@tiens.nguyen/gu-cli 1.0.834 → 1.0.836

package/gonext_agent_chat.py

@@ -7933,6 +7933,123 @@ def _ws_shell_command_risk(scan, denyset, wd="", allowset=None, roots=None):
     return (None, None, None)
 
 
+# ---- POWERSHELL LINES (task #374, GitHub #155) ---------------------------------------------------
+# The same policy as a bash line, read with gu_powershell: every simple command — inside $( ),
+# @( ), ( ) and { } too, since a ForEach-Object block runs — through the allow/deny lists,
+# elevation, deletes and writes outside the project (cmdlets' -Path/-Destination as well as
+# redirects), plus PowerShell's own ways to run text as code: Invoke-Expression, piping into an
+# interpreter (unless what is piped is a string the line itself wrote — PowerShell's heredoc),
+# [ScriptBlock]::Create and -EncodedCommand.
+
+def _ps_mod():
+    import gu_powershell as _gp
+    return _gp
+
+
+def _ps_background_error(scan):
+    """A line ending a command with `&` (a PowerShell job, gone when the shell exits), or None."""
+    gp = _ps_mod()
+    top, _ = gp.ps_all_commands(scan)
+    if any(c["background"] for c in top):
+        return ("Error: that command did NOT run. Do not end it with `&` — in PowerShell that "
+                "starts a job that dies with the shell. run_command already leaves a server or app "
+                "RUNNING when it starts listening or opens a window; for a long job pass "
+                "background=True. Send the same command without the `&`.")
+    return None
+
+
+def _ps_priv_reason(scan):
+    """Elevation in any command of a PowerShell line (runas, -Verb RunAs, sudo, ACL/service/
+    registry rewrites) — judged with the Windows rules whatever OS reads it."""
+    gp = _ps_mod()
+    top, inner = gp.ps_all_commands(scan)
+    for c in top + inner:
+        r = _ws_priv_reason(" ".join(c["argv"]), windows=True)
+        if r:
+            return r
+    return None
+
+
+def _ps_native_paths(paths, wd):
+    """PowerShell paths as the OS reads them: $env:X / $HOME / ~ filled in. A path that only
+    exists at run time ($_, $x) becomes an impossible one, so it is never judged "inside"."""
+    gp = _ps_mod()
+    out = []
+    for p in paths:
+        q = gp.ps_expand_path(p, os.environ, os.path.expanduser("~"), wd or os.getcwd())
+        out.append(q if q is not None else os.path.join(os.sep, "gu-unknown-at-run-time", p))
+    return out
+
+
+def _ws_ps_command_risk(scan, denyset, wd="", allowset=None, roots=None):
+    """_ws_shell_command_risk for a PowerShell line. Same contract: (refuse, hard, ask)."""
+    gp = _ps_mod()
+    top, inner = gp.ps_all_commands(scan)
+    every = top + inner
+    effects = [(c, gp.ps_effects(c)) for c in every]
+
+    def names(c, e):
+        raw = re.split(r"[\\/]", c["argv"][0])[-1].lower() if c["argv"] else ""
+        return {n for n in (raw, e["program"], c["argv"][0] if c["argv"] else "") if n}
+
+    if allowset:
+        low = {a.lower() for a in allowset}
+        for c, e in effects:
+            if e["program"] and not (names(c, e) & (set(allowset) | low)):
+                return (f"Error: '{c['argv'][0]}' is not in your run allowlist. Add it in web "
+                        "Settings → Agent, or clear the allowlist to allow all commands.", None, None)
+    priv = _ps_priv_reason(scan)
+    if priv:
+        return (None, priv, priv)
+    if denyset:
+        low = {d.lower() for d in denyset}
+        for c, e in effects:
+            if e["program"] and names(c, e) & (set(denyset) | low):
+                msg = f"'{c['argv'][0]}' is on your blocked-commands list"
+                return (None, msg, msg)
+    # Deletes and writes outside the project, following Set-Location the way PowerShell will.
+    cur = wd
+    for c, e in effects:
+        is_top = any(c is t for t in top)
+        if is_top and e["program"] in ("set-location", "push-location") and c["sep"] != "|":
+            _, pos, _ = gp.ps_bound(c["argv"])
+            if pos:
+                p = _ps_native_paths(pos[:1], cur)[0]
+                cur = os.path.normpath(os.path.join(cur or os.getcwd(), p))
+            continue
+        here = cur if is_top else wd
+        why = None
+        if e["deletes"]:
+            why = _ws_delete_outside_reason(["rm"] + _ps_native_paths(e["deletes"], here), here, roots)
+        if not why and e["writes"]:
+            why = _ws_write_outside_reason([(">", t) for t in _ps_native_paths(e["writes"], here)],
+                                           here, roots)
+        if why:
+            return (None, why, why)
+    # Text run as code.
+    for k, c in enumerate(top):
+        e = gp.ps_effects(c)
+        if c["sep"] == "|" and e["program"] in gp.PS_INTERPRETERS \
+                and all(x.startswith("-") for x in c["argv"][1:]):
+            # Upstream of this stage, back to the pipeline's start: only a literal string = the
+            # code is in the line itself (a heredoc). Anything else feeds it unseen text.
+            j = k
+            while j > 0 and top[j]["sep"] == "|":
+                j -= 1
+            if not all(gp.ps_is_literal(x) for x in top[j:k]):
+                msg = f"it pipes text into {c['argv'][0]}, which runs that text as code"
+                return (None, msg, msg)
+    for c, e in effects:
+        if e["runs_text"]:
+            return (None, None, f"it runs text as code ({e['runs_text']})")
+        if e["dynamic"]:
+            return (None, None, f"the program to run is only known at run time ({c['argv'][0][:40]})")
+    for c, e in effects:
+        if e["destructive"] or _WS_DESTRUCTIVE_RE.search(" ".join(c["argv"])):
+            return (None, None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None, None)
+
+
 def _with_attribution_text(command, scan, settings):
     """_with_attribution for a SHELL line: the co-author trailer is inserted into the text right
     after each top-level `git … commit` word. → (command, note). A gh pr create body written as a
@@ -7940,7 +8057,7 @@ def _with_attribution_text(command, scan, settings):
     import shlex as _shlex
     name = str(settings.get("name") or "").strip()
     email = str(settings.get("email") or "").strip()
-    cmds = _shell_commands(scan["tokens"])
+    cmds = scan["commands"] if "commands" in scan else _shell_commands(scan["tokens"])
     notes = []
     if settings.get("commit") and name and email and email.lower() not in command.lower():
         at = []
@@ -7990,30 +8107,79 @@ def _git_bash_path(env=None, which=None, isfile=None):
     return ""
 
