@tiens.nguyen/gu-cli 1.0.835 → 1.0.837

package/browser-extension/actions.js

@@ -10,6 +10,9 @@
 //   host.tabs() → [{id, title, url, current}]        host.switchTo(tabId) → boolean
 //   host.info(tabId) → {url, title, status} | null   host.activate(tabId)
 //   host.close(tabId)
+//   host.runsJs — true only where running gu's own JavaScript text is allowed (gu's own window).
+//   The Chrome Web Store extension leaves it unset: text sent at run time and executed is
+//   "remote code", which a Manifest V3 store extension may not run (#377, GitHub #158).
 // No chrome.* and no Node API in here: it runs in an extension service worker and in Node.
 
 const consoleBuf = new Map(); // tabId → [{level, text}] since the last "console" read
@@ -305,6 +308,11 @@ export async function runAction(cmd, host) {
       await sleep(Math.max(0, Math.min(Number(cmd.seconds) || 1, 30)) * 1000);
       return after(host, id);
     case "js": {
+      if (!host.runsJs) {
+        throw new Error("js is not available through the gu Chrome extension (Chrome Web Store rules: " +
+          "it runs only the code it ships with). Use read, console, click and type instead — or gu's own " +
+          "Chrome window, which has it.");
+      }
       const value = await evaluate(host, id, String(cmd.text || ""));
       return after(host, id, { value: value === undefined ? "undefined" : JSON.stringify(value)?.slice(0, 8000) });
     }

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "gu browser",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "Lets the gu coding agent open, see and operate web pages in its own tabs (tab group \"gu\") with a real mouse and keyboard.",
   "minimum_chrome_version": "116",
   "icons": {
@@ -17,9 +17,6 @@
     "alarms",
     "storage"
   ],
-  "host_permissions": [
-    "<all_urls>"
-  ],
   "background": {
     "service_worker": "background.js",
     "type": "module"

package/gonext_agent_chat.py

@@ -7933,6 +7933,123 @@ def _ws_shell_command_risk(scan, denyset, wd="", allowset=None, roots=None):
     return (None, None, None)
 
