@tiens.nguyen/gu-cli 1.0.831 → 1.0.832

package/gonext_agent_chat.py

@@ -7711,13 +7711,13 @@ def _shell_commands(tokens):
     while i < len(tokens):
         kind, text, a, b, quoted = tokens[i]
         if kind == "op" and text in _SHELL_SEPARATORS:
-            if cur and (cur["argv"] or cur["redirects"]):
+            if cur and (cur["argv"] or cur["redirects"] or cur["assigns"]):
                 cmds.append(cur)
             cur, sep = None, text
             i += 1
             continue
         if cur is None:
-            cur = {"argv": [], "spans": [], "sep": sep, "redirects": []}
+            cur = {"argv": [], "spans": [], "sep": sep, "redirects": [], "assigns": []}
         if kind == "op":
             nxt = tokens[i + 1] if i + 1 < len(tokens) else None
             tgt = nxt[1] if nxt and nxt[0] == "word" else ""
@@ -7725,16 +7725,73 @@ def _shell_commands(tokens):
             i += 2 if tgt or (nxt and nxt[0] == "word") else 1
             continue
         if not cur["argv"] and re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", text):
+            cur["assigns"].append(tuple(text.split("=", 1)))
             i += 1
             continue
         cur["argv"].append(text)
         cur["spans"].append((a, b))
         i += 1
-    if cur and (cur["argv"] or cur["redirects"]):
+    if cur and (cur["argv"] or cur["redirects"] or cur["assigns"]):
         cmds.append(cur)
     return cmds
 
 
+# A RUNNER IN A VARIABLE THAT THE LINE ITSELF SET (#362). `U=/Applications/…/Unity && $U -batchmode
+# -runTests …` asked "the program to run is only known at run time" — but it is known: the same
+# line assigned it a literal. The check now resolves that case and judges the REAL program, by
+# re-scanning a copy of the line with the literal in place — so every rule (privilege, denylist,
+# allowlist, deletes) sees it: `S=sudo && $S rm -rf /` is still sudo. Only a top-level assignment
+# whose value has no $, `, glob or leading ~, made before the use and not inside a pipeline (a
+# subshell); anything else keeps asking. bash still runs the line exactly as written.
+# Anything else that can set or clear a variable makes the value unknowable from the text.
+_SHELL_VAR_CHANGERS = {"unset", "read", "declare", "typeset", "local", "readonly", "source", ".",
+                       "eval", "for", "select", "mapfile", "readarray", "getopts", "printf", "let"}
+_SHELL_VAR_RUNNER_RE = re.compile(r"^\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))$")
+
+
+def _shell_literal_value(v: str) -> bool:
+    return bool(v) and not re.search(r"[$`*?\[]", v) and not v.startswith("~")
+
+
+def _shell_resolve_runner_vars(command: str, scan) -> str:
+    """`command` with each top-level `$X` runner replaced by X's literal value, or "" when there
+    is nothing this line can resolve. For CHECKING only — never executed."""
+    import shlex as _shlex
+    if not scan or scan.get("error"):
+        return ""
+    cmds = _shell_commands(scan["tokens"])
+    if any(c["argv"] and _shell_prog_name(c["argv"][0]) in _SHELL_VAR_CHANGERS for c in cmds):
+        return ""
+    env, edits = {}, []
+    for k, c in enumerate(cmds):
+        in_pipe = c["sep"] in ("|", "|&") or (k + 1 < len(cmds) and cmds[k + 1]["sep"] in ("|", "|&"))
+        a = c["argv"]
+        pairs = []
+        if not a:
+            pairs = list(c.get("assigns") or [])
+        elif a[0] == "export":
+            pairs = [tuple(x.split("=", 1)) for x in a[1:] if re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", x)]
+        if pairs:
+            for name, val in pairs:
+                if not in_pipe and _shell_literal_value(val):
+                    env[name] = val
+                else:
+                    env.pop(name, None)
+            continue
+        m = _SHELL_VAR_RUNNER_RE.match(a[0]) if a else None
+        if m and (m.group(1) or m.group(2)) in env:
+            start, end = c["spans"][0]
+            val = env[m.group(1) or m.group(2)]
+            # "$U" is one word; a bare $U is WORD-SPLIT by bash — `U="sudo rm" && $U -rf /` runs
+            # sudo. Substituted raw, the re-scan splits it the same way and sees sudo.
+            edits.append(((start, end), _shlex.quote(val) if command[start:end].startswith('"') else val))
+    if not edits:
+        return ""
+    for (start, end), val in sorted(edits, reverse=True):
+        command = command[:start] + val + command[end:]
+    return command
+
+
 def _shell_needed(scan):
     """Does this line need a shell to mean what it says? False → run it as argv, as before."""
     return bool(scan["heredocs"] or scan["substs"] or scan["expands"]
@@ -9164,6 +9221,55 @@ def _shell_or_server(shells: list, servers: list, key: str):
     return max(cands, key=lambda x: float(x.get("started") or 0)) if cands else None
 