 
+_RUN_SHELL_KIND = None
+
+
+def _pwsh_path(env=None, which=None, isfile=None):
+    """PowerShell for run_command, or "". PURE given its lookups (tested off Windows).
+
+    GU_PWSH_PATH first; then PowerShell 7 (`pwsh`), which has && and || of its own; then Windows
+    PowerShell 5.1, which every Windows 10/11 has — gu supplies && and || there itself."""
+    import ntpath
+    import shutil as _sh
+    env = os.environ if env is None else env
+    which = which or _sh.which
+    isfile = isfile or os.path.isfile
+    if env.get("GU_PWSH_PATH") and isfile(env["GU_PWSH_PATH"]):
+        return env["GU_PWSH_PATH"]
+    for name in ("pwsh", "powershell"):
+        p = which(name) or ""
+        if p and "\\windowsapps\\" not in p.lower():  # never a Store alias stub
+            return p
+    root = env.get("SystemRoot") or env.get("SYSTEMROOT") or env.get("WINDIR") or ""
+    if root:
+        p = ntpath.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+        if isfile(p):
+            return p
+    return ""
+
+
+def _run_shell_kind():
+    """"bash" | "powershell" | "" — how run_command runs a line (see _run_shell_bin)."""
+    _run_shell_bin()
+    return _RUN_SHELL_KIND or ""
+
+
 def _run_shell_bin():
-    """The shell for run_command's shell lines: bash (else sh), Git Bash on Windows — or "" for
-    the argv-only path (Windows without Git for Windows, or GU_RUN_NO_SHELL=1, the way back if a
-    shell line ever misbehaves for a user)."""
-    global _RUN_SHELL_BIN
+    """The shell for run_command (task #359; PowerShell #374): bash (else sh) on macOS/Linux;
+    on Windows PowerShell, the way Claude Code does it there — Git Bash instead with
+    GU_WINDOWS_SHELL=bash. "" = the argv-only path (GU_RUN_NO_SHELL=1, the way back if a shell
+    line ever misbehaves for a user, or no shell found). GU_RUN_SHELL=powershell|bash picks one
+    on any OS (how the PowerShell path is tested on a Mac)."""
+    global _RUN_SHELL_BIN, _RUN_SHELL_KIND
     if os.environ.get("GU_RUN_NO_SHELL") == "1":
         return ""
     if _RUN_SHELL_BIN is None:
-        if os.name == "nt":
-            _RUN_SHELL_BIN = _git_bash_path()
-            _log("run_command shell: " + ("Git Bash" if _RUN_SHELL_BIN else
-                 "none (Git for Windows not found) — commands run without a shell"))
+        import shutil as _sh
+        want = (os.environ.get("GU_RUN_SHELL") or "").strip().lower()
+        if not want:
+            want = ("bash" if (os.environ.get("GU_WINDOWS_SHELL") or "").strip().lower() == "bash"
+                    else "powershell") if os.name == "nt" else "bash"
+        if want == "powershell":
+            _RUN_SHELL_BIN, _RUN_SHELL_KIND = _pwsh_path(), "powershell"
+            if not _RUN_SHELL_BIN and os.name == "nt":
+                _RUN_SHELL_BIN, _RUN_SHELL_KIND = _git_bash_path(), "bash"
+        elif os.name == "nt":
+            _RUN_SHELL_BIN, _RUN_SHELL_KIND = _git_bash_path(), "bash"
+            if not _RUN_SHELL_BIN:
+                _RUN_SHELL_BIN, _RUN_SHELL_KIND = _pwsh_path(), "powershell"
         else:
-            import shutil as _sh
-            _RUN_SHELL_BIN = next((p for p in (_sh.which("bash"), "/bin/bash", "/bin/sh")
-                                   if p and os.path.exists(p)), "")
+            _RUN_SHELL_BIN, _RUN_SHELL_KIND = next(
+                (p for p in (_sh.which("bash"), "/bin/bash", "/bin/sh") if p and os.path.exists(p)), ""), "bash"
+        if not _RUN_SHELL_BIN:
+            _RUN_SHELL_KIND = ""
+        _log("run_command shell: " + ({"powershell": "PowerShell", "bash": "bash"}.get(_RUN_SHELL_KIND, "none")
+             + (f" ({_RUN_SHELL_BIN})" if _RUN_SHELL_BIN else " — commands run without a shell")))
     return _RUN_SHELL_BIN
 
