@tiens.nguyen/gu-cli 1.0.834 → 1.0.835

package/gonext_agent_chat.py

@@ -8071,9 +8071,9 @@ _BROWSER_LINE = (
     "(text + numbered elements) or browser(\"screenshot\") → browser(\"click\", ref=n) / "
     "browser(\"type\", ref=n, text=…) → read again to check the result; browser(\"console\") shows "
     "page errors. A local app needs its server running first (run_command background=True). "
-    "Never report a UI as working without looking at it. If browser answers BROWSER NOT "
-    "AVAILABLE, stop and ask the user to install the gu Chrome extension (steps are in the "
-    "answer).\n")
+    "Never report a UI as working without looking at it. The first browser call asks the user's "
+    "permission (nothing to install: without the gu extension it opens gu's own Chrome window). "
+    "If the user says no, or it answers BROWSER NOT AVAILABLE, stop and tell the user.\n")
 
 
 # Background shells (task #360). Never `&` (refused) — background=True is the way to say it.
@@ -8725,6 +8725,8 @@ def _ws_request_approval(api_base, worker_key, job_id, command, reason, deadline
         _emit({"type": "step", "text": "Awaiting your choice: compact the context?"})
     elif command.startswith("__S3SETUP__::"):
         _emit({"type": "step", "text": "Awaiting your choice: set up S3, or save on this computer?"})
+    elif command.startswith("__BROWSER__::"):
+        _emit({"type": "step", "text": "Awaiting your approval: use a web browser"})
     elif command.startswith("__MCPTOOL__::"):
         _srv, _, _rest = command[len("__MCPTOOL__::"):].partition("\t")
         _emit({"type": "step", "text": f"Awaiting your approval: MCP tool {_srv}/{_rest.split(chr(9))[0]}"})
@@ -8942,6 +8944,90 @@ def _ws_pgroup_pids(pgid: int) -> list:
         return []
 
 
+# A SAVED PGID IS ONLY OURS WHILE ITS LEADER IS THE PROCESS WE STARTED (task #373, GitHub #154).
+# shells.json / servers.json outlive their commands. After a reboot, a crash or a closed terminal
+# the id is free, and the OS hands it to the next program — an Electron app such as VS Code is its
+# own group leader — so "a group with that id exists" said "running" and a stop SIGTERMed that
+# app. The record's own start time is the proof: a process whose pid == the pgid must have started
+# when the record says (± _WS_START_SLACK). The leader gone but members left is still ours: an id
+# is never reused while a process group of that id exists.
+_WS_START_SLACK = 5.0
+
+
+def _ws_proc_start(pid: int):
+    """When process `pid` started (epoch seconds), None when there is no such process, or "" when
+    it cannot be told (no ps). POSIX ps lstart: the same spelling on macOS and procps."""
+    import subprocess
+    import time as _t
+    try:
+        out = subprocess.run(["ps", "-o", "lstart=", "-p", str(int(pid))], stdout=subprocess.PIPE,
+                             stderr=subprocess.DEVNULL, text=True, timeout=5,
+                             env={**os.environ, "LC_ALL": "C", "LANG": "C"})
+    except Exception:  # noqa: BLE001
+        return ""
+    raw = " ".join(out.stdout.split())
+    if not raw:
+        return None
+    try:
+        return _t.mktime(_t.strptime(raw, "%a %b %d %H:%M:%S %Y"))
+    except ValueError:
+        return ""
+
+
+def _ws_record_started(rec: dict):
+    """The record's start time (epoch), from `started`, else the older `started_at` string."""
+    import time as _t
+    try:
+        if rec.get("started") is not None:
+            return float(rec["started"])
+    except (TypeError, ValueError):
+        pass
+    try:
+        return _t.mktime(_t.strptime(str(rec.get("started_at")), "%Y-%m-%d %H:%M:%S"))
+    except (ValueError, OverflowError):
+        return None
+
+
+def _ws_group_owner(rec: dict, proc_start=None) -> str:
+    """Whose is the group a shell/server record names now?
+      "ours"    — its leader is the process the record started;
+      "leader-gone" — no process has that id; any group members left are still ours;
+      "other"   — that id now belongs to a process started at another time: NOT ours;
+      "unknown" — nothing to compare (no start time recorded, or ps could not say).
+    Windows has no process groups; its records are taken as they are."""
+    if _IS_WINDOWS:
+        return "ours"
+    pgid = int(rec.get("pgid") or rec.get("pid") or 0)
+    if pgid <= 0:
+        return "unknown"
+    leader = (proc_start or _ws_proc_start)(pgid)
+    if leader is None:
+        return "leader-gone"
+    started = _ws_record_started(rec)
+    if leader == "" or started is None:
+        return "unknown"
+    return "ours" if abs(float(leader) - started) <= _WS_START_SLACK else "other"
+
+
+def _ws_record_pids(rec: dict) -> list:
+    """Live pids of a record's group — none when the id has passed to another program."""
+    if _ws_group_owner(rec) == "other":
+        return []
+    return _ws_pgroup_pids(int(rec.get("pgid") or rec.get("pid") or 0))
+
+
+def _ws_stop_record(rec: dict, force: bool = False) -> bool:
+    """Signal a record's group ONLY when it is provably ours. False = nothing was signalled."""
+    owner = _ws_group_owner(rec)
+    pgid = int(rec.get("pgid") or rec.get("pid") or 0)
+    if owner not in ("ours", "leader-gone") or pgid <= 0:
+        _log(f"not stopping pgid={pgid} ('{str(rec.get('command'))[:40]}'): {owner} — the id is no "
+             "longer the process gu started")
+        return False
+    _ws_kill_tree(pgid, force=force)
+    return True
+
+
 def _ws_parse_netstat_ports(stdout: str, pids: set) -> list:
     """LISTENING ports owned by `pids`, from `netstat -ano` output. Pure, so it is testable
     on a Mac against recorded Windows output — running netstat here is not."""
@@ -9054,7 +9140,7 @@ def _ws_load_servers(prune: bool = True) -> list:
     except Exception:  # noqa: BLE001
         return []
     if prune:
-        servers = [s for s in servers if _ws_pgroup_pids(int(s.get("pgid", 0)))]
+        servers = [s for s in servers if _ws_record_pids(s)]
     return servers
 
