@tiens.nguyen/gu-cli 1.0.836 → 1.0.838

package/browser-extension/actions.js

@@ -10,6 +10,9 @@
 //   host.tabs() → [{id, title, url, current}]        host.switchTo(tabId) → boolean
 //   host.info(tabId) → {url, title, status} | null   host.activate(tabId)
 //   host.close(tabId)
+//   host.runsJs — true only where running gu's own JavaScript text is allowed (gu's own window).
+//   The Chrome Web Store extension leaves it unset: text sent at run time and executed is
+//   "remote code", which a Manifest V3 store extension may not run (#377, GitHub #164).
 // No chrome.* and no Node API in here: it runs in an extension service worker and in Node.
 
 const consoleBuf = new Map(); // tabId → [{level, text}] since the last "console" read
@@ -305,6 +308,11 @@ export async function runAction(cmd, host) {
       await sleep(Math.max(0, Math.min(Number(cmd.seconds) || 1, 30)) * 1000);
       return after(host, id);
     case "js": {
+      if (!host.runsJs) {
+        throw new Error("js is not available through the gu Chrome extension (Chrome Web Store rules: " +
+          "it runs only the code it ships with). Use read, console, click and type instead — or gu's own " +
+          "Chrome window, which has it.");
+      }
       const value = await evaluate(host, id, String(cmd.text || ""));
       return after(host, id, { value: value === undefined ? "undefined" : JSON.stringify(value)?.slice(0, 8000) });
     }

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "gu browser",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "Lets the gu coding agent open, see and operate web pages in its own tabs (tab group \"gu\") with a real mouse and keyboard.",
   "minimum_chrome_version": "116",
   "icons": {
@@ -17,9 +17,6 @@
     "alarms",
     "storage"
   ],
-  "host_permissions": [
-    "<all_urls>"
-  ],
   "background": {
     "service_worker": "background.js",
     "type": "module"

package/gonext_agent_chat.py

@@ -2226,6 +2226,41 @@ def _announces_next_step(stripped: str) -> bool:
     return bool(_NEXT_STEP_RE.search(last)) and not _HANDED_TO_USER_RE.search(last)
 
 
+# A SENTENCE OF INTENT WITH NO CODE (#379, GitHub #163), measured: after a failed `cd` the model
+# replied "The shell was already in `frontend`, so `cd frontend` failed. Run without the cd." and
+# then "I forgot the code block. Run the tests with the correct workdir." — no code either time,
+# two failed steps (~94k input tokens). Neither says "let me" / "I'll", so _announces_next_step
+# missed them. A SHORT reply whose last sentence tells ITSELF to act (an imperative, not addressed
+# to "you"), or that admits leaving the code out, is a plan. A short report of finished work
+# ("Done. Run `npm start` to see it.") is not.
+_SELF_ACTION_RE = re.compile(
+    r"^(?:(?:now|so|then|next|ok(?:ay)?),?\s+)?(?:run|re-?run|retry|try|check|read|open|call|use|"
+    r"fix|edit|update|test|execute|search|grep|list|look|install|build|verify|inspect|add|remove|"
+    r"stage|commit|push|create|write|redo|repeat|drop|skip|pass|set)\b", re.I)
+_SELF_FIX_RE = re.compile(
+    r"\bI\s+(?:forgot|missed|left\s+out|omitted|didn't\s+include|did\s+not\s+include)\b[^.]*\b(?:code|block)\b"
+    r"|\bno\s+code\s+block\b", re.I)
+_FINISHED_RE = re.compile(
+    r"\b(?:done|committed|pushed|fixed|created|deployed|merged|finished|completed|all set)\b|✅", re.I)
+
+
+def _short_self_directive(stripped: str) -> bool:
+    """A short, code-less reply that ends by telling itself what to do, or admits it left the
+    code out. PURE, so the measured replies can be replayed."""
+    t = (stripped or "").strip()
+    if not t or len(t) > 300 or "\n\n" in t:
+        return False
+    if _SELF_FIX_RE.search(t):
+        return True
+    sentences = [x.strip() for x in re.split(r"(?<=[.!?])\s+", t) if x.strip()]
+    if not sentences or len(sentences) > 3:
+        return False
+    last = sentences[-1]
+    if re.search(r"\byou(?:r)?\b", last, re.I) or _FINISHED_RE.search(t):
+        return False
+    return bool(_SELF_ACTION_RE.match(last))
+
+
 def _looks_like_scratchpad(stripped: str) -> bool:
     """True if `stripped` reads like unresolved internal deliberation rather than a
     finished, user-facing answer — see module comment above for the signals used."""
@@ -2233,6 +2268,8 @@ def _looks_like_scratchpad(stripped: str) -> bool:
         return True
     if _announces_next_step(stripped):
         return True
+    if _short_self_directive(stripped):
+        return True
     return len(_DELIBERATION_RE.findall(stripped)) >= 3
 