 
-def _run_command_prompt_line(shell, windows=None):
+def _run_command_prompt_line(shell, windows=None, kind=None):
     """The system prompt's run_command rule. With a shell it carries the git and GitHub recipes,
     the way Claude Code's Bash tool description does: told how to batch, the model does (#359).
-    On Windows the shell is Git Bash, and the line says what differs there."""
+    On Windows the shell is PowerShell (#374) — or Git Bash, and the line says what differs there."""
     windows = (os.name == "nt") if windows is None else windows
+    if shell and kind == "powershell":
+        return _PS_PROMPT_LINE + _BG_LINE
     if not shell:
         return (
             "    run_command CHAINS: put dependent commands in ONE call with && — e.g. "
@@ -8052,6 +8218,37 @@ def _run_command_prompt_line(shell, windows=None):
         "RUNNING — stop_server closes it. " + _BG_LINE)
 
 
+# The run_command rule when the shell is PowerShell (#374) — Claude Code's PowerShell tool, in gu's
+# words: the same recipes as the bash line, written the PowerShell way.
+_PS_PROMPT_LINE = (
+    "    run_command IS POWERSHELL (Windows), and it KEEPS its folder and $env: variables from one "
+    "call to the next in this turn (`cd sub`, then `npm test` runs in sub; an explicit workdir "
+    "wins). Write PowerShell, not bash: pipes `|`, `;`, `&&`, `||`, redirects (`> out.txt`, "
+    "`2>&1`), `$env:NAME = 'x'` (not export), cmdlets (Get-ChildItem, Select-String, "
+    "Get-Content -Tail 40, Remove-Item -Recurse), `$LASTEXITCODE`. Put a whole sequence in ONE call "
+    "(e.g. `cd app && npm test 2>&1 | Select-Object -Last 40`); a multi-line command goes in a "
+    "triple-quoted string. A program path with spaces needs the call operator: "
+    "`& 'C:\\Program Files\\x\\x.exe' args`. Python is `py -3` or `python`, not python3.\n"
+    "    MULTI-LINE TEXT is a here-string: `@'` ends its line, the text follows, and `'@` STARTS "
+    "the closing line; nothing inside needs escaping.\n"
+    "    GIT in one call each: look (`git status -sb; git diff --stat; git log --oneline -5`), "
+    "commit (`git add a.py b.py; if ($?) { git commit -m \"msg\" }` or with a here-string: "
+    "`@'` newline message newline `'@ | git commit -F -`).\n"
+    "    GITHUB: use `gh`. A multi-line body goes as a here-string on stdin — `@'` … `'@ | gh issue "
+    "comment 12 --body-file -` (same for gh issue create / gh pr create) — never write a body file "
+    "first, and do not run `gh auth status` first.\n"
+    "    CHECKS: a Python/Node script goes as a here-string piped in — `@'` … `'@ | py -3 -` (node: "
+    "`| node --input-type=module -`). To check one function, load its module and call it with real "
+    "input instead of running the app. Order: syntax check → the ONE test → the suite once. Test "
+    "output arrives with a TEST SUMMARY of each failure first, so never pipe it into "
+    "Select-Object/Select-String (a pipe hides the exit code).\n"
+    "    Read and search FILES with read_file_lines / grep_repo, not Get-Content/Select-String. "
+    "Elevation (Start-Process -Verb RunAs, runas, sudo) is blocked; Invoke-Expression, piping "
+    "into an interpreter, and writing or deleting outside the project ask the user first; never "
+    "end a line with `&` (a background job). An interactive prompt (Read-Host) fails. A server "
+    "or GUI app is left RUNNING — stop_server closes it. ")
+
+
 # THE BROWSER (task #363, GitHub #144): a real Chrome the agent drives through the gu extension.
 # Offered only where commands may run (the terminal's own folders, never the web app's scratch one)
 # and node can start the bridge. GU_BROWSER=0 turns it off.
@@ -8071,9 +8268,9 @@ _BROWSER_LINE = (
     "(text + numbered elements) or browser(\"screenshot\") → browser(\"click\", ref=n) / "
     "browser(\"type\", ref=n, text=…) → read again to check the result; browser(\"console\") shows "
     "page errors. A local app needs its server running first (run_command background=True). "
-    "Never report a UI as working without looking at it. If browser answers BROWSER NOT "
-    "AVAILABLE, stop and ask the user to install the gu Chrome extension (steps are in the "
-    "answer).\n")
+    "Never report a UI as working without looking at it. The first browser call asks the user's "
+    "permission (nothing to install: without the gu extension it opens gu's own Chrome window). "
+    "If the user says no, or it answers BROWSER NOT AVAILABLE, stop and tell the user.\n")
 
 
 # Background shells (task #360). Never `&` (refused) — background=True is the way to say it.
@@ -8098,7 +8295,8 @@ _HEREDOC_HINT = ("\n\nSHELL QUOTING broke this line. For text with quotes or lin
 _PIPE_FAIL_RE = re.compile(
     r"^.*(?:No module named \S+|ModuleNotFoundError: .*|: command not found|: not found$"
     r"|^Traceback \(most recent call last\):|^fatal: .*|^error: .*|^npm ERR! .*"
-    r"|^E: Unable to locate package .*|: No such file or directory$)",
+    r"|^E: Unable to locate package .*|: No such file or directory$"
+    r"|is not recognized as (?:the |a )?name of a cmdlet.*)",
     re.M)
 
 
@@ -8110,12 +8308,12 @@ def _pipe_hidden_failure(scan, out: str) -> str:
     return m.group(0).strip()[:200] if m else ""
 
 
-def _pipe_hidden_failure_note(line: str) -> str:
+def _pipe_hidden_failure_note(line: str, ps: bool = False) -> str:
     return ("\n\nWARNING — A FAILURE WAS HIDDEN BY A PIPE: the output shows "
             f"'{line}', but a pipeline reports only its LAST command's exit code, so this "
             "line counted as success and every part after `&&` RAN ANYWAY. Check what those "
-            "parts did before relying on them. To chain on a check, run it without a pipe, or "
-            "start the line with `set -o pipefail;`.")
+            "parts did before relying on them. To chain on a check, run it without a pipe"
+            + ("." if ps else ", or start the line with `set -o pipefail;`."))
 