 
@@ -9080,10 +9166,8 @@ def _ws_cap_servers(max_live: int = 3) -> list:
     if len(servers) > max_live:
         for s in servers[:-max_live]:  # registry is append-ordered → oldest first
             try:
-                pgid = int(s.get("pgid", 0))
-                if pgid <= 0:
+                if not _ws_stop_record(s):
                     continue
-                _ws_kill_tree(pgid)
                 _log(f"server lifecycle: stopped old background server pid={s.get('pid')} "
                      f"ports={s.get('ports')} ('{str(s.get('command'))[:40]}')")
             except (OSError, ValueError) as e:  # already gone / no permission
@@ -9169,7 +9253,7 @@ def _shell_state(s: dict, alive=None, now=None) -> dict:
     started = float(s.get("started") or now)
     code, code_at = _shell_exit_code(s)
     if alive is None:
-        alive = code is None and bool(_ws_pgroup_pids(int(s.get("pgid") or 0)))
+        alive = code is None and bool(_ws_record_pids(s))
     if alive and code is None and not s.get("killed"):
         return {"state": "running", "code": None, "runtime": max(0.0, now - started), "ended": now}
     ended = float(s.get("ended") or code_at or now)
@@ -9333,10 +9417,10 @@ def _shell_kill(s: dict, by: str = "the agent (stop_server)") -> None:
     if _shell_state(s)["state"] != "running":
         return
     try:
-        _ws_kill_tree(int(s.get("pgid") or 0))
-        _t.sleep(1.0)
-        if _ws_pgroup_pids(int(s.get("pgid") or 0)):
-            _ws_kill_tree(int(s.get("pgid") or 0), force=True)
+        if _ws_stop_record(s):
+            _t.sleep(1.0)
+            if _ws_record_pids(s):
+                _ws_stop_record(s, force=True)
     except (OSError, ValueError):
         pass
     s["killed"] = True
@@ -15357,12 +15441,11 @@ def run_agent_chat(cfg):
                         return msg
                 else:
                     target = servers[-1]
-                pgid = int(target["pgid"])
                 try:
-                    _ws_kill_tree(pgid)
-                    _t.sleep(1.5)
-                    if _ws_pgroup_pids(pgid):
-                        _ws_kill_tree(pgid, force=True)
+                    if _ws_stop_record(target):
+                        _t.sleep(1.5)
+                        if _ws_record_pids(target):
+                            _ws_stop_record(target, force=True)
                 except OSError:
                     pass
                 _ws_save_servers([s for s in servers if s is not target])
@@ -15578,12 +15661,40 @@ def run_agent_chat(cfg):
                 _last_obs["text"] = msg
                 return msg
 
