@tiens.nguyen/gu-cli 1.0.830 → 1.0.832

package/gonext_agent_chat.py

@@ -7711,13 +7711,13 @@ def _shell_commands(tokens):
     while i < len(tokens):
         kind, text, a, b, quoted = tokens[i]
         if kind == "op" and text in _SHELL_SEPARATORS:
-            if cur and (cur["argv"] or cur["redirects"]):
+            if cur and (cur["argv"] or cur["redirects"] or cur["assigns"]):
                 cmds.append(cur)
             cur, sep = None, text
             i += 1
             continue
         if cur is None:
-            cur = {"argv": [], "spans": [], "sep": sep, "redirects": []}
+            cur = {"argv": [], "spans": [], "sep": sep, "redirects": [], "assigns": []}
         if kind == "op":
             nxt = tokens[i + 1] if i + 1 < len(tokens) else None
             tgt = nxt[1] if nxt and nxt[0] == "word" else ""
@@ -7725,16 +7725,73 @@ def _shell_commands(tokens):
             i += 2 if tgt or (nxt and nxt[0] == "word") else 1
             continue
         if not cur["argv"] and re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", text):
+            cur["assigns"].append(tuple(text.split("=", 1)))
             i += 1
             continue
         cur["argv"].append(text)
         cur["spans"].append((a, b))
         i += 1
-    if cur and (cur["argv"] or cur["redirects"]):
+    if cur and (cur["argv"] or cur["redirects"] or cur["assigns"]):
         cmds.append(cur)
     return cmds
 
 
+# A RUNNER IN A VARIABLE THAT THE LINE ITSELF SET (#362). `U=/Applications/…/Unity && $U -batchmode
+# -runTests …` asked "the program to run is only known at run time" — but it is known: the same
+# line assigned it a literal. The check now resolves that case and judges the REAL program, by
+# re-scanning a copy of the line with the literal in place — so every rule (privilege, denylist,
+# allowlist, deletes) sees it: `S=sudo && $S rm -rf /` is still sudo. Only a top-level assignment
+# whose value has no $, `, glob or leading ~, made before the use and not inside a pipeline (a
+# subshell); anything else keeps asking. bash still runs the line exactly as written.
+# Anything else that can set or clear a variable makes the value unknowable from the text.
+_SHELL_VAR_CHANGERS = {"unset", "read", "declare", "typeset", "local", "readonly", "source", ".",
+                       "eval", "for", "select", "mapfile", "readarray", "getopts", "printf", "let"}
+_SHELL_VAR_RUNNER_RE = re.compile(r"^\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))$")
+
+
+def _shell_literal_value(v: str) -> bool:
+    return bool(v) and not re.search(r"[$`*?\[]", v) and not v.startswith("~")
+
+
+def _shell_resolve_runner_vars(command: str, scan) -> str:
+    """`command` with each top-level `$X` runner replaced by X's literal value, or "" when there
+    is nothing this line can resolve. For CHECKING only — never executed."""
+    import shlex as _shlex
+    if not scan or scan.get("error"):
+        return ""
+    cmds = _shell_commands(scan["tokens"])
+    if any(c["argv"] and _shell_prog_name(c["argv"][0]) in _SHELL_VAR_CHANGERS for c in cmds):
+        return ""
+    env, edits = {}, []
+    for k, c in enumerate(cmds):
+        in_pipe = c["sep"] in ("|", "|&") or (k + 1 < len(cmds) and cmds[k + 1]["sep"] in ("|", "|&"))
+        a = c["argv"]
+        pairs = []
+        if not a:
+            pairs = list(c.get("assigns") or [])
+        elif a[0] == "export":
+            pairs = [tuple(x.split("=", 1)) for x in a[1:] if re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", x)]
+        if pairs:
+            for name, val in pairs:
+                if not in_pipe and _shell_literal_value(val):
+                    env[name] = val
+                else:
+                    env.pop(name, None)
+            continue
+        m = _SHELL_VAR_RUNNER_RE.match(a[0]) if a else None
+        if m and (m.group(1) or m.group(2)) in env:
+            start, end = c["spans"][0]
+            val = env[m.group(1) or m.group(2)]
+            # "$U" is one word; a bare $U is WORD-SPLIT by bash — `U="sudo rm" && $U -rf /` runs
+            # sudo. Substituted raw, the re-scan splits it the same way and sees sudo.
+            edits.append(((start, end), _shlex.quote(val) if command[start:end].startswith('"') else val))
+    if not edits:
+        return ""
+    for (start, end), val in sorted(edits, reverse=True):
+        command = command[:start] + val + command[end:]
+    return command
+
+
 def _shell_needed(scan):
     """Does this line need a shell to mean what it says? False → run it as argv, as before."""
     return bool(scan["heredocs"] or scan["substs"] or scan["expands"]
@@ -7999,6 +8056,111 @@ _HEREDOC_HINT = ("\n\nSHELL QUOTING broke this line. For text with quotes or lin
                  "run_command(\"\"\"git commit -F - <<'EOF'\n<message>\nEOF\"\"\") — nothing in the "
                  "message needs escaping.")
 