 
 # THE PROJECT'S OWN TEST COMMANDS (#360 review). The model guessed `python3 -m pytest` in a repo
@@ -8218,7 +8416,18 @@ _SHELL_QUOTE_ERR_RE = re.compile(
     r"unexpected EOF while looking for matching|syntax error near unexpected token|"
     r"syntax error: unexpected end of file|unterminated quoted string")
 
+# PowerShell's words for a line it could not parse (#374), and the form that has nothing to quote.
+_PS_QUOTE_ERR_RE = re.compile(
+    r"string is missing the terminator|Missing closing|Unexpected token|missing the closing|"
+    r"ParserError|Missing (?:argument|expression)")
+_PS_HEREDOC_HINT = ("\n\nQUOTING broke this line. For text with quotes or line breaks (a commit "
+                    "message, an issue body) use a here-string inside a triple-quoted string: "
+                    "run_command(\"\"\"@'\n<message>\n'@ | git commit -F -\"\"\") — `'@` must start "
+                    "its line, and nothing in the message needs escaping.")
+
 _RUN_DOC_ARGV = ("No other shell syntax (no pipes/redirects/;). sudo/su are blocked.")
+_RUN_DOC_PS = ("It runs in PowerShell, so pipes, ;, &&, ||, redirects, cmdlets and here-strings "
+               "work too (e.g. 'npm test 2>&1 | Select-Object -Last 40'). Elevation is blocked.")
 _RUN_DOC_SHELL = ("It runs in bash, so pipes, redirects, ;, ||, $( ), globs and heredocs work too "
                   "(e.g. 'npm test 2>&1 | tail -40'). sudo/su are blocked.")
 
@@ -8725,6 +8934,8 @@ def _ws_request_approval(api_base, worker_key, job_id, command, reason, deadline
         _emit({"type": "step", "text": "Awaiting your choice: compact the context?"})
     elif command.startswith("__S3SETUP__::"):
         _emit({"type": "step", "text": "Awaiting your choice: set up S3, or save on this computer?"})
+    elif command.startswith("__BROWSER__::"):
+        _emit({"type": "step", "text": "Awaiting your approval: use a web browser"})
     elif command.startswith("__MCPTOOL__::"):
         _srv, _, _rest = command[len("__MCPTOOL__::"):].partition("\t")
         _emit({"type": "step", "text": f"Awaiting your approval: MCP tool {_srv}/{_rest.split(chr(9))[0]}"})
@@ -8942,6 +9153,90 @@ def _ws_pgroup_pids(pgid: int) -> list:
         return []
 
