@tiens.nguyen/gu-cli 1.0.834 → 1.0.835

package/gu_browser.py

@@ -18,7 +18,7 @@ import urllib.request
 
 HERE = os.path.dirname(os.path.abspath(__file__))
 EXT_SRC = os.path.join(HERE, "browser-extension")
-EXT_FILES = ("manifest.json", "background.js", "popup.html", "popup.js",
+EXT_FILES = ("manifest.json", "background.js", "actions.js", "popup.html", "popup.js",
              "icons/icon16.png", "icons/icon48.png", "icons/icon128.png")
 BRIDGE = os.path.join(HERE, "browser-bridge.mjs")
 
@@ -69,18 +69,75 @@ def install_extension_files():
     return dst
 
 
+# The Chrome Web Store page of the gu extension, once it is published (#149/#150). Until then the
+# extension is the developer path only — and nobody needs it: gu's own Chrome window works without.
+STORE_URL = os.environ.get("GU_BROWSER_STORE_URL", "")
+
+
+def allow_path():
+    return os.path.join(os.path.dirname(state_path()), "browser-allow.json")
+
+
+def _real(folder):
+    try:
+        return os.path.realpath(folder)
+    except OSError:
+        return folder
+
+
+def allowed_in(folder):
+    """Has the user said "always allow the browser" for this folder (#150)?"""
+    try:
+        with open(allow_path(), encoding="utf-8") as f:
+            return _real(folder) in (json.load(f).get("folders") or [])
+    except (OSError, ValueError):
+        return False
+
+
+def allow_in(folder, allow=True):
+    """Add (or remove) a folder on the "always allow" list. The terminal writes it on "Always"."""
+    try:
+        with open(allow_path(), encoding="utf-8") as f:
+            folders = json.load(f).get("folders") or []
+    except (OSError, ValueError):
+        folders = []
+    f_ = _real(folder)
+    folders = [x for x in folders if x != f_] + ([f_] if allow else [])
+    os.makedirs(os.path.dirname(allow_path()), exist_ok=True)
+    with open(allow_path(), "w", encoding="utf-8") as f:
+        json.dump({"folders": folders}, f, indent=2)
+
+
+def last_seen():
+    """{version, installType} of the extension that last connected, or {} (#146). An older marker
+    holds only the version."""
+    try:
+        with open(seen_path(), encoding="utf-8") as f:
+            raw = f.read().strip()
+        try:
+            return json.loads(raw) if raw.startswith("{") else {"version": raw}
+        except ValueError:
+            return {"version": raw}
+    except OSError:
+        return {}
+
+
 def install_text(reason="not connected"):
     """What the model is told when the extension is not there: stop and ask the user."""
-    folder = install_extension_files()
+    if last_seen().get("installType") == "normal":
+        # The Chrome Web Store copy is installed: never point at the developer folder again (#145).
+        return (f"BROWSER NOT AVAILABLE ({reason}): the gu Chrome extension (Chrome Web Store) is "
+                "installed but not connected — Chrome is probably closed. STOP and ask the user to "
+                "open Chrome (the extension reconnects within 30 seconds, or its icon → Connect now), "
+                "then continue. /browser in the gu terminal shows the status.")
+    # gu's own Chrome window needs no extension (#150), so this is reached only when there is no
+    # Chrome to start at all.
     return (
-        f"BROWSER NOT AVAILABLE ({reason}): the gu Chrome extension is not installed, or Chrome is "
-        "not running. Do NOT try to work around it with curl or a headless script for a UI check — "
-        "STOP and ask the user to install it, then continue when they say it is done. Tell them:\n"
-        "  1. Open Chrome and go to chrome://extensions\n"
-        "  2. Turn on Developer mode (top right)\n"
-        f"  3. Click \"Load unpacked\" and choose the folder {folder}\n"
-        "  4. (Or type /browser in the gu terminal for these steps and the connection status.)\n"
-        "gu only uses its own tabs (a tab group named \"gu\"); the user's other tabs are never touched.")
+        f"BROWSER NOT AVAILABLE ({reason}). gu opens its own Chrome window when the gu extension is "
+        "not there, and it found no Chrome, Chromium, Edge or Brave on this computer. Do NOT work "
+        "around it with curl or a headless script for a UI check — STOP and tell the user: install "
+        "Google Chrome (or set GU_BROWSER_CHROME to a Chromium-based browser), then ask again."
+        + (f" To use their own Chrome instead, they can add the gu extension: {STORE_URL}" if STORE_URL else ""))
 