 
+# ---- POWERSHELL LINES (task #374, GitHub #155) ---------------------------------------------------
+# The same policy as a bash line, read with gu_powershell: every simple command — inside $( ),
+# @( ), ( ) and { } too, since a ForEach-Object block runs — through the allow/deny lists,
+# elevation, deletes and writes outside the project (cmdlets' -Path/-Destination as well as
+# redirects), plus PowerShell's own ways to run text as code: Invoke-Expression, piping into an
+# interpreter (unless what is piped is a string the line itself wrote — PowerShell's heredoc),
+# [ScriptBlock]::Create and -EncodedCommand.
+
+def _ps_mod():
+    import gu_powershell as _gp
+    return _gp
+
+
+def _ps_background_error(scan):
+    """A line ending a command with `&` (a PowerShell job, gone when the shell exits), or None."""
+    gp = _ps_mod()
+    top, _ = gp.ps_all_commands(scan)
+    if any(c["background"] for c in top):
+        return ("Error: that command did NOT run. Do not end it with `&` — in PowerShell that "
+                "starts a job that dies with the shell. run_command already leaves a server or app "
+                "RUNNING when it starts listening or opens a window; for a long job pass "
+                "background=True. Send the same command without the `&`.")
+    return None
+
+
+def _ps_priv_reason(scan):
+    """Elevation in any command of a PowerShell line (runas, -Verb RunAs, sudo, ACL/service/
+    registry rewrites) — judged with the Windows rules whatever OS reads it."""
+    gp = _ps_mod()
+    top, inner = gp.ps_all_commands(scan)
+    for c in top + inner:
+        r = _ws_priv_reason(" ".join(c["argv"]), windows=True)
+        if r:
+            return r
+    return None
+
+
+def _ps_native_paths(paths, wd):
+    """PowerShell paths as the OS reads them: $env:X / $HOME / ~ filled in. A path that only
+    exists at run time ($_, $x) becomes an impossible one, so it is never judged "inside"."""
+    gp = _ps_mod()
+    out = []
+    for p in paths:
+        q = gp.ps_expand_path(p, os.environ, os.path.expanduser("~"), wd or os.getcwd())
+        out.append(q if q is not None else os.path.join(os.sep, "gu-unknown-at-run-time", p))
+    return out
+
+
+def _ws_ps_command_risk(scan, denyset, wd="", allowset=None, roots=None):
+    """_ws_shell_command_risk for a PowerShell line. Same contract: (refuse, hard, ask)."""
+    gp = _ps_mod()
+    top, inner = gp.ps_all_commands(scan)
+    every = top + inner
+    effects = [(c, gp.ps_effects(c)) for c in every]
+
+    def names(c, e):
+        raw = re.split(r"[\\/]", c["argv"][0])[-1].lower() if c["argv"] else ""
+        return {n for n in (raw, e["program"], c["argv"][0] if c["argv"] else "") if n}
+
+    if allowset:
+        low = {a.lower() for a in allowset}
+        for c, e in effects:
+            if e["program"] and not (names(c, e) & (set(allowset) | low)):
+                return (f"Error: '{c['argv'][0]}' is not in your run allowlist. Add it in web "
+                        "Settings → Agent, or clear the allowlist to allow all commands.", None, None)
+    priv = _ps_priv_reason(scan)
+    if priv:
+        return (None, priv, priv)
+    if denyset:
+        low = {d.lower() for d in denyset}
+        for c, e in effects:
+            if e["program"] and names(c, e) & (set(denyset) | low):
+                msg = f"'{c['argv'][0]}' is on your blocked-commands list"
+                return (None, msg, msg)
+    # Deletes and writes outside the project, following Set-Location the way PowerShell will.
+    cur = wd
+    for c, e in effects:
+        is_top = any(c is t for t in top)
+        if is_top and e["program"] in ("set-location", "push-location") and c["sep"] != "|":
+            _, pos, _ = gp.ps_bound(c["argv"])
+            if pos:
+                p = _ps_native_paths(pos[:1], cur)[0]
+                cur = os.path.normpath(os.path.join(cur or os.getcwd(), p))
+            continue
+        here = cur if is_top else wd
+        why = None
+        if e["deletes"]:
+            why = _ws_delete_outside_reason(["rm"] + _ps_native_paths(e["deletes"], here), here, roots)
+        if not why and e["writes"]:
+            why = _ws_write_outside_reason([(">", t) for t in _ps_native_paths(e["writes"], here)],
+                                           here, roots)
+        if why:
+            return (None, why, why)
+    # Text run as code.
+    for k, c in enumerate(top):
+        e = gp.ps_effects(c)
+        if c["sep"] == "|" and e["program"] in gp.PS_INTERPRETERS \
+                and all(x.startswith("-") for x in c["argv"][1:]):
+            # Upstream of this stage, back to the pipeline's start: only a literal string = the
+            # code is in the line itself (a heredoc). Anything else feeds it unseen text.
+            j = k
+            while j > 0 and top[j]["sep"] == "|":
+                j -= 1
+            if not all(gp.ps_is_literal(x) for x in top[j:k]):
+                msg = f"it pipes text into {c['argv'][0]}, which runs that text as code"
+                return (None, msg, msg)
+    for c, e in effects:
+        if e["runs_text"]:
+            return (None, None, f"it runs text as code ({e['runs_text']})")
+        if e["dynamic"]:
+            return (None, None, f"the program to run is only known at run time ({c['argv'][0][:40]})")
+    for c, e in effects:
+        if e["destructive"] or _WS_DESTRUCTIVE_RE.search(" ".join(c["argv"])):
+            return (None, None, "a destructive command (deletes files / wipes disk / powers off)")
+    return (None, None, None)
+
+
 def _with_attribution_text(command, scan, settings):
     """_with_attribution for a SHELL line: the co-author trailer is inserted into the text right
     after each top-level `git … commit` word. → (command, note). A gh pr create body written as a
@@ -7940,7 +8057,7 @@ def _with_attribution_text(command, scan, settings):
     import shlex as _shlex
     name = str(settings.get("name") or "").strip()
     email = str(settings.get("email") or "").strip()
-    cmds = _shell_commands(scan["tokens"])
+    cmds = scan["commands"] if "commands" in scan else _shell_commands(scan["tokens"])
     notes = []
     if settings.get("commit") and name and email and email.lower() not in command.lower():
         at = []
@@ -7990,30 +8107,79 @@ def _git_bash_path(env=None, which=None, isfile=None):
     return ""
 