 
+# A SAVED PGID IS ONLY OURS WHILE ITS LEADER IS THE PROCESS WE STARTED (task #373, GitHub #154).
+# shells.json / servers.json outlive their commands. After a reboot, a crash or a closed terminal
+# the id is free, and the OS hands it to the next program — an Electron app such as VS Code is its
+# own group leader — so "a group with that id exists" said "running" and a stop SIGTERMed that
+# app. The record's own start time is the proof: a process whose pid == the pgid must have started
+# when the record says (± _WS_START_SLACK). The leader gone but members left is still ours: an id
+# is never reused while a process group of that id exists.
+_WS_START_SLACK = 5.0
+
+
+def _ws_proc_start(pid: int):
+    """When process `pid` started (epoch seconds), None when there is no such process, or "" when
+    it cannot be told (no ps). POSIX ps lstart: the same spelling on macOS and procps."""
+    import subprocess
+    import time as _t
+    try:
+        out = subprocess.run(["ps", "-o", "lstart=", "-p", str(int(pid))], stdout=subprocess.PIPE,
+                             stderr=subprocess.DEVNULL, text=True, timeout=5,
+                             env={**os.environ, "LC_ALL": "C", "LANG": "C"})
+    except Exception:  # noqa: BLE001
+        return ""
+    raw = " ".join(out.stdout.split())
+    if not raw:
+        return None
+    try:
+        return _t.mktime(_t.strptime(raw, "%a %b %d %H:%M:%S %Y"))
+    except ValueError:
+        return ""
+
+
+def _ws_record_started(rec: dict):
+    """The record's start time (epoch), from `started`, else the older `started_at` string."""
+    import time as _t
+    try:
+        if rec.get("started") is not None:
+            return float(rec["started"])
+    except (TypeError, ValueError):
+        pass
+    try:
+        return _t.mktime(_t.strptime(str(rec.get("started_at")), "%Y-%m-%d %H:%M:%S"))
+    except (ValueError, OverflowError):
+        return None
+
+
+def _ws_group_owner(rec: dict, proc_start=None) -> str:
+    """Whose is the group a shell/server record names now?
+      "ours"    — its leader is the process the record started;
+      "leader-gone" — no process has that id; any group members left are still ours;
+      "other"   — that id now belongs to a process started at another time: NOT ours;
+      "unknown" — nothing to compare (no start time recorded, or ps could not say).
+    Windows has no process groups; its records are taken as they are."""
+    if _IS_WINDOWS:
+        return "ours"
+    pgid = int(rec.get("pgid") or rec.get("pid") or 0)
+    if pgid <= 0:
+        return "unknown"
+    leader = (proc_start or _ws_proc_start)(pgid)
+    if leader is None:
+        return "leader-gone"
+    started = _ws_record_started(rec)
+    if leader == "" or started is None:
+        return "unknown"
+    return "ours" if abs(float(leader) - started) <= _WS_START_SLACK else "other"
+
+
+def _ws_record_pids(rec: dict) -> list:
+    """Live pids of a record's group — none when the id has passed to another program."""
+    if _ws_group_owner(rec) == "other":
+        return []
+    return _ws_pgroup_pids(int(rec.get("pgid") or rec.get("pid") or 0))
+
+
+def _ws_stop_record(rec: dict, force: bool = False) -> bool:
+    """Signal a record's group ONLY when it is provably ours. False = nothing was signalled."""
+    owner = _ws_group_owner(rec)
+    pgid = int(rec.get("pgid") or rec.get("pid") or 0)
+    if owner not in ("ours", "leader-gone") or pgid <= 0:
+        _log(f"not stopping pgid={pgid} ('{str(rec.get('command'))[:40]}'): {owner} — the id is no "
+             "longer the process gu started")
+        return False
+    _ws_kill_tree(pgid, force=force)
+    return True
+
+
 def _ws_parse_netstat_ports(stdout: str, pids: set) -> list:
     """LISTENING ports owned by `pids`, from `netstat -ano` output. Pure, so it is testable
     on a Mac against recorded Windows output — running netstat here is not."""
@@ -9054,7 +9349,7 @@ def _ws_load_servers(prune: bool = True) -> list:
     except Exception:  # noqa: BLE001
         return []
     if prune:
-        servers = [s for s in servers if _ws_pgroup_pids(int(s.get("pgid", 0)))]
+        servers = [s for s in servers if _ws_record_pids(s)]
     return servers
 