 
 def _node():
@@ -135,8 +192,10 @@ def _start_bridge(log=None):
     return None
 
 
-def connect(wait=True, log=None, on_wait=None):
-    """→ (state, None) when the extension is connected, else (None, reason)."""
+def connect(wait=True, log=None, on_wait=None, own=False):
+    """→ (state, None) when the extension is connected, else (None, reason).
+    own=True (#150): gu's own Chrome window may stand in, so a missing extension is no failure —
+    → (state, None) either way, and the wait for a sleeping extension is shorter."""
     st = _read_state()
     started = False
     try:
@@ -151,7 +210,10 @@ def connect(wait=True, log=None, on_wait=None):
     # A Chrome extension's worker sleeps; its alarm wakes it to reconnect within 30 s. Wait that
     # long only when an extension has connected before — otherwise it is most likely not installed.
     seen = os.path.exists(seen_path())
-    wait_ms = (35000 if (seen and started) else 8000 if seen else 4000) if wait else 0
+    if own:
+        wait_ms = (8000 if seen else 0) if wait else 0  # then gu's own window
+    else:
+        wait_ms = (35000 if (seen and started) else 8000 if seen else 4000) if wait else 0
     if wait_ms >= 8000 and on_wait:
         on_wait()
     try:
@@ -159,21 +221,26 @@ def connect(wait=True, log=None, on_wait=None):
     except OSError as e:
         return None, f"the gu browser bridge is not answering ({e})"
     if not s.get("connected"):
-        return None, "extension not connected"
-    if not seen:
+        return (st, None) if own else (None, "extension not connected")
+    mark = {"version": s.get("version"), "installType": s.get("installType")}
+    if last_seen() != mark:
         try:
             with open(seen_path(), "w") as f:
-                f.write(str(s.get("version") or ""))
+                json.dump(mark, f)
         except OSError:
             pass
     return st, None
 
 
-def command(cmd, log=None, on_wait=None):
-    """Send one command. → (ok, result_or_error, not_connected)."""
-    st, why = connect(log=log, on_wait=on_wait)
+def command(cmd, log=None, on_wait=None, own=False):
+    """Send one command. → (ok, result_or_error, not_connected).
+    own=True: without the extension, the bridge uses gu's own Chrome window (#150). The result
+    then carries "_backend": "chrome"."""
+    st, why = connect(log=log, on_wait=on_wait, own=own)
     if not st:
         return False, why, True
+    if own:
+        cmd = dict(cmd, backend="auto")
     timeout_s = 75 if cmd.get("action") in ("open", "wait", "js") else 40
     try:
         r = _http(st, "POST", "/cmd", body=dict(cmd, timeout_ms=(timeout_s - 5) * 1000), timeout=timeout_s)
@@ -181,9 +248,14 @@ def command(cmd, log=None, on_wait=None):
         return False, f"the browser bridge did not answer ({e})", False
     if r.get("_status") == 503:
         return False, "extension not connected", True
+    if r.get("noChrome"):
+        return False, str(r.get("error")), True  # nothing to drive: the install answer applies
     if not r.get("ok"):
         return False, str(r.get("error") or "failed"), False
-    return True, r.get("result") or {}, False
+    res = r.get("result") or {}
+    if isinstance(res, dict) and r.get("backend"):
+        res["_backend"] = r["backend"]
+    return True, res, False
 