 
+_RUN_SHELL_KIND = None
+
+
+def _pwsh_path(env=None, which=None, isfile=None):
+    """PowerShell for run_command, or "". PURE given its lookups (tested off Windows).
+
+    GU_PWSH_PATH first; then PowerShell 7 (`pwsh`), which has && and || of its own; then Windows
+    PowerShell 5.1, which every Windows 10/11 has — gu supplies && and || there itself."""
+    import ntpath
+    import shutil as _sh
+    env = os.environ if env is None else env
+    which = which or _sh.which
+    isfile = isfile or os.path.isfile
+    if env.get("GU_PWSH_PATH") and isfile(env["GU_PWSH_PATH"]):
+        return env["GU_PWSH_PATH"]
+    for name in ("pwsh", "powershell"):
+        p = which(name) or ""
+        if p and "\\windowsapps\\" not in p.lower():  # never a Store alias stub
+            return p
+    root = env.get("SystemRoot") or env.get("SYSTEMROOT") or env.get("WINDIR") or ""
+    if root:
+        p = ntpath.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+        if isfile(p):
+            return p
+    return ""
+
+
+def _run_shell_kind():
+    """"bash" | "powershell" | "" — how run_command runs a line (see _run_shell_bin)."""
+    _run_shell_bin()
+    return _RUN_SHELL_KIND or ""
+
+
 def _run_shell_bin():
-    """The shell for run_command's shell lines: bash (else sh), Git Bash on Windows — or "" for
-    the argv-only path (Windows without Git for Windows, or GU_RUN_NO_SHELL=1, the way back if a
-    shell line ever misbehaves for a user)."""
-    global _RUN_SHELL_BIN
+    """The shell for run_command (task #359; PowerShell #374): bash (else sh) on macOS/Linux;
+    on Windows PowerShell, the way Claude Code does it there — Git Bash instead with
+    GU_WINDOWS_SHELL=bash. "" = the argv-only path (GU_RUN_NO_SHELL=1, the way back if a shell
+    line ever misbehaves for a user, or no shell found). GU_RUN_SHELL=powershell|bash picks one
+    on any OS (how the PowerShell path is tested on a Mac)."""
+    global _RUN_SHELL_BIN, _RUN_SHELL_KIND
     if os.environ.get("GU_RUN_NO_SHELL") == "1":
         return ""
     if _RUN_SHELL_BIN is None:
-        if os.name == "nt":
-            _RUN_SHELL_BIN = _git_bash_path()
-            _log("run_command shell: " + ("Git Bash" if _RUN_SHELL_BIN else
-                 "none (Git for Windows not found) — commands run without a shell"))
+        import shutil as _sh
+        want = (os.environ.get("GU_RUN_SHELL") or "").strip().lower()
+        if not want:
+            want = ("bash" if (os.environ.get("GU_WINDOWS_SHELL") or "").strip().lower() == "bash"
+                    else "powershell") if os.name == "nt" else "bash"
+        if want == "powershell":
+            _RUN_SHELL_BIN, _RUN_SHELL_KIND = _pwsh_path(), "powershell"
+            if not _RUN_SHELL_BIN and os.name == "nt":
+                _RUN_SHELL_BIN, _RUN_SHELL_KIND = _git_bash_path(), "bash"
+        elif os.name == "nt":
+            _RUN_SHELL_BIN, _RUN_SHELL_KIND = _git_bash_path(), "bash"
+            if not _RUN_SHELL_BIN:
+                _RUN_SHELL_BIN, _RUN_SHELL_KIND = _pwsh_path(), "powershell"
         else:
-            import shutil as _sh
-            _RUN_SHELL_BIN = next((p for p in (_sh.which("bash"), "/bin/bash", "/bin/sh")
-                                   if p and os.path.exists(p)), "")
+            _RUN_SHELL_BIN, _RUN_SHELL_KIND = next(
+                (p for p in (_sh.which("bash"), "/bin/bash", "/bin/sh") if p and os.path.exists(p)), ""), "bash"
+        if not _RUN_SHELL_BIN:
+            _RUN_SHELL_KIND = ""
+        _log("run_command shell: " + ({"powershell": "PowerShell", "bash": "bash"}.get(_RUN_SHELL_KIND, "none")
+             + (f" ({_RUN_SHELL_BIN})" if _RUN_SHELL_BIN else " — commands run without a shell")))
     return _RUN_SHELL_BIN
 
 
-def _run_command_prompt_line(shell, windows=None):
+def _run_command_prompt_line(shell, windows=None, kind=None):
     """The system prompt's run_command rule. With a shell it carries the git and GitHub recipes,
     the way Claude Code's Bash tool description does: told how to batch, the model does (#359).
-    On Windows the shell is Git Bash, and the line says what differs there."""
+    On Windows the shell is PowerShell (#374) — or Git Bash, and the line says what differs there."""
     windows = (os.name == "nt") if windows is None else windows
+    if shell and kind == "powershell":
+        return _PS_PROMPT_LINE + _BG_LINE
     if not shell:
         return (
             "    run_command CHAINS: put dependent commands in ONE call with && — e.g. "
@@ -8052,6 +8218,37 @@ def _run_command_prompt_line(shell, windows=None):
         "RUNNING — stop_server closes it. " + _BG_LINE)
 