 
@@ -9080,10 +9375,8 @@ def _ws_cap_servers(max_live: int = 3) -> list:
     if len(servers) > max_live:
         for s in servers[:-max_live]:  # registry is append-ordered → oldest first
             try:
-                pgid = int(s.get("pgid", 0))
-                if pgid <= 0:
+                if not _ws_stop_record(s):
                     continue
-                _ws_kill_tree(pgid)
                 _log(f"server lifecycle: stopped old background server pid={s.get('pid')} "
                      f"ports={s.get('ports')} ('{str(s.get('command'))[:40]}')")
             except (OSError, ValueError) as e:  # already gone / no permission
@@ -9169,7 +9462,7 @@ def _shell_state(s: dict, alive=None, now=None) -> dict:
     started = float(s.get("started") or now)
     code, code_at = _shell_exit_code(s)
     if alive is None:
-        alive = code is None and bool(_ws_pgroup_pids(int(s.get("pgid") or 0)))
+        alive = code is None and bool(_ws_record_pids(s))
     if alive and code is None and not s.get("killed"):
         return {"state": "running", "code": None, "runtime": max(0.0, now - started), "ended": now}
     ended = float(s.get("ended") or code_at or now)
@@ -9333,10 +9626,10 @@ def _shell_kill(s: dict, by: str = "the agent (stop_server)") -> None:
     if _shell_state(s)["state"] != "running":
         return
     try:
-        _ws_kill_tree(int(s.get("pgid") or 0))
-        _t.sleep(1.0)
-        if _ws_pgroup_pids(int(s.get("pgid") or 0)):
-            _ws_kill_tree(int(s.get("pgid") or 0), force=True)
+        if _ws_stop_record(s):
+            _t.sleep(1.0)
+            if _ws_record_pids(s):
+                _ws_stop_record(s, force=True)
     except (OSError, ValueError):
         pass
     s["killed"] = True
@@ -9374,7 +9667,8 @@ def _shells_finished_note(shells: list, now=None) -> str:
         s["announced"] = True
         note = (f"[background shell {s.get('id')} finished: {_shell_status_text(st)} after "
                 f"{_fmt_runtime(st['runtime'])} — '{_clip(str(s.get('command')), 120)}'. "
-                f"shell_output('{s.get('id')}') has its output.]")
+                f"shell_output('{s.get('id')}') has its output. If it failed, find out why and fix it; "
+                f"if it was a step of this task, carry on with the next one.]")
         try:
             with open(s.get("log") or "", encoding="utf-8", errors="replace") as fh:
                 dg = _test_digest(fh.read(), str(s.get("workdir") or ""))
@@ -9448,7 +9742,7 @@ def _run_state_cwd() -> str:
     if not p:
         return ""
     try:
-        with open(p + ".cwd", encoding="utf-8") as fh:
+        with open(p + ".cwd", encoding="utf-8-sig") as fh:  # PowerShell 5.1 writes a BOM
             return fh.read().strip()
     except OSError:
         return ""
@@ -9488,7 +9782,9 @@ def _ws_scrubbed_env() -> dict:
         keep += ("SYSTEMROOT", "SystemDrive", "WINDIR", "COMSPEC", "PATHEXT", "USERPROFILE",
                  "HOMEDRIVE", "HOMEPATH", "USERNAME", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP",
                  "ProgramFiles", "ProgramFiles(x86)", "ProgramW6432", "ProgramData",
-                 "CommonProgramFiles", "NUMBER_OF_PROCESSORS", "PROCESSOR_ARCHITECTURE")
+                 "CommonProgramFiles", "NUMBER_OF_PROCESSORS", "PROCESSOR_ARCHITECTURE",
+                 # PowerShell finds its own modules (Microsoft.PowerShell.*) through it (#374).
+                 "PSModulePath")
     env = {k: os.environ[k] for k in keep if k in os.environ}
     # CI=1 makes watch-mode test runners (CRA's `npm test`, jest --watch) run ONCE and
     # exit instead of sitting in interactive watch mode until the timeout kills them.
@@ -10864,7 +11160,7 @@ def run_agent_chat(cfg):
         "and reads do not pile up here and are not re-sent on every later step. Then read only "
         "the exact ranges you will edit. Use grep_repo/read_file_lines directly when you already "
         "know the file or the exact string.\n"
-        + _run_command_prompt_line(bool(_run_shell_bin()))
+        + _run_command_prompt_line(bool(_run_shell_bin()), kind=_run_shell_kind())
         + (_BROWSER_LINE if _browser_on() else "") +
         "    DEPLOY: prefer deploy_web(local_dir, host, user, remote_path, domain) over "
         "hand-written scp/ssh/rsync (it rsyncs over your SSH key and finishes nginx when it "
@@ -14909,20 +15205,25 @@ def run_agent_chat(cfg):
                 # A REAL SHELL WHEN THE LINE NEEDS ONE (task #359). Scanned BEFORE shlex.split,
                 # which raises on a heredoc body with an apostrophe in it ("don't").
                 _shell_bin = _run_shell_bin()
-                _scan = _shell_scan(command) if _shell_bin else None
+                # PowerShell on Windows (#374): every line goes through it — a cmdlet is no program.
+                _ps = bool(_shell_bin) and _run_shell_kind() == "powershell"
+                _scan = (_ps_mod().ps_scan(command) if _ps else _shell_scan(command)) if _shell_bin else None
                 if _scan and _scan["error"]:
                     msg = (f"Error: that command did NOT run — {_scan['error']}. Nothing was "
                            "executed; fix the quoting and send it again."
-                           + (_HEREDOC_HINT if "quote" in str(_scan["error"]) else ""))
+                           + ((_PS_HEREDOC_HINT if _ps else _HEREDOC_HINT)
+                              if re.search(r"quote|here-string", str(_scan["error"])) else ""))
                     _last_obs["text"] = msg
                     return msg
                 # Once this turn has shell state (a cd, an activated venv), every line goes through
                 # the shell so it starts from that state — not only lines with shell syntax.
-                _words = [c["argv"][0] for c in _shell_commands(_scan["tokens"]) if c["argv"]] if _scan else []
+                _words = [c["argv"][0] for c in _shell_commands(_scan["tokens"]) if c["argv"]] \
+                    if (_scan and not _ps) else []
                 _builtin = sorted({w for w in _words if w in _SHELL_STATE_BUILTINS})
-                _use_shell = bool(_scan) and (_shell_needed(_scan) or bool(_builtin) or bool(
+                _use_shell = bool(_scan) and (_ps or _shell_needed(_scan) or bool(_builtin) or bool(