+        # ASK FIRST (#150), the way Claude Code does: the first browser call of a turn asks the user
+        # (Allow once / Always in this folder / No), unless this folder is on the "always" list in
+        # ~/.gonext/browser-allow.json. A "No" holds for the rest of the turn.
+        _browser_consent = {"ok": False, "no": False, "where": ""}
+
+        def _browser_ask(what: str):
+            """→ "" when the browser may be used, else the message for the model."""
+            import gu_browser as _gb
+            if _browser_consent["ok"]:
+                return ""
+            if _browser_consent["no"]:
+                return ("The user did not allow the browser in this turn. Do not call browser again; "
+                        "carry on without it, or ask the user.")
+            folder = _WS_ACTIVE or _default_ws_root()
+            if _gb.allowed_in(folder):
+                _browser_consent["ok"] = True
+                return ""
+            if not (_interactive_approval and _job_id and worker_api_base and worker_api_key):
+                return ("The browser needs the user's permission and this session cannot ask. Tell the "
+                        "user to allow it (/browser allow in the gu terminal), then carry on without it.")
+            if _ws_request_approval(worker_api_base, worker_api_key, _job_id,
+                                    f"__BROWSER__::{folder}\t{what}", "", deadline_s=180):
+                _browser_consent["ok"] = True
+                return ""
+            _browser_consent["no"] = True
+            return ("The user did not allow the browser. Do not call browser again this turn; carry on "
+                    "without it, or ask the user.")
+
         @tool
         def browser(action: str, url: str = "", ref: int = 0, x: int = -1, y: int = -1,
                     text: str = "", clear: bool = False, submit: bool = False,
-                    direction: str = "", amount: int = 0, seconds: int = 0, tab: int = 0,
+                    direction: str = "", amount: int = 0, seconds: int = 0, tab: str = "",
                     new_tab: bool = False) -> str:
-            """Use a REAL Chrome browser (through the gu Chrome extension) like a person does — open a page, see it, click with the mouse, type with the keyboard — to test a UI flow, check a page renders, fill a form or click through an app. Loop: open → read (or screenshot) → click / type → read again to check what happened. Only gu's own tabs are used. If the answer starts BROWSER NOT AVAILABLE, stop and ask the user to install the extension (the answer has the steps).
+            """Use a REAL Chrome browser like a person does — open a page, see it, click with the mouse, type with the keyboard — to test a UI flow, check a page renders, fill a form or click through an app. The first call asks the user's permission. It uses the user's Chrome through the gu extension when that is installed, otherwise gu's own Chrome window (a separate profile: not logged in to the user's accounts). Loop: open → read (or screenshot) → click / type → read again to check what happened. Only gu's own tabs, and tabs the user shared, are used. If the answer starts BROWSER NOT AVAILABLE, stop and tell the user (the answer says what to do).
 