 
+# The run_command rule when the shell is PowerShell (#374) — Claude Code's PowerShell tool, in gu's
+# words: the same recipes as the bash line, written the PowerShell way.
+_PS_PROMPT_LINE = (
+    "    run_command IS POWERSHELL (Windows), and it KEEPS its folder and $env: variables from one "
+    "call to the next in this turn (`cd sub`, then `npm test` runs in sub; an explicit workdir "
+    "wins). Write PowerShell, not bash: pipes `|`, `;`, `&&`, `||`, redirects (`> out.txt`, "
+    "`2>&1`), `$env:NAME = 'x'` (not export), cmdlets (Get-ChildItem, Select-String, "
+    "Get-Content -Tail 40, Remove-Item -Recurse), `$LASTEXITCODE`. Put a whole sequence in ONE call "
+    "(e.g. `cd app && npm test 2>&1 | Select-Object -Last 40`); a multi-line command goes in a "
+    "triple-quoted string. A program path with spaces needs the call operator: "
+    "`& 'C:\\Program Files\\x\\x.exe' args`. Python is `py -3` or `python`, not python3.\n"
+    "    MULTI-LINE TEXT is a here-string: `@'` ends its line, the text follows, and `'@` STARTS "
+    "the closing line; nothing inside needs escaping.\n"
+    "    GIT in one call each: look (`git status -sb; git diff --stat; git log --oneline -5`), "
+    "commit (`git add a.py b.py; if ($?) { git commit -m \"msg\" }` or with a here-string: "
+    "`@'` newline message newline `'@ | git commit -F -`).\n"
+    "    GITHUB: use `gh`. A multi-line body goes as a here-string on stdin — `@'` … `'@ | gh issue "
+    "comment 12 --body-file -` (same for gh issue create / gh pr create) — never write a body file "
+    "first, and do not run `gh auth status` first.\n"
+    "    CHECKS: a Python/Node script goes as a here-string piped in — `@'` … `'@ | py -3 -` (node: "
+    "`| node --input-type=module -`). To check one function, load its module and call it with real "
+    "input instead of running the app. Order: syntax check → the ONE test → the suite once. Test "
+    "output arrives with a TEST SUMMARY of each failure first, so never pipe it into "
+    "Select-Object/Select-String (a pipe hides the exit code).\n"
+    "    Read and search FILES with read_file_lines / grep_repo, not Get-Content/Select-String. "
+    "Elevation (Start-Process -Verb RunAs, runas, sudo) is blocked; Invoke-Expression, piping "
+    "into an interpreter, and writing or deleting outside the project ask the user first; never "
+    "end a line with `&` (a background job). An interactive prompt (Read-Host) fails. A server "
+    "or GUI app is left RUNNING — stop_server closes it. ")
+
+
 # THE BROWSER (task #363, GitHub #144): a real Chrome the agent drives through the gu extension.
 # Offered only where commands may run (the terminal's own folders, never the web app's scratch one)
 # and node can start the bridge. GU_BROWSER=0 turns it off.
@@ -8098,7 +8295,8 @@ _HEREDOC_HINT = ("\n\nSHELL QUOTING broke this line. For text with quotes or lin
 _PIPE_FAIL_RE = re.compile(
     r"^.*(?:No module named \S+|ModuleNotFoundError: .*|: command not found|: not found$"
     r"|^Traceback \(most recent call last\):|^fatal: .*|^error: .*|^npm ERR! .*"
-    r"|^E: Unable to locate package .*|: No such file or directory$)",
+    r"|^E: Unable to locate package .*|: No such file or directory$"
+    r"|is not recognized as (?:the |a )?name of a cmdlet.*)",
     re.M)
 
 
@@ -8110,12 +8308,12 @@ def _pipe_hidden_failure(scan, out: str) -> str:
     return m.group(0).strip()[:200] if m else ""
 
 
-def _pipe_hidden_failure_note(line: str) -> str:
+def _pipe_hidden_failure_note(line: str, ps: bool = False) -> str:
     return ("\n\nWARNING — A FAILURE WAS HIDDEN BY A PIPE: the output shows "
             f"'{line}', but a pipeline reports only its LAST command's exit code, so this "
             "line counted as success and every part after `&&` RAN ANYWAY. Check what those "
-            "parts did before relying on them. To chain on a check, run it without a pipe, or "
-            "start the line with `set -o pipefail;`.")
+            "parts did before relying on them. To chain on a check, run it without a pipe"
+            + ("." if ps else ", or start the line with `set -o pipefail;`."))
 
 
 # THE PROJECT'S OWN TEST COMMANDS (#360 review). The model guessed `python3 -m pytest` in a repo
@@ -8218,7 +8416,18 @@ _SHELL_QUOTE_ERR_RE = re.compile(
     r"unexpected EOF while looking for matching|syntax error near unexpected token|"
     r"syntax error: unexpected end of file|unterminated quoted string")
 
+# PowerShell's words for a line it could not parse (#374), and the form that has nothing to quote.
+_PS_QUOTE_ERR_RE = re.compile(
+    r"string is missing the terminator|Missing closing|Unexpected token|missing the closing|"
+    r"ParserError|Missing (?:argument|expression)")
+_PS_HEREDOC_HINT = ("\n\nQUOTING broke this line. For text with quotes or line breaks (a commit "
+                    "message, an issue body) use a here-string inside a triple-quoted string: "
+                    "run_command(\"\"\"@'\n<message>\n'@ | git commit -F -\"\"\") — `'@` must start "
+                    "its line, and nothing in the message needs escaping.")
+
 _RUN_DOC_ARGV = ("No other shell syntax (no pipes/redirects/;). sudo/su are blocked.")
+_RUN_DOC_PS = ("It runs in PowerShell, so pipes, ;, &&, ||, redirects, cmdlets and here-strings "
+               "work too (e.g. 'npm test 2>&1 | Select-Object -Last 40'). Elevation is blocked.")
 _RUN_DOC_SHELL = ("It runs in bash, so pipes, redirects, ;, ||, $( ), globs and heredocs work too "
                   "(e.g. 'npm test 2>&1 | tail -40'). sudo/su are blocked.")
 