 
@@ -9736,6 +9773,62 @@ def _run_state_path() -> str:
     return _RUN_STATE["path"]
 
 
+_CD_FIRST_RE = re.compile(
+    r"""^\s*(?:cd|pushd|set-location|sl|chdir)\s+(?:-(?:literalpath|path)\s+)?(['"]?)([^'";&|\s]+)\1(?=\s*(?:$|&&|;|\|\||\n))""",
+    re.IGNORECASE)
+
+
+def _cd_from_root(command: str, kept: str, root: str) -> str:
+    """The folder a line should start in: `kept` (where the last shell line ended), unless the line
+    begins by entering a RELATIVE folder that does not exist there but does at `root` — then
+    `root`. PURE but for isdir. Anything else (absolute, ~, $VAR, `..`, already there) → `kept`."""
+    if not kept or not root or os.path.realpath(kept) == os.path.realpath(root):
+        return kept
+    m = _CD_FIRST_RE.match(command or "")
+    if not m:
+        return kept
+    target = m.group(2)
+    if os.path.isabs(target) or target.startswith(("~", "$", ".")) or re.match(r"^[A-Za-z]:", target):
+        return kept
+    if os.path.isdir(os.path.join(kept, target)) or not os.path.isdir(os.path.join(root, target)):
+        return kept
+    return root
+
+
+def _patch_dotted_imports() -> bool:
+    """`import urllib.request` in the agent's sandbox binds the name `urllib` (#378, GitHub #162).
+
+    smolagents 1.26's evaluate_import stores `import a.b` under the literal key "a.b" and never binds
+    `a`, so `urllib.request.urlopen(…)` — urllib.request is an allowed import here — fails with
+    "module 'urllib.error' has no attribute 'request'". Measured: three identical failing steps in
+    one deploy turn before the model gave up and used curl. Python binds the TOP package for a
+    dotted import; this does the same, and only when that top package is itself an allowed import
+    (so `import os.path` stays refused). Idempotent. False when smolagents is not there."""
+    try:
+        import ast as _ast
+        from importlib import import_module as _imp
+        from smolagents import local_python_executor as _lpe
+    except Exception:  # noqa: BLE001
+        return False
+    if getattr(_lpe.evaluate_import, "_gu_dotted", False):
+        return True
+    orig = _lpe.evaluate_import
+
+    def evaluate_import(expression, state, authorized_imports):
+        r = orig(expression, state, authorized_imports)
+        if isinstance(expression, _ast.Import):
+            for alias in expression.names:
+                if not alias.asname and "." in alias.name:
+                    top = alias.name.split(".")[0]
+                    if _lpe.check_import_authorized(top, authorized_imports):
+                        state[top] = _lpe.get_safe_module(_imp(top), authorized_imports)
+        return r
+
+    evaluate_import._gu_dotted = True
+    _lpe.evaluate_import = evaluate_import
+    return True
+
+
 def _run_state_cwd() -> str:
     """The folder the last shell line ended in, this turn — or ""."""
     p = _RUN_STATE["path"]
@@ -10069,6 +10162,7 @@ def run_agent_chat(cfg):
                        f"then: gu stop && gu start"})
         _log(f"smolagents import FAILED on {_where}: {e}")
         return
+    _patch_dotted_imports()
 