+# A PIPE HIDES THE EXIT CODE OF EVERYTHING BEFORE IT (#360 review, turn 3c06654e). The model ran
+# `python3 -m pytest … | tail -5 && git add … && git commit …`; pytest was not installed, `tail`
+# exited 0, and the commit went in untested. Global `set -o pipefail` would fix that and break
+# `git log | head -5` (SIGPIPE → 141) everywhere, so the line runs as written and gu READS the
+# output instead: a pipe line that exited 0 while printing an unmistakable failure is reported
+# as one. Markers are line-anchored and specific, so ordinary output containing "error" passes.
+_PIPE_FAIL_RE = re.compile(
+    r"^.*(?:No module named \S+|ModuleNotFoundError: .*|: command not found|: not found$"
+    r"|^Traceback \(most recent call last\):|^fatal: .*|^error: .*|^npm ERR! .*"
+    r"|^E: Unable to locate package .*|: No such file or directory$)",
+    re.M)
+
+
+def _pipe_hidden_failure(scan, out: str) -> str:
+    """The failure line a pipe hid, or "" — only for a line that has a `|`."""
+    if not scan or not any(t[0] == "op" and t[1] == "|" for t in scan.get("tokens") or []):
+        return ""
+    m = _PIPE_FAIL_RE.search(out or "")
+    return m.group(0).strip()[:200] if m else ""
+
+
+def _pipe_hidden_failure_note(line: str) -> str:
+    return ("\n\nWARNING — A FAILURE WAS HIDDEN BY A PIPE: the output shows "
+            f"'{line}', but a pipeline reports only its LAST command's exit code, so this "
+            "line counted as success and every part after `&&` RAN ANYWAY. Check what those "
+            "parts did before relying on them. To chain on a check, run it without a pipe, or "
+            "start the line with `set -o pipefail;`.")
+
+
+# THE PROJECT'S OWN TEST COMMANDS (#360 review). The model guessed `python3 -m pytest` in a repo
+# whose package.json says `python3 -m unittest discover tests -v && node --test` — pytest was not
+# even installed. The manifests already say how each part of the project is tested; reading them
+# costs no tool call. Depth ≤ 3 (a monorepo's packages), at most 8, nearest first.
+_TEST_SKIP_DIRS = {"node_modules", "dist", "build", "out", "target", "vendor", "venv", ".venv",
+                   "__pycache__", "server-bundle", "coverage"}
+
+
+def _project_test_commands(root: str, max_depth: int = 3, limit: int = 8) -> list:
+    """[(relative folder, command)] from package.json scripts.test, a Makefile `test:` target,
+    pytest config, Cargo.toml and go.mod. Never raises."""
+    import json as _json
+    found = []
+    try:
+        root = os.path.abspath(root)
+    except Exception:  # noqa: BLE001
+        return []
+    queue = [(root, 0)]
+    while queue and len(found) < limit:
+        d, depth = queue.pop(0)
+        try:
+            names = set(os.listdir(d))
+        except OSError:
+            continue
+        rel = os.path.relpath(d, root)
+        rel = "." if rel == "." else rel.replace(os.sep, "/")
+        cmd = ""
+        if "package.json" in names:
+            try:
+                with open(os.path.join(d, "package.json"), encoding="utf-8") as fh:
+                    t = ((_json.load(fh) or {}).get("scripts") or {}).get("test") or ""
+                if t and "no test specified" not in t:
+                    cmd = f"npm test  ({_clip(t, 110)})"
+            except Exception:  # noqa: BLE001
+                pass
+        if not cmd and "Makefile" in names:
+            try:
+                with open(os.path.join(d, "Makefile"), encoding="utf-8", errors="replace") as fh:
+                    if re.search(r"(?m)^test\s*:", fh.read(200_000)):
+                        cmd = "make test"
+            except OSError:
+                pass
+        if not cmd and ("pytest.ini" in names or "conftest.py" in names):
+            cmd = "python3 -m pytest"
+        if not cmd and "pyproject.toml" in names:
+            try:
+                with open(os.path.join(d, "pyproject.toml"), encoding="utf-8", errors="replace") as fh:
+                    if "[tool.pytest" in fh.read(200_000):
+                        cmd = "python3 -m pytest"
+            except OSError:
+                pass
+        if not cmd and "Cargo.toml" in names:
+            cmd = "cargo test"
+        if not cmd and "go.mod" in names:
+            cmd = "go test ./..."
+        if cmd:
+            found.append((rel, cmd))
+        if depth < max_depth:
+            for n in sorted(names):
+                if n.startswith(".") or n in _TEST_SKIP_DIRS:
+                    continue
+                p = os.path.join(d, n)
+                if os.path.isdir(p) and not os.path.islink(p):
+                    queue.append((p, depth + 1))
+    return found
+
+
+def _test_commands_line(root: str) -> str:
+    cmds = _project_test_commands(root) if root else []
+    if not cmds:
+        return ""
+    return ("  TEST COMMANDS, from this project's own manifests — use these, never guess a runner "
+            "(a missing pytest fails silently behind a pipe): "
+            + "; ".join(f"{d} → {c}" for d, c in cmds) + "\n")
+
+
 # bash's words for a line whose quotes do not pair up.
 _SHELL_QUOTE_ERR_RE = re.compile(
     r"unexpected EOF while looking for matching|syntax error near unexpected token|"
@@ -9059,6 +9221,55 @@ def _shell_or_server(shells: list, servers: list, key: str):
     return max(cands, key=lambda x: float(x.get("started") or 0)) if cands else None
 