@@ -9458,7 +9667,8 @@ def _shells_finished_note(shells: list, now=None) -> str:
         s["announced"] = True
         note = (f"[background shell {s.get('id')} finished: {_shell_status_text(st)} after "
                 f"{_fmt_runtime(st['runtime'])} — '{_clip(str(s.get('command')), 120)}'. "
-                f"shell_output('{s.get('id')}') has its output.]")
+                f"shell_output('{s.get('id')}') has its output. If it failed, find out why and fix it; "
+                f"if it was a step of this task, carry on with the next one.]")
         try:
             with open(s.get("log") or "", encoding="utf-8", errors="replace") as fh:
                 dg = _test_digest(fh.read(), str(s.get("workdir") or ""))
@@ -9526,13 +9736,69 @@ def _run_state_path() -> str:
     return _RUN_STATE["path"]
 
 
+_CD_FIRST_RE = re.compile(
+    r"""^\s*(?:cd|pushd|set-location|sl|chdir)\s+(?:-(?:literalpath|path)\s+)?(['"]?)([^'";&|\s]+)\1(?=\s*(?:$|&&|;|\|\||\n))""",
+    re.IGNORECASE)
+
+
+def _cd_from_root(command: str, kept: str, root: str) -> str:
+    """The folder a line should start in: `kept` (where the last shell line ended), unless the line
+    begins by entering a RELATIVE folder that does not exist there but does at `root` — then
+    `root`. PURE but for isdir. Anything else (absolute, ~, $VAR, `..`, already there) → `kept`."""
+    if not kept or not root or os.path.realpath(kept) == os.path.realpath(root):
+        return kept
+    m = _CD_FIRST_RE.match(command or "")
+    if not m:
+        return kept
+    target = m.group(2)
+    if os.path.isabs(target) or target.startswith(("~", "$", ".")) or re.match(r"^[A-Za-z]:", target):
+        return kept
+    if os.path.isdir(os.path.join(kept, target)) or not os.path.isdir(os.path.join(root, target)):
+        return kept
+    return root
+
+
+def _patch_dotted_imports() -> bool:
+    """`import urllib.request` in the agent's sandbox binds the name `urllib` (#378, GitHub #162).
+
+    smolagents 1.26's evaluate_import stores `import a.b` under the literal key "a.b" and never binds
+    `a`, so `urllib.request.urlopen(…)` — urllib.request is an allowed import here — fails with
+    "module 'urllib.error' has no attribute 'request'". Measured: three identical failing steps in
+    one deploy turn before the model gave up and used curl. Python binds the TOP package for a
+    dotted import; this does the same, and only when that top package is itself an allowed import
+    (so `import os.path` stays refused). Idempotent. False when smolagents is not there."""
+    try:
+        import ast as _ast
+        from importlib import import_module as _imp
+        from smolagents import local_python_executor as _lpe
+    except Exception:  # noqa: BLE001
+        return False
+    if getattr(_lpe.evaluate_import, "_gu_dotted", False):
+        return True
+    orig = _lpe.evaluate_import
+
+    def evaluate_import(expression, state, authorized_imports):
+        r = orig(expression, state, authorized_imports)
+        if isinstance(expression, _ast.Import):
+            for alias in expression.names:
+                if not alias.asname and "." in alias.name:
+                    top = alias.name.split(".")[0]
+                    if _lpe.check_import_authorized(top, authorized_imports):
+                        state[top] = _lpe.get_safe_module(_imp(top), authorized_imports)
+        return r
+
+    evaluate_import._gu_dotted = True
+    _lpe.evaluate_import = evaluate_import
+    return True
+
+
 def _run_state_cwd() -> str:
     """The folder the last shell line ended in, this turn — or ""."""
     p = _RUN_STATE["path"]
     if not p:
         return ""
     try:
-        with open(p + ".cwd", encoding="utf-8") as fh:
+        with open(p + ".cwd", encoding="utf-8-sig") as fh:  # PowerShell 5.1 writes a BOM
             return fh.read().strip()
     except OSError:
         return ""
@@ -9572,7 +9838,9 @@ def _ws_scrubbed_env() -> dict:
         keep += ("SYSTEMROOT", "SystemDrive", "WINDIR", "COMSPEC", "PATHEXT", "USERPROFILE",
                  "HOMEDRIVE", "HOMEPATH", "USERNAME", "APPDATA", "LOCALAPPDATA", "TEMP", "TMP",
                  "ProgramFiles", "ProgramFiles(x86)", "ProgramW6432", "ProgramData",
-                 "CommonProgramFiles", "NUMBER_OF_PROCESSORS", "PROCESSOR_ARCHITECTURE")
+                 "CommonProgramFiles", "NUMBER_OF_PROCESSORS", "PROCESSOR_ARCHITECTURE",
+                 # PowerShell finds its own modules (Microsoft.PowerShell.*) through it (#374).
+                 "PSModulePath")
     env = {k: os.environ[k] for k in keep if k in os.environ}
     # CI=1 makes watch-mode test runners (CRA's `npm test`, jest --watch) run ONCE and
     # exit instead of sitting in interactive watch mode until the timeout kills them.
@@ -9857,6 +10125,7 @@ def run_agent_chat(cfg):
                        f"then: gu stop && gu start"})
         _log(f"smolagents import FAILED on {_where}: {e}")
         return
+    _patch_dotted_imports()
 