             Args:
                 action: one of: open (url) · read (page text + visible interactive elements numbered [n] with x,y) · screenshot (an image of the page; pixels = click x,y) · click / double_click / right_click / hover (ref, or x and y) · type (text into the focused field; with ref it clicks that field first) · key (text: "Enter", "Tab", "Escape", "ctrl+a", "shift+Tab"… several separated by spaces) · scroll (direction, amount) · back · reload · wait (seconds) · js (text = a JavaScript expression run in the page; returns its value) · console (the page's console messages since the last call) · tabs · switch (tab) · close
@@ -15597,7 +15708,7 @@ def run_agent_chat(cfg):
                 direction: scroll only — down (default), up, left or right
                 amount: scroll only — pixels (default most of a screen)
                 seconds: wait only — 1 to 30
-                tab: switch only — a tab id from tabs
+                tab: switch only — a tab id from tabs (a number, or an id like "8F3A…" in gu's own window)
                 new_tab: open only — open in a new tab instead of the current gu tab
             """
             import gu_browser as _gb
@@ -15627,7 +15738,7 @@ def run_agent_chat(cfg):
                 if seconds:
                     cmd["seconds"] = int(seconds)
                 if tab:
-                    cmd["tab"] = int(tab)
+                    cmd["tab"] = int(tab) if str(tab).strip().isdigit() else str(tab).strip()
                 shot_ok = a == "screenshot" and (
                     _is_anthropic_url(coding_base_url) or _coder_takes_images(coding_base_url, coding_model_id))
                 if a == "screenshot" and not shot_ok:
@@ -15635,11 +15746,20 @@ def run_agent_chat(cfg):
                 what = cmd.get("url") or (f"[{ref}]" if ref else f"{int(x)},{int(y)}" if "x" in cmd else
                                           _clip(str(text), 50) if text else "")
                 _emit({"type": "step", "text": f"Browser {a}" + (f" → {what}" if what else "")})
+                refused = _browser_ask(f"{a} {what}".strip())
+                if refused:
+                    _last_obs["text"] = refused
+                    return refused
                 ok, res, not_connected = _gb.command(
-                    cmd, log=_log,
-                    on_wait=lambda: _emit({"type": "step", "text": "Waiting for the gu Chrome extension to connect…"}))
+                    cmd, log=_log, own=True,
+                    on_wait=lambda: _emit({"type": "step", "text": "Waiting for Chrome to connect…"}))
+                where = res.pop("_backend", "") if ok and isinstance(res, dict) else ""
+                if where and where != _browser_consent["where"]:
+                    _browser_consent["where"] = where
+                    _emit({"type": "step", "text": "Using gu's own Chrome window" if where == "chrome"
+                           else "Using your Chrome (gu extension)"})
                 if not_connected:
-                    _emit({"type": "step", "text": "⚠ The gu Chrome extension is not connected — /browser shows how to install it"})
+                    _emit({"type": "step", "text": "⚠ No browser gu can use — /browser shows why"})
                     msg = _gb.install_text(str(res))
                 elif not ok:
                     msg = f"Error: browser {a} failed: {res}"
@@ -15652,6 +15772,9 @@ def run_agent_chat(cfg):
                            + _gb.format_result("read", res))
                 else:
                     msg = _gb.format_result(a, res)
+                if ok and where == "chrome" and a == "open":
+                    msg = ("(gu's own Chrome window — a separate profile, not signed in to the user's "
+                           "accounts.)\n" + msg)
             except Exception as ex:  # noqa: BLE001
                 msg = f"Error: browser {a} failed: {type(ex).__name__}: {ex}"
             _last_obs["text"] = msg

package/gu-cli.mjs

@@ -854,8 +854,9 @@ const currentApiVersion = async () => {
     }
     // RESTART LAST, and only after the new version can actually run — currentVersion() now
     // refuses a deps-less directory, so a failed install above leaves the old one serving.
-    const pid = Number((await readFile(ce.API_PID_FILE, "utf8").catch(() => "")).trim());
-    if (Number.isFinite(pid) && pid > 0) {
+    // Only while the pid on record is still the local API (#373): a stale file's id may be another program's.
+    const { pid } = await ce.apiPidToStop();
+    if (pid) {
       try { process.kill(pid, "SIGTERM"); } catch { /* already gone */ }
       // WAIT FOR THE PORT, not just for the signal. SIGTERM returns immediately and the old
       // server keeps the socket for a moment; starting the new one into that gap fails as
@@ -883,9 +884,9 @@ const currentApiVersion = async () => {
   }
 