 
+# A SHELL THAT WRITES ITS OWN LOG (#362). Unity `-batchmode … -logFile Logs/all.log` prints nothing
+# for its whole 5-minute run — everything goes to that file — so the shell's output read "No output
+# available" until the end. When a shell has no output of its own, the file its command names is
+# the next best thing: an explicit log flag first, then `tee`, then the last `>`/`>>` redirect.
+_LOG_FLAG_RE = re.compile(r"^--?(?:log-?file|logfile|log-path|log)(?:=(.+))?$", re.I)
+
+
+def _shell_log_file(command: str, workdir: str = "") -> str:
+    """The log file a command line writes to, as an absolute path that exists — or ""."""
+    scan = _shell_scan(command or "")
+    if scan.get("error"):
+        return ""
+    flag = tee = redir = ""
+    for c in _shell_commands(scan["tokens"]):
+        a = c["argv"]
+        for i, w in enumerate(a):
+            m = _LOG_FLAG_RE.match(w)
+            if m:
+                flag = m.group(1) or (a[i + 1] if i + 1 < len(a) else "") or flag
+        if a and _shell_prog_name(a[0]) == "tee":
+            files = [x for x in a[1:] if not x.startswith("-")]
+            tee = files[-1] if files else tee
+        for op, tgt in c["redirects"]:
+            if op in (">", ">>", "&>", "&>>", "1>", "1>>") and tgt and not tgt.startswith("&"):
+                redir = tgt
+    for cand in (flag, tee, redir):
+        if not cand or cand in ("/dev/null", "-"):
+            continue
+        path = cand.replace("$PWD", workdir or "").replace("${PWD}", workdir or "")
+        path = os.path.expanduser(path)
+        if not os.path.isabs(path):
+            path = os.path.join(workdir or os.getcwd(), path)
+        if os.path.isfile(path):
+            return os.path.normpath(path)
+    return ""
+
+
+def _file_tail(path: str, max_chars: int = 4000) -> str:
+    try:
+        with open(path, "rb") as fh:
+            fh.seek(0, 2)
+            size = fh.tell()
+            fh.seek(max(0, size - max_chars))
+            text = fh.read().decode("utf-8", errors="replace")
+        return text if size <= max_chars else text.split("\n", 1)[-1]
+    except OSError:
+        return ""
+
+
 def _shell_kill(s: dict) -> None:
     """Stop a shell's whole process group and mark it killed (unless it already finished)."""
     import time as _t
@@ -10418,9 +10629,16 @@ def run_agent_chat(cfg):
             _ws_servers_line += _shells_context_line(_shells_load())
         except Exception as _e:  # noqa: BLE001
             _log(f"shell context skip: {_e}")
+    _ws_tests_line = ""
+    if _WS_AVAILABLE and _WS_ACTIVE:
+        try:
+            _ws_tests_line = _test_commands_line(_WS_ACTIVE)
+        except Exception as _e:  # noqa: BLE001
+            _log(f"test command scan skip: {_e}")
     _ws_context_block = (
         _ws_current_line
         + f"  Other registered workspaces (use only if the user names them): {_ws_names}\n"
+        + _ws_tests_line
         + _ws_servers_line
         + f"  Current folder contents:\n"
         + "\n".join(f"    {line}" for line in _ws_overview.splitlines()) + "\n"
@@ -14565,8 +14783,11 @@ def run_agent_chat(cfg):
                     # Every simple command in the line, including those inside $( ), gets the
                     # checks an argv command gets — allowlist, privilege, denylist, deletes —
                     # plus the shell-only ones (redirect outside the project, `| sh`).
+                    _resolved = _shell_resolve_runner_vars(command, _scan)
+                    _risk_scan = _shell_scan(_resolved) if _resolved else _scan
                     _refuse, _hard_reason, _ask_reason = _ws_shell_command_risk(
-                        _scan, _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
+                        _risk_scan if not _risk_scan.get("error") else _scan,
+                        _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
                     if _refuse:
                         _last_obs["text"] = _refuse
                         return _refuse
@@ -14754,6 +14975,11 @@ def run_agent_chat(cfg):
                         # `git commit -m '…turn'\''s…'` lost its backslash to Python and bash
                         # stopped on the quote; the next step was spent guessing. A heredoc in a
                         # triple-quoted string has no quoting to get wrong.
+                        _hidden = _pipe_hidden_failure(_scan, out) if (rc == 0 and _use_shell) else ""
+                        if _hidden:
+                            result += _pipe_hidden_failure_note(_hidden)
+                            _emit({"type": "step", "text":
+                                   f"Command failed behind a pipe → {_trim_words(_hidden)}"})
                         if rc != 0 and _use_shell and _SHELL_QUOTE_ERR_RE.search(out or ""):
                             result += _HEREDOC_HINT
                         if rc != 0 and _WS_PERM_ERR_RE.search(out or ""):
@@ -14971,8 +15197,15 @@ def run_agent_chat(cfg):
                 if st["state"] == "exited":
                     head += ("\nexit 0 alone does NOT prove the intended effect happened — check "
                              "the output and VERIFY.")
+                tail_note = ""
+                if not new.strip() and int(sh.get("read_offset") or 0) == 0:
+                    lf = _shell_log_file(str(sh.get("command") or ""), str(sh.get("workdir") or ""))
+                    lt = _file_tail(lf).strip() if lf else ""
+                    if lt:
+                        tail_note = (f"\nIt prints nothing itself; the end of the log it writes "
+                                     f"({lf}):\n{lt}")
                 msg = head + "\n" + (f"New output:\n{new}" if new.strip()
-                                     else "No new output since the last read.")
+                                     else "No new output since the last read.") + tail_note
                 _emit({"type": "step", "text":
                        f"Shell {sh.get('id')} {_shell_status_text(st)} → {_trim_words(str(sh.get('command')))}"})
                 _last_obs["text"] = msg