     messages = cfg.get("messages") or []
     _turn_image_refs = _take_image_markers(messages)
@@ -10948,7 +11217,7 @@ def run_agent_chat(cfg):
         "and reads do not pile up here and are not re-sent on every later step. Then read only "
         "the exact ranges you will edit. Use grep_repo/read_file_lines directly when you already "
         "know the file or the exact string.\n"
-        + _run_command_prompt_line(bool(_run_shell_bin()))
+        + _run_command_prompt_line(bool(_run_shell_bin()), kind=_run_shell_kind())
         + (_BROWSER_LINE if _browser_on() else "") +
         "    DEPLOY: prefer deploy_web(local_dir, host, user, remote_path, domain) over "
         "hand-written scp/ssh/rsync (it rsyncs over your SSH key and finishes nginx when it "
@@ -14977,6 +15246,12 @@ def run_agent_chat(cfg):
                             wd = _rag_read_allowed(_kept)
                         except Exception:  # noqa: BLE001 — left the allowed folders: start over
                             wd = _wd_before
+                    # `cd sub` AGAIN FROM INSIDE sub (#378, GitHub #161), measured: after
+                    # `cd frontend && npx tsc` the shell stayed in frontend, the next line was
+                    # `cd frontend && node test…` → "no such folder: frontend", then two text-only
+                    # steps before the tests ran — 4 steps for one test run. A line that starts by
+                    # entering a folder that is not here but IS at the project root means the root.
+                    wd = _cd_from_root(command, wd, _wd_before)
                 w = _ws_for_path(wd)
                 if w is None or not w.get("allowRun"):
                     # Contextual nudge (task #102): the #1 reason the model shells out here is
@@ -14993,20 +15268,25 @@ def run_agent_chat(cfg):
                 # A REAL SHELL WHEN THE LINE NEEDS ONE (task #359). Scanned BEFORE shlex.split,
                 # which raises on a heredoc body with an apostrophe in it ("don't").
                 _shell_bin = _run_shell_bin()
-                _scan = _shell_scan(command) if _shell_bin else None
+                # PowerShell on Windows (#374): every line goes through it — a cmdlet is no program.
+                _ps = bool(_shell_bin) and _run_shell_kind() == "powershell"
+                _scan = (_ps_mod().ps_scan(command) if _ps else _shell_scan(command)) if _shell_bin else None
                 if _scan and _scan["error"]:
                     msg = (f"Error: that command did NOT run — {_scan['error']}. Nothing was "
                            "executed; fix the quoting and send it again."
-                           + (_HEREDOC_HINT if "quote" in str(_scan["error"]) else ""))
+                           + ((_PS_HEREDOC_HINT if _ps else _HEREDOC_HINT)
+                              if re.search(r"quote|here-string", str(_scan["error"])) else ""))
                     _last_obs["text"] = msg
                     return msg
                 # Once this turn has shell state (a cd, an activated venv), every line goes through
                 # the shell so it starts from that state — not only lines with shell syntax.
-                _words = [c["argv"][0] for c in _shell_commands(_scan["tokens"]) if c["argv"]] if _scan else []
+                _words = [c["argv"][0] for c in _shell_commands(_scan["tokens"]) if c["argv"]] \
+                    if (_scan and not _ps) else []
                 _builtin = sorted({w for w in _words if w in _SHELL_STATE_BUILTINS})
-                _use_shell = bool(_scan) and (_shell_needed(_scan) or bool(_builtin) or bool(
+                _use_shell = bool(_scan) and (_ps or _shell_needed(_scan) or bool(_builtin) or bool(
                     _RUN_STATE["path"] and os.path.exists(_RUN_STATE["path"])))
-                _bg_err = _shell_background_error(_scan) if _use_shell else None
+                _bg_err = ((_ps_background_error(_scan) if _ps else _shell_background_error(_scan))
+                           if _use_shell else None)
                 if _bg_err:
                     _last_obs["text"] = _bg_err
                     return _bg_err
@@ -15020,7 +15300,7 @@ def run_agent_chat(cfg):
                 # the first failure stops the rest. `cd DIR` sets the folder for what follows.
                 # A chain runs each part as a program; `export`/`source` in it would run nothing,
                 # so with a shell such a line goes to bash whole. (`cd` the chain does itself.)
-                _chain = None if (_use_shell and [b for b in _builtin if b != "cd"]) \
+                _chain = None if (_ps or (_use_shell and [b for b in _builtin if b != "cd"])) \
                     else _and_chain_parts(command)
                 if _chain:
                     _chain_start = _t.time()
@@ -15084,7 +15364,13 @@ def run_agent_chat(cfg):
                 # `/usr/bin/<x>` can't slip past a bare-name rule.
                 _runner = argv[0]
                 _rbase = os.path.basename(_runner)