   if (sub === "stop") {
-    const pid = Number((await readFile(ce.API_PID_FILE, "utf8").catch(() => "")).trim());
-    if (!Number.isFinite(pid) || pid <= 0) {
-      console.log("\n  No local API pid on record.\n");
+    const { pid, why } = await ce.apiPidToStop();
+    if (!pid) {
+      console.log(`\n  Nothing stopped: ${why}.\n`);
       process.exit(0);
     }
     try {
@@ -946,9 +947,9 @@ const currentApiVersion = async () => {
    * ANSWERING before starting the new one.
    */
   if (sub === "restart") {
-    const pid = Number((await readFile(ce.API_PID_FILE, "utf8").catch(() => "")).trim());
+    const { pid } = await ce.apiPidToStop();
     const before = await ce.probeLocalApi();
-    if (Number.isFinite(pid) && pid > 0) {
+    if (pid) {
       try {
         process.kill(pid, "SIGTERM");
         console.log(`\n  Stopping the local API (pid ${pid})…`);
@@ -964,7 +965,7 @@ const currentApiVersion = async () => {
       // Answering, but we have no pid to signal — started by hand, or the file was lost. Say so
       // rather than starting a SECOND one on the same port and reporting success.
       console.log(
-        `\n  The API is answering on ${ce.LOCAL_API_BASE} but there is no pid on record,` +
+        `\n  The API is answering on ${ce.LOCAL_API_BASE} but no pid on record is still it,` +
           "\n  so it cannot be stopped from here. Stop it yourself, then: gu-cli api start\n"
       );
       process.exit(1);
@@ -1292,10 +1293,8 @@ if (args[0] === "clear" || args[0] === "reset") {
   // nothing on the machine any longer knows about.
   if (groups.includes("identity")) {
     const ce = await import("./client-expert-api.mjs");
-    const pid = Number(
-      (await readFile(ce.API_PID_FILE, "utf8").catch(() => "")).trim()
-    );
-    if (Number.isFinite(pid) && pid > 0) {
+    const { pid } = await ce.apiPidToStop();
+    if (pid) {
       try {
         process.kill(pid, "SIGTERM");
         console.log(`stopped the local API (pid ${pid})`);

package/gu-repl.mjs

@@ -139,7 +139,7 @@ import {
 import { completedFlush, splitLiveStream } from "./completed-flush.mjs";
 import { isScaffoldStep, isGroupableStep, stepGroupRows, relativizePaths } from "./step-group.mjs";
 import { clearLogsNoticeText } from "./clear-logs.mjs";
-import { browserReport, bridgeStatus, extensionDir, helpInstall, installExtensionFiles } from "./browser-command.mjs";
+import { allowIn, allowedIn, bridgeCommand, browserReport, bridgeStatus, extensionDir, findDevInstalls, helpInstall, installExtensionFiles, installSteps, localLeftovers, openExtensionsPage, removeLocalFiles, STORE_URL, stopBridge } from "./browser-command.mjs";
 import { commandLogFile, killShell, logTail, markAnnounced, readShells, recapQuestion, shellsToRecap, statusText as shellStatusText, renderShellDetails, shellPickerLabel, shellState, shellsNotice } from "./shell-details.mjs";
 import { discoverSkills, matchSkillCommand } from "./skills.mjs";
 import { appendNew, archivePathFor, archivedWorkspaceKey, markReset, seedArchive } from "./conversation-archive.mjs";
@@ -954,7 +954,7 @@ const COMMANDS = [