package/gu-repl.mjs

@@ -139,7 +139,7 @@ import {
 import { completedFlush, splitLiveStream } from "./completed-flush.mjs";
 import { isScaffoldStep, isGroupableStep, stepGroupRows, relativizePaths } from "./step-group.mjs";
 import { clearLogsNoticeText } from "./clear-logs.mjs";
-import { killShell, logTail, readShells, renderShellDetails, shellPickerLabel, shellState, shellsNotice } from "./shell-details.mjs";
+import { commandLogFile, killShell, logTail, readShells, renderShellDetails, shellPickerLabel, shellState, shellsNotice } from "./shell-details.mjs";
 import { discoverSkills, matchSkillCommand } from "./skills.mjs";
 import { appendNew, archivePathFor, archivedWorkspaceKey, markReset, seedArchive } from "./conversation-archive.mjs";
 import { addAllowRule, listServers as listMcpServers } from "./mcp-config.mjs";
@@ -9510,8 +9510,18 @@ function printShellDetails(rec) {
   const width = Math.max(20, process.stdout.columns || 80);
   const st = shellState(rec);
   shellsViewed.add(String(rec.id));
+  // Nothing printed of its own (Unity -batchmode -logFile …)? Show the log its command writes.
+  let output = logTail(rec.log);
+  let outputFrom = "";
+  if (!output.length) {
+    const lf = commandLogFile(rec.command, rec.workdir);
+    if (lf) {
+      output = logTail(lf);
+      outputFrom = lf.startsWith(String(rec.workdir || "\0") + "/") ? lf.slice(String(rec.workdir).length + 1) : lf;
+    }
+  }
   const rows = renderShellDetails({
-    rec, st, output: logTail(rec.log), width: width - 1, gutter: GUTTER,
+    rec, st, output, outputFrom, width: width - 1, gutter: GUTTER,
     style: { title: (t) => bold(accent(t)), label: bold, running: accent, ok: accent, bad: red, dim },
   });
   console.log("\n" + GUTTER + accent("─".repeat(Math.max(10, width - 1 - GUTTER.length))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.830",
+  "version": "1.0.832",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",