 
 # ── what the model reads ────────────────────────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.834",
+  "version": "1.0.835",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -125,10 +125,12 @@
     "skills.mjs",
     "skill-source.mjs",
     "shell-details.mjs",
+    "proc-identity.mjs",
     "browser-command.mjs",
     "browser-bridge.mjs",
     "browser-extension/manifest.json",
     "browser-extension/background.js",
+    "browser-extension/actions.js",
     "browser-extension/popup.html",
     "browser-extension/popup.js",
     "browser-extension/icons/",

package/proc-identity.mjs

@@ -0,0 +1,53 @@
+// IS THIS PID STILL THE PROCESS WE MEANT? (task #373, GitHub #154)
+//
+// gu keeps process ids in files — shells.json, the local API's pid file, the browser bridge's state —
+// and those files outlive their processes. After a reboot or a crash the id is free, and the OS
+// hands it to the next program (VS Code, Chrome); a SIGTERM to the saved id then lands on that.
+// A process's START TIME is what tells two holders of one id apart, so it is what gu records and
+// checks before it signals anything. POSIX only: `ps -o lstart=` reads the same on macOS and procps.
+
+import { spawnSync } from "node:child_process";
+
+const MONTHS = "JanFebMarAprMayJunJulAugSepOctNovDec";
+
+/** When `pid` started (epoch s); null = no such process; NaN = cannot tell (no ps, Windows). */
+export function procStart(pid, { platform = process.platform } = {}) {
+  if (platform === "win32" || !(Number(pid) > 0)) return NaN;
+  const r = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+    encoding: "utf8",
+    env: { ...process.env, LC_ALL: "C", LANG: "C" },
+    timeout: 5000,
+  });
+  if (r.error) return NaN;
+  const raw = String(r.stdout || "").trim().replace(/\s+/g, " ");
+  if (!raw) return null;
+  // "Wed Oct 14 23:26:17 2026", local time.
+  const m = raw.match(/^\w{3} (\w{3}) (\d{1,2}) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/);
+  const mon = m ? MONTHS.indexOf(m[1]) / 3 : -1;
+  if (!m || mon < 0 || !Number.isInteger(mon)) return NaN;
+  return new Date(Number(m[6]), mon, Number(m[2]), Number(m[3]), Number(m[4]), Number(m[5])).getTime() / 1000;
+}
+
+/** The command line of `pid` ("" when there is none, or no ps). */
+export function procCommand(pid, { platform = process.platform } = {}) {
+  if (platform === "win32" || !(Number(pid) > 0)) return "";
+  const r = spawnSync("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8", timeout: 5000 });
+  return r.error ? "" : String(r.stdout || "").trim();
+}
+
+/**
+ * Is `pid` the process that was running at `startedAt` (epoch s, as recorded)?
+ *   "same"  — it started then (within `before` s before and `after` s after the record);
+ *   "gone"  — no process has that id;
+ *   "other" — that id belongs to a process started at another time: never signal it;
+ *   "unknown" — nothing to compare (Windows, no ps, nothing recorded).
+ * `before` is the room for a record written a while after its process started (a server that
+ * records itself once it listens); `after` is ps's whole-second rounding.
+ */
+export function sameProcess(pid, startedAt, { before = 5, after = 5, startOf = procStart } = {}) {
+  const t = startOf(pid);
+  if (t === null) return "gone";
+  const rec = Number(startedAt);
+  if (!Number.isFinite(t) || startedAt == null || !Number.isFinite(rec)) return "unknown";
+  return t >= rec - before && t <= rec + after ? "same" : "other";
+}

package/shell-details.mjs

@@ -15,6 +15,9 @@ import { existsSync, openSync, readSync, closeSync, fstatSync, readFileSync, rea
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, normalize } from "node:path";
 import { spawnSync } from "node:child_process";
+import { procStart } from "./proc-identity.mjs";
+
+export { procStart };
 
 export const shellsPath = (home = homedir()) => join(home, ".gonext", "shells.json");
 