 
+# A SHELL THAT WRITES ITS OWN LOG (#362). Unity `-batchmode … -logFile Logs/all.log` prints nothing
+# for its whole 5-minute run — everything goes to that file — so the shell's output read "No output
+# available" until the end. When a shell has no output of its own, the file its command names is
+# the next best thing: an explicit log flag first, then `tee`, then the last `>`/`>>` redirect.
+_LOG_FLAG_RE = re.compile(r"^--?(?:log-?file|logfile|log-path|log)(?:=(.+))?$", re.I)
+
+
+def _shell_log_file(command: str, workdir: str = "") -> str:
+    """The log file a command line writes to, as an absolute path that exists — or ""."""
+    scan = _shell_scan(command or "")
+    if scan.get("error"):
+        return ""
+    flag = tee = redir = ""
+    for c in _shell_commands(scan["tokens"]):
+        a = c["argv"]
+        for i, w in enumerate(a):
+            m = _LOG_FLAG_RE.match(w)
+            if m:
+                flag = m.group(1) or (a[i + 1] if i + 1 < len(a) else "") or flag
+        if a and _shell_prog_name(a[0]) == "tee":
+            files = [x for x in a[1:] if not x.startswith("-")]
+            tee = files[-1] if files else tee
+        for op, tgt in c["redirects"]:
+            if op in (">", ">>", "&>", "&>>", "1>", "1>>") and tgt and not tgt.startswith("&"):
+                redir = tgt
+    for cand in (flag, tee, redir):
+        if not cand or cand in ("/dev/null", "-"):
+            continue
+        path = cand.replace("$PWD", workdir or "").replace("${PWD}", workdir or "")
+        path = os.path.expanduser(path)
+        if not os.path.isabs(path):
+            path = os.path.join(workdir or os.getcwd(), path)
+        if os.path.isfile(path):
+            return os.path.normpath(path)
+    return ""
+
+
+def _file_tail(path: str, max_chars: int = 4000) -> str:
+    try:
+        with open(path, "rb") as fh:
+            fh.seek(0, 2)
+            size = fh.tell()
+            fh.seek(max(0, size - max_chars))
+            text = fh.read().decode("utf-8", errors="replace")
+        return text if size <= max_chars else text.split("\n", 1)[-1]
+    except OSError:
+        return ""
+
+
 def _shell_kill(s: dict) -> None:
     """Stop a shell's whole process group and mark it killed (unless it already finished)."""
     import time as _t
@@ -14677,8 +14783,11 @@ def run_agent_chat(cfg):
                     # Every simple command in the line, including those inside $( ), gets the
                     # checks an argv command gets — allowlist, privilege, denylist, deletes —
                     # plus the shell-only ones (redirect outside the project, `| sh`).
+                    _resolved = _shell_resolve_runner_vars(command, _scan)
+                    _risk_scan = _shell_scan(_resolved) if _resolved else _scan
                     _refuse, _hard_reason, _ask_reason = _ws_shell_command_risk(
-                        _scan, _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
+                        _risk_scan if not _risk_scan.get("error") else _scan,
+                        _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
                     if _refuse:
                         _last_obs["text"] = _refuse
                         return _refuse
@@ -15088,8 +15197,15 @@ def run_agent_chat(cfg):
                 if st["state"] == "exited":
                     head += ("\nexit 0 alone does NOT prove the intended effect happened — check "
                              "the output and VERIFY.")
+                tail_note = ""
+                if not new.strip() and int(sh.get("read_offset") or 0) == 0:
+                    lf = _shell_log_file(str(sh.get("command") or ""), str(sh.get("workdir") or ""))
+                    lt = _file_tail(lf).strip() if lf else ""
+                    if lt:
+                        tail_note = (f"\nIt prints nothing itself; the end of the log it writes "
+                                     f"({lf}):\n{lt}")
                 msg = head + "\n" + (f"New output:\n{new}" if new.strip()
-                                     else "No new output since the last read.")
+                                     else "No new output since the last read.") + tail_note
                 _emit({"type": "step", "text":
                        f"Shell {sh.get('id')} {_shell_status_text(st)} → {_trim_words(str(sh.get('command')))}"})
                 _last_obs["text"] = msg