                     _RUN_STATE["path"] and os.path.exists(_RUN_STATE["path"])))
-                _bg_err = _shell_background_error(_scan) if _use_shell else None
+                _bg_err = ((_ps_background_error(_scan) if _ps else _shell_background_error(_scan))
+                           if _use_shell else None)
                 if _bg_err:
                     _last_obs["text"] = _bg_err
                     return _bg_err
@@ -14936,7 +15237,7 @@ def run_agent_chat(cfg):
                 # the first failure stops the rest. `cd DIR` sets the folder for what follows.
                 # A chain runs each part as a program; `export`/`source` in it would run nothing,
                 # so with a shell such a line goes to bash whole. (`cd` the chain does itself.)
-                _chain = None if (_use_shell and [b for b in _builtin if b != "cd"]) \
+                _chain = None if (_ps or (_use_shell and [b for b in _builtin if b != "cd"])) \
                     else _and_chain_parts(command)
                 if _chain:
                     _chain_start = _t.time()
@@ -15000,7 +15301,13 @@ def run_agent_chat(cfg):
                 # `/usr/bin/<x>` can't slip past a bare-name rule.
                 _runner = argv[0]
                 _rbase = os.path.basename(_runner)
-                if _use_shell:
+                if _use_shell and _ps:
+                    _refuse, _hard_reason, _ask_reason = _ws_ps_command_risk(
+                        _scan, _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
+                    if _refuse:
+                        _last_obs["text"] = _refuse
+                        return _refuse
+                elif _use_shell:
                     # Every simple command in the line, including those inside $( ), gets the
                     # checks an argv command gets — allowlist, privilege, denylist, deletes —
                     # plus the shell-only ones (redirect outside the project, `| sh`).
@@ -15038,7 +15345,8 @@ def run_agent_chat(cfg):
                 # states it. "this needs root and sudo needs a password we cannot type" is a
                 # different question from "sudo is passwordless here", and the user can only
                 # answer the one they are shown.
-                _priv = _shell_priv_reason(_scan) if _use_shell else _ws_priv_reason(command)
+                _priv = ((_ps_priv_reason(_scan) if _ps else _shell_priv_reason(_scan))
+                         if _use_shell else _ws_priv_reason(command))
                 _facts = _ws_access_facts() if _priv else None
                 if _priv and _facts and not _facts["can_elevate"]:
                     # REFUSE BEFORE SPAWNING (requirement 5). With no tty, `sudo x` dies with
@@ -15102,7 +15410,24 @@ def run_agent_chat(cfg):
                 exit_path = log_path[:-4] + ".exit"
                 # gu as a co-author on the commits it makes (task #289) — after every check
                 # above, which judged the command as the model wrote it.
-                if _use_shell:
+                if _use_shell and _ps:
+                    # PowerShell (#374): the line, sequenced (&& / || for 5.1, the exit status
+                    # kept), in a file the wrapper dot-sources — no quoting crosses a command
+                    # line — and the wrapper keeps the exit code, folder and $env: changes.
+                    _gp = _ps_mod()
+                    _cmd_text, _attrib_note = _with_attribution_text(
+                        command, dict(_scan, commands=_gp.ps_commands(_scan["tokens"])),
+                        _attribution_settings(wd))
+                    _ps_cmd = log_path[:-4] + ".cmd.ps1"
+                    _ps_wrap = log_path[:-4] + ".ps1"
+                    with open(_ps_cmd, "w", encoding="utf-8") as _fh:
+                        # Windows PowerShell 5.1 (powershell.exe) needs the 2>&1 care; pwsh 7 does not.
+                        _fh.write(_gp.ps_sequence(_cmd_text, legacy=os.path.basename(
+                            _shell_bin).lower().startswith("powershell")))
+                    with open(_ps_wrap, "w", encoding="utf-8-sig") as _fh:  # 5.1 reads a BOM-less file as ANSI
+                        _fh.write(_gp.ps_wrapper(_ps_cmd, exit_path, _run_state_path()))
+                    argv = _gp.ps_argv(_shell_bin, _ps_wrap)
+                elif _use_shell:
                     _cmd_text, _attrib_note = _with_attribution_text(
                         command, _scan, _attribution_settings(wd))
                     # The exit code is written to a file so it outlives this turn's process, and
@@ -15203,11 +15528,11 @@ def run_agent_chat(cfg):
                         # triple-quoted string has no quoting to get wrong.
                         _hidden = _pipe_hidden_failure(_scan, out) if (rc == 0 and _use_shell) else ""
                         if _hidden:
-                            result += _pipe_hidden_failure_note(_hidden)
+                            result += _pipe_hidden_failure_note(_hidden, ps=_ps)
                             _emit({"type": "step", "text":
                                    f"Command failed behind a pipe → {_trim_words(_hidden)}"})
-                        if rc != 0 and _use_shell and _SHELL_QUOTE_ERR_RE.search(out or ""):
-                            result += _HEREDOC_HINT
+                        if rc != 0 and _use_shell and (_PS_QUOTE_ERR_RE if _ps else _SHELL_QUOTE_ERR_RE).search(out or ""):
+                            result += _PS_HEREDOC_HINT if _ps else _HEREDOC_HINT
                         # Say where the shell now is, so a next `cd sub` is not done twice (#362).
                         _now = _run_state_cwd() if _use_shell else ""
                         if _now and os.path.realpath(_now) != os.path.realpath(wd):
@@ -15302,7 +15627,8 @@ def run_agent_chat(cfg):
         # bash here (Git Bash on Windows), argv when there is none (#359). Set before tool() reads
         # the docstring.
         if _run_shell_bin():
-            run_command.__doc__ = run_command.__doc__.replace(_RUN_DOC_ARGV, _RUN_DOC_SHELL)
+            run_command.__doc__ = run_command.__doc__.replace(
+                _RUN_DOC_ARGV, _RUN_DOC_PS if _run_shell_kind() == "powershell" else _RUN_DOC_SHELL)
         run_command = tool(run_command)
 