-                if _use_shell:
+                if _use_shell and _ps:
+                    _refuse, _hard_reason, _ask_reason = _ws_ps_command_risk(
+                        _scan, _WS_RUN_DENYLIST, wd, _WS_RUN_ALLOWLIST)
+                    if _refuse:
+                        _last_obs["text"] = _refuse
+                        return _refuse
+                elif _use_shell:
                     # Every simple command in the line, including those inside $( ), gets the
                     # checks an argv command gets — allowlist, privilege, denylist, deletes —
                     # plus the shell-only ones (redirect outside the project, `| sh`).
@@ -15122,7 +15408,8 @@ def run_agent_chat(cfg):
                 # states it. "this needs root and sudo needs a password we cannot type" is a
                 # different question from "sudo is passwordless here", and the user can only
                 # answer the one they are shown.
-                _priv = _shell_priv_reason(_scan) if _use_shell else _ws_priv_reason(command)
+                _priv = ((_ps_priv_reason(_scan) if _ps else _shell_priv_reason(_scan))
+                         if _use_shell else _ws_priv_reason(command))
                 _facts = _ws_access_facts() if _priv else None
                 if _priv and _facts and not _facts["can_elevate"]:
                     # REFUSE BEFORE SPAWNING (requirement 5). With no tty, `sudo x` dies with
@@ -15186,7 +15473,24 @@ def run_agent_chat(cfg):
                 exit_path = log_path[:-4] + ".exit"
                 # gu as a co-author on the commits it makes (task #289) — after every check
                 # above, which judged the command as the model wrote it.
-                if _use_shell:
+                if _use_shell and _ps:
+                    # PowerShell (#374): the line, sequenced (&& / || for 5.1, the exit status
+                    # kept), in a file the wrapper dot-sources — no quoting crosses a command
+                    # line — and the wrapper keeps the exit code, folder and $env: changes.
+                    _gp = _ps_mod()
+                    _cmd_text, _attrib_note = _with_attribution_text(
+                        command, dict(_scan, commands=_gp.ps_commands(_scan["tokens"])),
+                        _attribution_settings(wd))
+                    _ps_cmd = log_path[:-4] + ".cmd.ps1"
+                    _ps_wrap = log_path[:-4] + ".ps1"
+                    with open(_ps_cmd, "w", encoding="utf-8") as _fh:
+                        # Windows PowerShell 5.1 (powershell.exe) needs the 2>&1 care; pwsh 7 does not.
+                        _fh.write(_gp.ps_sequence(_cmd_text, legacy=os.path.basename(
+                            _shell_bin).lower().startswith("powershell")))
+                    with open(_ps_wrap, "w", encoding="utf-8-sig") as _fh:  # 5.1 reads a BOM-less file as ANSI
+                        _fh.write(_gp.ps_wrapper(_ps_cmd, exit_path, _run_state_path()))
+                    argv = _gp.ps_argv(_shell_bin, _ps_wrap)
+                elif _use_shell:
                     _cmd_text, _attrib_note = _with_attribution_text(
                         command, _scan, _attribution_settings(wd))
                     # The exit code is written to a file so it outlives this turn's process, and
@@ -15287,11 +15591,11 @@ def run_agent_chat(cfg):
                         # triple-quoted string has no quoting to get wrong.
                         _hidden = _pipe_hidden_failure(_scan, out) if (rc == 0 and _use_shell) else ""
                         if _hidden:
-                            result += _pipe_hidden_failure_note(_hidden)
+                            result += _pipe_hidden_failure_note(_hidden, ps=_ps)
                             _emit({"type": "step", "text":
                                    f"Command failed behind a pipe → {_trim_words(_hidden)}"})
-                        if rc != 0 and _use_shell and _SHELL_QUOTE_ERR_RE.search(out or ""):
-                            result += _HEREDOC_HINT
+                        if rc != 0 and _use_shell and (_PS_QUOTE_ERR_RE if _ps else _SHELL_QUOTE_ERR_RE).search(out or ""):
+                            result += _PS_HEREDOC_HINT if _ps else _HEREDOC_HINT
                         # Say where the shell now is, so a next `cd sub` is not done twice (#362).
                         _now = _run_state_cwd() if _use_shell else ""
                         if _now and os.path.realpath(_now) != os.path.realpath(wd):
@@ -15386,7 +15690,8 @@ def run_agent_chat(cfg):
         # bash here (Git Bash on Windows), argv when there is none (#359). Set before tool() reads
         # the docstring.
         if _run_shell_bin():
-            run_command.__doc__ = run_command.__doc__.replace(_RUN_DOC_ARGV, _RUN_DOC_SHELL)
+            run_command.__doc__ = run_command.__doc__.replace(
+                _RUN_DOC_ARGV, _RUN_DOC_PS if _run_shell_kind() == "powershell" else _RUN_DOC_SHELL)
         run_command = tool(run_command)
 
