null.
+ *
+ * It used to be the account's agent-model setting, which on a real account was OpenAI o1 —
+ * not what the turns ran on (kimi-k3 on ollama.com), and called without a key, so every long
+ * question stayed trimmed. The coder is the model the user has already chosen and keyed; the
+ * agent-model setting is only the fallback for a session whose coder is not known yet.
+ */
+export function titleModel(settings, coder = {}) {
+  const rows = Array.isArray(settings?.agentCodingBackends) ? settings.agentCodingBackends : [];
+  const rowFor = (url) => rows.find((r) => r?.id && serverOf(r.url) === serverOf(url))?.id ?? "";
+  const url = String(coder?.url ?? "").trim();
+  const model = String(coder?.model ?? "").trim();
+  if (url && model) return { url, model, backendId: rowFor(url) };
+  const agent = agentModelFromSettings(settings);
+  return agent ? { ...agent, backendId: rowFor(agent.url) } : null;
+}
+
 export function summaryRequest(model, question) {
   const q = Array.from(cleanTitleText(question)).slice(0, SUMMARY_INPUT_MAX).join("");
   return {
@@ -140,20 +164,22 @@ export function pickSummary(body, max = TITLE_MAX) {
 }
 
 /**
- * Ask the agent model for a title. → the title, or "" for every reason there is not one.
+ * Ask a model for a title. → the title, or "" for every reason there is not one.
+ * `target` ({ url, model }, see titleModel) picks the model — the agent-model setting when absent —
+ * and `apiKey` is sent as a Bearer token when the server needs one.
  * Never throws: this runs beside a turn and must not be able to disturb it.
  */
 export async function summariseForTitle(
   question,
   settings,
-  { fetchImpl = fetch, timeoutMs = 20_000 } = {},
+  { fetchImpl = fetch, timeoutMs = 20_000, target = null, apiKey = "" } = {},
 ) {
-  const agent = agentModelFromSettings(settings);
+  const agent = target?.url && target?.model ? target : agentModelFromSettings(settings);
   if (!agent || !needsSummary(question)) return "";
   try {
     const res = await fetchImpl(chatEndpoint(agent.url), {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}) },
       body: JSON.stringify(summaryRequest(agent.model, question)),
       signal: AbortSignal.timeout(timeoutMs),
     });