package/gu-repl.mjs

@@ -139,7 +139,7 @@ import {
 import { completedFlush, splitLiveStream } from "./completed-flush.mjs";
 import { isScaffoldStep, isGroupableStep, stepGroupRows, relativizePaths } from "./step-group.mjs";
 import { clearLogsNoticeText } from "./clear-logs.mjs";
-import { killShell, logTail, readShells, renderShellDetails, shellPickerLabel, shellState, shellsNotice } from "./shell-details.mjs";
+import { commandLogFile, killShell, logTail, readShells, renderShellDetails, shellPickerLabel, shellState, shellsNotice } from "./shell-details.mjs";
 import { discoverSkills, matchSkillCommand } from "./skills.mjs";
 import { appendNew, archivePathFor, archivedWorkspaceKey, markReset, seedArchive } from "./conversation-archive.mjs";
 import { addAllowRule, listServers as listMcpServers } from "./mcp-config.mjs";
@@ -9510,8 +9510,18 @@ function printShellDetails(rec) {
   const width = Math.max(20, process.stdout.columns || 80);
   const st = shellState(rec);
   shellsViewed.add(String(rec.id));
+  // Nothing printed of its own (Unity -batchmode -logFile …)? Show the log its command writes.
+  let output = logTail(rec.log);
+  let outputFrom = "";
+  if (!output.length) {
+    const lf = commandLogFile(rec.command, rec.workdir);
+    if (lf) {
+      output = logTail(lf);
+      outputFrom = lf.startsWith(String(rec.workdir || "\0") + "/") ? lf.slice(String(rec.workdir).length + 1) : lf;
+    }
+  }
   const rows = renderShellDetails({
-    rec, st, output: logTail(rec.log), width: width - 1, gutter: GUTTER,
+    rec, st, output, outputFrom, width: width - 1, gutter: GUTTER,
     style: { title: (t) => bold(accent(t)), label: bold, running: accent, ok: accent, bad: red, dim },
   });
   console.log("\n" + GUTTER + accent("─".repeat(Math.max(10, width - 1 - GUTTER.length))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.831",
+  "version": "1.0.832",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",

package/shell-details.mjs

@@ -13,7 +13,7 @@
 
 import { existsSync, openSync, readSync, closeSync, fstatSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join, normalize } from "node:path";
 import { spawnSync } from "node:child_process";
 
 export const shellsPath = (home = homedir()) => join(home, ".gonext", "shells.json");
@@ -135,6 +135,38 @@ export function logTail(path, { lines = 15, maxBytes = 64 * 1024 } = {}) {
   return out.slice(-lines);
 }
 
+const unq = (w) => w.replace(/^"(.*)"$/s, "$1").replace(/^'(.*)'$/s, "$1");
+const WORD = String.raw`("[^"]*"|'[^']*'|[^\s;&|<>]+)`;
+
+/**
+ * The log file a command writes to, when the shell itself prints nothing (#362: Unity's
+ * `-logFile Logs/all.log` left Shell details on "No output available" for a 5-minute run).
+ * An explicit log flag first, then `tee`, then the last `>`/`>>` redirect — the same order as
+ * the agent's _shell_log_file. → an absolute path that exists, or "".
+ */
+export function commandLogFile(command, workdir = "") {
+  const cmd = String(command ?? "");
+  const last = (re) => {
+    let m, v = "";
+    for (const r = new RegExp(re, "gi"); (m = r.exec(cmd)); ) v = m[1] ?? m[2] ?? v;
+    return v;
+  };
+  const flag = last(String.raw`(?:^|\s)--?(?:log-?file|logfile|log-path|log)(?:=` + WORD + String.raw`|\s+` + WORD + ")");
+  const tee = last(String.raw`\btee\s+(?:-a\s+)?` + WORD);
+  const redir = last(String.raw`(?:^|[^0-9&>])(?:1|&)?>>?\s*(?!&)` + WORD);
+  for (const raw of [flag, tee, redir]) {
+    if (!raw) continue;
+    let p = unq(raw).replace(/\$\{?PWD\}?/g, workdir || "");
+    if (p === "/dev/null" || p === "-") continue;
+    if (p.startsWith("~/")) p = join(homedir(), p.slice(2));
+    if (!isAbsolute(p)) p = join(workdir || process.cwd(), p);
+    try {
+      if (statSync(p).isFile()) return normalize(p);
+    } catch { /* not there (yet) */ }
+  }
+  return "";
+}
+
 /** Word-wrap `text` to `width`; at most `maxRows`, the last ending in "…" when cut. */
 export function wrapClip(text, width, maxRows = 4) {
   const w = Math.max(10, width);
@@ -166,7 +198,7 @@ const plain = (s) => s;
  * The Shell details block, one string per row, no row wider than `width`.
  * `style`: {title, label, running, ok, bad, dim} paint functions (identity in tests).
  */
-export function renderShellDetails({ rec, st, output = [], width = 80, gutter = "  ", style = {} }) {
+export function renderShellDetails({ rec, st, output = [], outputFrom = "", width = 80, gutter = "  ", style = {} }) {
   const p = { title: plain, label: plain, running: plain, ok: plain, bad: plain, dim: plain, ...style };
   const inner = Math.max(20, width - gutter.length);
   const valW = inner - LABEL_W;
@@ -183,7 +215,8 @@ export function renderShellDetails({ rec, st, output = [], width = 80, gutter =
     ...cmd.slice(1).map((c) => gutter + pad + c),
   ];
   if (rec?.workdir) rows.push(row("Folder:", p.dim(wrapClip(rec.workdir, valW, 1)[0])));
-  rows.push("", gutter + p.label("Output:"));
+  // From the log file the command writes, when the shell printed nothing itself — say which.
+  rows.push("", gutter + p.label("Output:") + (outputFrom ? p.dim(`  (from ${wrapClip(outputFrom, Math.max(10, inner - 20), 1)[0]})`) : ""));
   if (!output.length) rows.push(gutter + p.dim("No output available"));
   else for (const l of output) rows.push(gutter + (l.length > inner ? l.slice(0, inner - 1) + "…" : l));
   return rows;