   { name: "/open-presets", usage: "/open-presets [name]", desc: "your whole setup now, keys included, read-only in your editor — to copy to another computer; with a name, edit that preset" },
   { name: "/use-presets", usage: "/use-presets [name]", desc: "pick a saved preset and apply it — shows what changes, backs up your setup, asks first" },
   { name: "/doctor", desc: "check every configured model ANSWERS — especially the embedder, which a turn only reaches after several steps" },
-  { name: "/browser", desc: "the gu Chrome extension the agent uses to open and click web pages (UI tests) — is it connected, and how to install it" },
+  { name: "/browser", usage: "/browser [allow|forget|install|cleanup]", desc: "the gu Chrome extension the agent uses to open and click web pages (UI tests) — is it connected, and how to install it" },
   { name: "/shells", desc: "long commands the agent left running in the background — status, runtime, command, output; stop one" },
   { name: "/tokens", desc: "break down the last prompt sent to the coding model — how much of it was RAG" },
   { name: "/clear-logs", desc: "show what gu's logs, RAG indexes and old API versions take on disk, then ask what to clear — the logs first" },
@@ -9565,21 +9565,87 @@ function printShellDetails(rec) {
  */
 // /browser (#363): the extension's connection, else how to install it.
 async function showBrowser() {
+  const st = await bridgeStatus().catch(() => ({ running: false, connected: false }));
+  const lines = browserReport(st, { allowed: allowedIn(resolve(process.cwd())) });
+  console.log("");
+  for (const [i, l] of lines.entries()) console.log(GUTTER + (i === 0 && st.connected ? accent(l) : l.startsWith("⚠") ? yellow(l) : dim(l)));
+  console.log("");
+  paintBar();
+}
+
+// /browser install (#150): the extension, for the agent to use YOUR Chrome. Optional — gu's own
+// window needs nothing. The store page once published; until then the developer way.
+async function browserInstall() {
   let folder = extensionDir();
-  try {
-    folder = installExtensionFiles();
-  } catch (e) {
-    console.log(GUTTER + yellow(`could not copy the extension to ${folder}: ${e.message}`));
+  if (!STORE_URL) {
+    try {
+      folder = installExtensionFiles();
+    } catch (e) {
+      console.log(GUTTER + yellow(`could not copy the extension to ${folder}: ${e.message}`));
+    }
   }
-  const st = await bridgeStatus().catch(() => ({ running: false, connected: false }));
-  const lines = browserReport(st, folder);
+  await bridgeStatus().catch(() => null); // running, so a fresh install has something to connect to
   console.log("");
-  for (const [i, l] of lines.entries()) console.log(GUTTER + (i === 0 ? (st.connected ? accent(l) : l) : dim(l)));
-  if (!st.connected && st.running && helpInstall(folder)) console.log(GUTTER + dim("(Opened chrome://extensions and copied the folder to your clipboard.)"));
+  for (const l of installSteps(folder)) console.log(GUTTER + dim(l));
+  if (STORE_URL ? openExtensionsPage() : helpInstall(folder)) console.log(GUTTER + dim(STORE_URL ? "(Opened Chrome.)" : "(Opened chrome://extensions and copied the folder to your clipboard.)"));
   console.log("");
   paintBar();
 }
 