         @tool
@@ -15357,12 +15683,11 @@ def run_agent_chat(cfg):
                         return msg
                 else:
                     target = servers[-1]
-                pgid = int(target["pgid"])
                 try:
-                    _ws_kill_tree(pgid)
-                    _t.sleep(1.5)
-                    if _ws_pgroup_pids(pgid):
-                        _ws_kill_tree(pgid, force=True)
+                    if _ws_stop_record(target):
+                        _t.sleep(1.5)
+                        if _ws_record_pids(target):
+                            _ws_stop_record(target, force=True)
                 except OSError:
                     pass
                 _ws_save_servers([s for s in servers if s is not target])
@@ -15578,12 +15903,40 @@ def run_agent_chat(cfg):
                 _last_obs["text"] = msg
                 return msg
 
+        # ASK FIRST (#150), the way Claude Code does: the first browser call of a turn asks the user
+        # (Allow once / Always in this folder / No), unless this folder is on the "always" list in
+        # ~/.gonext/browser-allow.json. A "No" holds for the rest of the turn.
+        _browser_consent = {"ok": False, "no": False, "where": ""}
+
+        def _browser_ask(what: str):
+            """→ "" when the browser may be used, else the message for the model."""
+            import gu_browser as _gb
+            if _browser_consent["ok"]:
+                return ""
+            if _browser_consent["no"]:
+                return ("The user did not allow the browser in this turn. Do not call browser again; "
+                        "carry on without it, or ask the user.")
+            folder = _WS_ACTIVE or _default_ws_root()
+            if _gb.allowed_in(folder):
+                _browser_consent["ok"] = True
+                return ""
+            if not (_interactive_approval and _job_id and worker_api_base and worker_api_key):
+                return ("The browser needs the user's permission and this session cannot ask. Tell the "
+                        "user to allow it (/browser allow in the gu terminal), then carry on without it.")
+            if _ws_request_approval(worker_api_base, worker_api_key, _job_id,
+                                    f"__BROWSER__::{folder}\t{what}", "", deadline_s=180):
+                _browser_consent["ok"] = True
+                return ""
+            _browser_consent["no"] = True
+            return ("The user did not allow the browser. Do not call browser again this turn; carry on "
+                    "without it, or ask the user.")
+
         @tool
         def browser(action: str, url: str = "", ref: int = 0, x: int = -1, y: int = -1,
                     text: str = "", clear: bool = False, submit: bool = False,
-                    direction: str = "", amount: int = 0, seconds: int = 0, tab: int = 0,
+                    direction: str = "", amount: int = 0, seconds: int = 0, tab: str = "",
                     new_tab: bool = False) -> str:
-            """Use a REAL Chrome browser (through the gu Chrome extension) like a person does — open a page, see it, click with the mouse, type with the keyboard — to test a UI flow, check a page renders, fill a form or click through an app. Loop: open → read (or screenshot) → click / type → read again to check what happened. Only gu's own tabs are used. If the answer starts BROWSER NOT AVAILABLE, stop and ask the user to install the extension (the answer has the steps).
+            """Use a REAL Chrome browser like a person does — open a page, see it, click with the mouse, type with the keyboard — to test a UI flow, check a page renders, fill a form or click through an app. The first call asks the user's permission. It uses the user's Chrome through the gu extension when that is installed, otherwise gu's own Chrome window (a separate profile: not logged in to the user's accounts). Loop: open → read (or screenshot) → click / type → read again to check what happened. Only gu's own tabs, and tabs the user shared, are used. If the answer starts BROWSER NOT AVAILABLE, stop and tell the user (the answer says what to do).
 
             Args:
                 action: one of: open (url) · read (page text + visible interactive elements numbered [n] with x,y) · screenshot (an image of the page; pixels = click x,y) · click / double_click / right_click / hover (ref, or x and y) · type (text into the focused field; with ref it clicks that field first) · key (text: "Enter", "Tab", "Escape", "ctrl+a", "shift+Tab"… several separated by spaces) · scroll (direction, amount) · back · reload · wait (seconds) · js (text = a JavaScript expression run in the page; returns its value) · console (the page's console messages since the last call) · tabs · switch (tab) · close
@@ -15597,7 +15950,7 @@ def run_agent_chat(cfg):
                 direction: scroll only — down (default), up, left or right
                 amount: scroll only — pixels (default most of a screen)
                 seconds: wait only — 1 to 30
-                tab: switch only — a tab id from tabs
+                tab: switch only — a tab id from tabs (a number, or an id like "8F3A…" in gu's own window)
                 new_tab: open only — open in a new tab instead of the current gu tab
             """
             import gu_browser as _gb
@@ -15627,7 +15980,7 @@ def run_agent_chat(cfg):
                 if seconds:
                     cmd["seconds"] = int(seconds)
                 if tab:
-                    cmd["tab"] = int(tab)
+                    cmd["tab"] = int(tab) if str(tab).strip().isdigit() else str(tab).strip()
                 shot_ok = a == "screenshot" and (
                     _is_anthropic_url(coding_base_url) or _coder_takes_images(coding_base_url, coding_model_id))
                 if a == "screenshot" and not shot_ok:
@@ -15635,11 +15988,20 @@ def run_agent_chat(cfg):
                 what = cmd.get("url") or (f"[{ref}]" if ref else f"{int(x)},{int(y)}" if "x" in cmd else
                                           _clip(str(text), 50) if text else "")
                 _emit({"type": "step", "text": f"Browser {a}" + (f" → {what}" if what else "")})
+                refused = _browser_ask(f"{a} {what}".strip())
+                if refused:
+                    _last_obs["text"] = refused
+                    return refused
                 ok, res, not_connected = _gb.command(
-                    cmd, log=_log,
-                    on_wait=lambda: _emit({"type": "step", "text": "Waiting for the gu Chrome extension to connect…"}))
+                    cmd, log=_log, own=True,
+                    on_wait=lambda: _emit({"type": "step", "text": "Waiting for Chrome to connect…"}))
+                where = res.pop("_backend", "") if ok and isinstance(res, dict) else ""
+                if where and where != _browser_consent["where"]:
+                    _browser_consent["where"] = where
+                    _emit({"type": "step", "text": "Using gu's own Chrome window" if where == "chrome"
+                           else "Using your Chrome (gu extension)"})
                 if not_connected:
-                    _emit({"type": "step", "text": "⚠ The gu Chrome extension is not connected — /browser shows how to install it"})
+                    _emit({"type": "step", "text": "⚠ No browser gu can use — /browser shows why"})
                     msg = _gb.install_text(str(res))
                 elif not ok:
                     msg = f"Error: browser {a} failed: {res}"
@@ -15652,6 +16014,9 @@ def run_agent_chat(cfg):
                            + _gb.format_result("read", res))
                 else:
                     msg = _gb.format_result(a, res)
+                if ok and where == "chrome" and a == "open":
+                    msg = ("(gu's own Chrome window — a separate profile, not signed in to the user's "
+                           "accounts.)\n" + msg)
             except Exception as ex:  # noqa: BLE001
                 msg = f"Error: browser {a} failed: {type(ex).__name__}: {ex}"
             _last_obs["text"] = msg