package/shell-details.mjs

@@ -13,7 +13,7 @@
 
 import { existsSync, openSync, readSync, closeSync, fstatSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, normalize } from "node:path";
 import { spawnSync } from "node:child_process";
 
 export const shellsPath = (home = homedir()) => join(home, ".gonext", "shells.json");
@@ -135,6 +135,38 @@ export function logTail(path, { lines = 15, maxBytes = 64 * 1024 } = {}) {
   return out.slice(-lines);
 }
 
+const unq = (w) => w.replace(/^"(.*)"$/s, "$1").replace(/^'(.*)'$/s, "$1");
+const WORD = String.raw`("[^"]*"|'[^']*'|[^\s;&|<>]+)`;
+
+/**
+ * The log file a command writes to, when the shell itself prints nothing (#362: Unity's
+ * `-logFile Logs/all.log` left Shell details on "No output available" for a 5-minute run).
+ * An explicit log flag first, then `tee`, then the last `>`/`>>` redirect — the same order as
+ * the agent's _shell_log_file. → an absolute path that exists, or "".
+ */
+export function commandLogFile(command, workdir = "") {
+  const cmd = String(command ?? "");
+  const last = (re) => {
+    let m, v = "";
+    for (const r = new RegExp(re, "gi"); (m = r.exec(cmd)); ) v = m[1] ?? m[2] ?? v;
+    return v;
+  };
+  const flag = last(String.raw`(?:^|\s)--?(?:log-?file|logfile|log-path|log)(?:=` + WORD + String.raw`|\s+` + WORD + ")");
+  const tee = last(String.raw`\btee\s+(?:-a\s+)?` + WORD);
+  const redir = last(String.raw`(?:^|[^0-9&>])(?:1|&)?>>?\s*(?!&)` + WORD);
+  for (const raw of [flag, tee, redir]) {
+    if (!raw) continue;
+    let p = unq(raw).replace(/\$\{?PWD\}?/g, workdir || "");
+    if (p === "/dev/null" || p === "-") continue;
+    if (p.startsWith("~/")) p = join(homedir(), p.slice(2));
+    if (!isAbsolute(p)) p = join(workdir || process.cwd(), p);
+    try {
+      if (statSync(p).isFile()) return normalize(p);
+    } catch { /* not there (yet) */ }
+  }
+  return "";
+}
+
 /** Word-wrap `text` to `width`; at most `maxRows`, the last ending in "…" when cut. */
 export function wrapClip(text, width, maxRows = 4) {
   const w = Math.max(10, width);
@@ -166,7 +198,7 @@ const plain = (s) => s;
  * The Shell details block, one string per row, no row wider than `width`.
  * `style`: {title, label, running, ok, bad, dim} paint functions (identity in tests).
  */
-export function renderShellDetails({ rec, st, output = [], width = 80, gutter = "  ", style = {} }) {
+export function renderShellDetails({ rec, st, output = [], outputFrom = "", width = 80, gutter = "  ", style = {} }) {
   const p = { title: plain, label: plain, running: plain, ok: plain, bad: plain, dim: plain, ...style };
   const inner = Math.max(20, width - gutter.length);
   const valW = inner - LABEL_W;
@@ -183,7 +215,8 @@ export function renderShellDetails({ rec, st, output = [], width = 80, gutter =
     ...cmd.slice(1).map((c) => gutter + pad + c),
   ];
   if (rec?.workdir) rows.push(row("Folder:", p.dim(wrapClip(rec.workdir, valW, 1)[0])));
-  rows.push("", gutter + p.label("Output:"));
+  // From the log file the command writes, when the shell printed nothing itself — say which.
+  rows.push("", gutter + p.label("Output:") + (outputFrom ? p.dim(`  (from ${wrapClip(outputFrom, Math.max(10, inner - 20), 1)[0]})`) : ""));
   if (!output.length) rows.push(gutter + p.dim("No output available"));
   else for (const l of output) rows.push(gutter + (l.length > inner ? l.slice(0, inner - 1) + "…" : l));
   return rows;