+// /browser cleanup (#145, #147): remove the developer (unpacked) install so the Chrome Web Store
+// one can take its place. Chrome lets no other program uninstall an extension, so: the connected
+// developer copy removes itself (chrome.management.uninstallSelf), other profiles get a Remove
+// click from you, and then gu's own files go.
+async function browserCleanup() {
+  if (listPickerActive || approvalActive) return;
+  const out = (l = "") => console.log(l ? GUTTER + l : "");
+  const st = await bridgeStatus({ start: false, waitMs: 0 }).catch(() => ({ connected: false }));
+  const devConnected = st.connected && st.installType === "development";
+  const installs = findDevInstalls();
+  const files = localLeftovers();
+  out();
+  if (!installs.length && !devConnected && !files.length) {
+    out(accent("✓ Nothing of the gu extension's developer install is left."));
+    out();
+    paintBar();
+    return;
+  }
+  out("The gu extension's developer install — what this removes:");
+  for (const f of installs) out(dim(`  • ${f.browser} — ${f.profile}: gu browser, unpacked (${f.id})`));
+  if (devConnected && !installs.some((f) => f.id === st.id)) out(dim(`  • the connected developer copy (${st.id})`));
+  for (const f of files) out(dim(`  • ${f.replace(homedir(), "~")}`));
+  if (st.connected && st.installType === "normal") out(dim("  (The Chrome Web Store copy is connected — it stays.)"));
+  out();
+  const go = await pickFromList(["Clean up", "Cancel"], 0);
+  if (go !== 0) {
+    out(dim("(cancelled)"));
+    out();
+    paintBar();
+    return;
+  }
+  if (devConnected) {
+    const r = await bridgeCommand({ action: "uninstall_self" });
+    out(r.ok ? accent(`✓ Removed from Chrome: the connected developer copy (${st.id}).`) : yellow(`could not remove the connected copy: ${r.error}`));
+    await new Promise((res) => setTimeout(res, 1500)); // Chrome writes its profile a moment later
+  }
+  const left = findDevInstalls().filter((f) => !(devConnected && f.id === st.id));
+  if (left.length) {
+    out("Chrome does not let gu remove an extension in another profile. In each of these,");
+    out("open chrome://extensions, find \"gu browser\" and click Remove:");
+    for (const f of left) out(dim(`  • ${f.browser} — ${f.profile}`));
+    if (openExtensionsPage()) out(dim("(Opened chrome://extensions.)"));
+    await pickFromList(["Done — I removed it", "Skip — leave it in that browser"], 0);
+  }
+  stopBridge();
+  await new Promise((res) => setTimeout(res, 300));
+  const gone = removeLocalFiles();
+  if (gone.length) out(accent(`✓ Deleted ${gone.length} of gu's file(s) in ~/.gonext.`));
+  const still = [...findDevInstalls().filter((f) => !(devConnected && f.id === st.id)).map((f) => `${f.browser} — ${f.profile}`), ...localLeftovers()];
+  out(still.length ? yellow(`Still there: ${still.join(", ")}`) : accent("✓ The developer install is gone. Install the Chrome Web Store copy, then /browser."));
+  out();
+  paintBar();
+}
+
 async function showShells() {
   if (listPickerActive || approvalActive) return;
   const width = Math.max(20, process.stdout.columns || 80);
@@ -10540,6 +10606,9 @@ const S3SETUP_PREFIX = "__S3SETUP__::";
 // "Always" writes an allow rule to ~/.gonext/mcp.json — the agent re-reads that file before every
 // call, so it counts from the next call of this same turn, and for every turn after.
 const MCPTOOL_PREFIX = "__MCPTOOL__::";
+// The agent's first use of the browser in a turn (#150): "<folder>\t<what it is about to do>".
+// "Always" puts the folder on ~/.gonext/browser-allow.json, which the agent reads before asking.
+const BROWSER_PREFIX = "__BROWSER__::";
 async function approvalPrompt(command) {
   // Wipe the live "thinking" status block BEFORE any picker draws, and stop the ticker from
   // redrawing it (the tick early-returns while a picker is active) — otherwise the block
@@ -10597,6 +10666,25 @@ async function approvalPrompt(command) {
     );
     return { allow: idx === 0, dontAsk: false };
   }
+  if (command.startsWith(BROWSER_PREFIX)) {
+    const [folder = "", what = ""] = command.slice(BROWSER_PREFIX.length).split("\t");
+    if (!process.stdin.isTTY) return { allow: false, dontAsk: false };
+    process.stdout.write(
+      "\n" + yellow("🌐 Allow gu to use a web browser?") + dim("  (no answer in ~3 min = No)") + "\n" +
+        dim(`  It wants to: ${what || "open a page"}`) + "\n" +
+        dim("  In your Chrome if the gu extension is there, else in gu's own Chrome window.") + "\n"
+    );
+    const idx = await pickFromList(["Yes, this time", "Yes, always in this folder", "No"], 0, { timeoutMs: 170000, timeoutIndex: 2 });
+    if (idx === 1) {
+      try {
+        allowIn(folder || resolve(process.cwd()), true);
+        process.stdout.write(dim("  (won't ask again here — /browser forget undoes it)\n"));
+      } catch (e) {
+        process.stdout.write(yellow(`  could not save that (${e?.message || e}) — allowed this once\n`));
+      }
+    }
+    return { allow: idx === 0 || idx === 1, dontAsk: false };
+  }
   if (command.startsWith(MCPTOOL_PREFIX)) {
     const [server = "", tool = "", preview = ""] = command.slice(MCPTOOL_PREFIX.length).split("\t");
     if (!process.stdin.isTTY) return { allow: false, dontAsk: false };
@@ -14211,6 +14299,22 @@ async function main() {
       await showBrowser();
       continue;
     }
+    if (line === "/browser cleanup") {
+      await browserCleanup();
+      continue;
+    }
+    if (line === "/browser install") {
+      await browserInstall();
+      continue;
+    }
+    if (line === "/browser allow" || line === "/browser forget") {
+      allowIn(cwd, line === "/browser allow");
+      console.log("\n" + GUTTER + (line === "/browser allow"
+        ? accent("✓ The agent may use the browser in this folder without asking.") + dim(" (/browser forget undoes it)")
+        : accent("✓ The agent asks again before it uses the browser in this folder.")) + "\n");
+      paintBar();
+      continue;
+    }
     if (line === "/model") {
       await chooseModel();
       continue;