@@ -40,10 +43,39 @@ export function readExit(rec) {
   }
 }
 
-/** Is the shell's process group (POSIX) or process (Windows) still there? */
-export function isAlive(rec, platform = process.platform) {
+// A SAVED PGID IS ONLY OURS WHILE ITS LEADER IS THE PROCESS WE STARTED (#373, GitHub #154) — the
+// same rule as the agent's _ws_group_owner. shells.json outlives its commands; after a reboot or a
+// crash the id goes to the next program (VS Code is its own group leader), and "a group with that
+// id exists" read as running and offered "Stop it" on someone else's app. The record's start time
+// is the proof: the process whose pid == the pgid must have started then (± START_SLACK_S). With
+// no such process, members left in the group are still ours — an id in use is never reused.
+export const START_SLACK_S = 5;
+
+/** The record's start (epoch s): `started`, else the older "YYYY-MM-DD HH:MM:SS" `started_at`. */
+function recordStarted(rec) {
+  const n = Number(rec?.started);
+  if (rec?.started != null && Number.isFinite(n)) return n;
+  const m = String(rec?.started_at ?? "").match(/^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})$/);
+  return m ? new Date(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]).getTime() / 1000 : null;
+}
+
+/** "ours" | "leader-gone" | "other" (the id now belongs to another program) | "unknown". */
+export function groupOwner(rec, { platform = process.platform, startOf = procStart } = {}) {
+  if (platform === "win32") return "ours";
+  const pgid = Number(rec?.pgid || rec?.pid || 0);
+  if (!pgid) return "unknown";
+  const leader = startOf(pgid);
+  if (leader === null) return "leader-gone";
+  const started = recordStarted(rec);
+  if (!Number.isFinite(leader) || started == null) return "unknown";
+  return Math.abs(leader - started) <= START_SLACK_S ? "ours" : "other";
+}
+
+/** Is the shell's process group (POSIX) or process (Windows) still there — and still ours? */
+export function isAlive(rec, platform = process.platform, { startOf = procStart } = {}) {
   const pid = Number(rec?.pgid || rec?.pid || 0);
   if (!pid) return false;
+  if (groupOwner(rec, { platform, startOf }) === "other") return false;
   try {
     process.kill(platform === "win32" ? pid : -pid, 0);
     return true;
@@ -237,15 +269,17 @@ export function shellPickerLabel(rec, st, width = 80) {
  * Stop a shell's whole group and record that it was killed — the record is what the agent reads
  * next turn, so "killed" must not later read as "ended (exit code unknown)".
  */
-export async function killShell(rec, { path = shellsPath(), platform = process.platform } = {}) {
+export async function killShell(rec, { path = shellsPath(), platform = process.platform, startOf = procStart } = {}) {
   const pid = Number(rec?.pgid || rec?.pid || 0);
-  if (pid && isAlive(rec, platform)) {
+  // Only a group that is provably the one gu started is signalled — never "unknown", never "other".
+  const ours = ["ours", "leader-gone"].includes(groupOwner(rec, { platform, startOf }));
+  if (pid && ours && isAlive(rec, platform, { startOf })) {
     if (platform === "win32") {
       spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
     } else {
       try { process.kill(-pid, "SIGTERM"); } catch { /* gone already */ }
-      for (let i = 0; i < 10 && isAlive(rec, platform); i++) await new Promise((r) => setTimeout(r, 100));
-      if (isAlive(rec, platform)) try { process.kill(-pid, "SIGKILL"); } catch { /* gone */ }
+      for (let i = 0; i < 10 && isAlive(rec, platform, { startOf }); i++) await new Promise((r) => setTimeout(r, 100));
+      if (isAlive(rec, platform, { startOf })) try { process.kill(-pid, "SIGKILL"); } catch { /* gone */ }
     }
   }
   if (!existsSync(path)) return;

package/terminal-layout.mjs

@@ -1148,6 +1148,7 @@ export function trimWords(text, limit) {
 // grey ✗ with dim text. Judged by the LAST segment of a chain/pipeline (its exit status is
 // the one reported): `ps aux | grep foo` and `cd src && rg Foo` are both look-ups.
 const SEARCH_CMDS = new Set([
+  // platform-ok: names to recognise in a command the agent ran — nothing here runs them.
   "grep", "egrep", "fgrep", "zgrep", "rg", "ag", "ack", "pgrep", "which", "whereis", "lsof",
 ]);
 export function isSoftFailCommand(cmd) {