         @tool
@@ -15697,7 +16002,7 @@ def run_agent_chat(cfg):
             """Use a REAL Chrome browser like a person does — open a page, see it, click with the mouse, type with the keyboard — to test a UI flow, check a page renders, fill a form or click through an app. The first call asks the user's permission. It uses the user's Chrome through the gu extension when that is installed, otherwise gu's own Chrome window (a separate profile: not logged in to the user's accounts). Loop: open → read (or screenshot) → click / type → read again to check what happened. Only gu's own tabs, and tabs the user shared, are used. If the answer starts BROWSER NOT AVAILABLE, stop and tell the user (the answer says what to do).
 
             Args:
-                action: one of: open (url) · read (page text + visible interactive elements numbered [n] with x,y) · screenshot (an image of the page; pixels = click x,y) · click / double_click / right_click / hover (ref, or x and y) · type (text into the focused field; with ref it clicks that field first) · key (text: "Enter", "Tab", "Escape", "ctrl+a", "shift+Tab"… several separated by spaces) · scroll (direction, amount) · back · reload · wait (seconds) · js (text = a JavaScript expression run in the page; returns its value) · console (the page's console messages since the last call) · tabs · switch (tab) · close
+                action: one of: open (url) · read (page text + visible interactive elements numbered [n] with x,y) · screenshot (an image of the page; pixels = click x,y) · click / double_click / right_click / hover (ref, or x and y) · type (text into the focused field; with ref it clicks that field first) · key (text: "Enter", "Tab", "Escape", "ctrl+a", "shift+Tab"… several separated by spaces) · scroll (direction, amount) · back · reload · wait (seconds) · js (text = a JavaScript expression run in the page; returns its value — gu's own Chrome window only: through the gu Chrome extension it is refused, so prefer read / console) · console (the page's console messages since the last call) · tabs · switch (tab) · close
                 url: for open — a full http(s):// or file:// url (localhost:3000 is taken as http://localhost:3000)
                 ref: an element's [n] from the last read, for click/hover/type
                 x: page x coordinate for click/hover (from read's @x,y or the screenshot), when no ref
@@ -15848,6 +16153,16 @@ def run_agent_chat(cfg):
                     "Finish with final_answer(<summary>): the answer in a few sentences, then the "
                     "relevant files as `path:start-end — what is there`, one per line. At most "
                     "about 250 words; never paste whole files.")
+                # ITS OWN CONTEXT, ITS OWN "ALREADY SHOWN" (#378, GitHub #160). The sub-agent runs the
+                # same tool functions, so its reads went into the turn's re-read guard — and the main
+                # agent was then refused lines it had never been shown ("already in this
+                # conversation"): 3 refused steps in one measured turn, then a whole-file read
+                # (50k chars carried by every later step) to get round it. The guards are swapped
+                # for empty ones while the sub-agent runs, and the main agent's put back after.
+                _guards = (_reads, _read_ranges, _seen_calls)
+                _saved = tuple(dict(g) for g in _guards)
+                for g in _guards:
+                    g.clear()
                 try:
                     with contextlib.redirect_stdout(sys.stderr):
                         out = sub.run(sub_task)
@@ -15855,6 +16170,10 @@ def run_agent_chat(cfg):
                     msg = f"Error: explore failed: {type(e).__name__}: {_clip(str(e), 200)}"
                     _last_obs["text"] = msg
                     return msg
+                finally:
+                    for g, old in zip(_guards, _saved):
+                        g.clear()
+                        g.update(old)
                 n = sum(1 for s in getattr(sub.memory, "steps", []) if type(s).__name__ == "ActionStep")
                 _emit({"type": "step", "text": f"Explored → {n} step(s), in its own context"})
                 _log(f"explore: {n} sub-step(s), {len(str(out))} chars back")