     messages = cfg.get("messages") or []
     _turn_image_refs = _take_image_markers(messages)
@@ -13755,11 +13849,12 @@ def run_agent_chat(cfg):
 
         def _sanitize_parse_errors(self, msgs):
             """Swap smolagents' code-parsing error text for a delimiter-free directive
-            (see _PARSE_ERROR_REPLACEMENT). No-op unless the backend is kind=openai, and
+            (see _PARSE_ERROR_REPLACEMENT), on every backend; a
             no-op on every other kind of message — genuine SyntaxError feedback from a
             block that DID run is left intact, since that is real information."""
-            if not self._openai_backend:
-                return
+            # Every backend now (#379, GitHub #163): ollama.com is an "ollama" backend, kept the
+            # stock text, and its model answered it twice more without code. gu runs strong
+            # models only (2026-09-25), the reason the CODE-NOW retry went ungated in #139.
             n = 0
             for m in msgs or []:
                 if not isinstance(m, dict):
@@ -13776,8 +13871,7 @@ def run_agent_chat(cfg):
                             part["text"] = self._PARSE_ERROR_REPLACEMENT
                             n += 1
             if n:
-                _log(f"#113 replaced {n} code-parsing error message(s) with a "
-                     "delimiter-free directive (openai backend)")
+                _log(f"#113 replaced {n} code-parsing error message(s) with a direct directive")
 
         def _prepare_completion_kwargs(self, *args, **kwargs):
             ck = super()._prepare_completion_kwargs(*args, **kwargs)
@@ -15189,6 +15283,12 @@ def run_agent_chat(cfg):
                             wd = _rag_read_allowed(_kept)
                         except Exception:  # noqa: BLE001 — left the allowed folders: start over
                             wd = _wd_before
+                    # `cd sub` AGAIN FROM INSIDE sub (#378, GitHub #161), measured: after
+                    # `cd frontend && npx tsc` the shell stayed in frontend, the next line was
+                    # `cd frontend && node test…` → "no such folder: frontend", then two text-only
+                    # steps before the tests ran — 4 steps for one test run. A line that starts by
+                    # entering a folder that is not here but IS at the project root means the root.
+                    wd = _cd_from_root(command, wd, _wd_before)
                 w = _ws_for_path(wd)
                 if w is None or not w.get("allowRun"):
                     # Contextual nudge (task #102): the #1 reason the model shells out here is
@@ -15939,7 +16039,7 @@ def run_agent_chat(cfg):
             """Use a REAL Chrome browser like a person does — open a page, see it, click with the mouse, type with the keyboard — to test a UI flow, check a page renders, fill a form or click through an app. The first call asks the user's permission. It uses the user's Chrome through the gu extension when that is installed, otherwise gu's own Chrome window (a separate profile: not logged in to the user's accounts). Loop: open → read (or screenshot) → click / type → read again to check what happened. Only gu's own tabs, and tabs the user shared, are used. If the answer starts BROWSER NOT AVAILABLE, stop and tell the user (the answer says what to do).
 
             Args:
-                action: one of: open (url) · read (page text + visible interactive elements numbered [n] with x,y) · screenshot (an image of the page; pixels = click x,y) · click / double_click / right_click / hover (ref, or x and y) · type (text into the focused field; with ref it clicks that field first) · key (text: "Enter", "Tab", "Escape", "ctrl+a", "shift+Tab"… several separated by spaces) · scroll (direction, amount) · back · reload · wait (seconds) · js (text = a JavaScript expression run in the page; returns its value) · console (the page's console messages since the last call) · tabs · switch (tab) · close
+                action: one of: open (url) · read (page text + visible interactive elements numbered [n] with x,y) · screenshot (an image of the page; pixels = click x,y) · click / double_click / right_click / hover (ref, or x and y) · type (text into the focused field; with ref it clicks that field first) · key (text: "Enter", "Tab", "Escape", "ctrl+a", "shift+Tab"… several separated by spaces) · scroll (direction, amount) · back · reload · wait (seconds) · js (text = a JavaScript expression run in the page; returns its value — gu's own Chrome window only: through the gu Chrome extension it is refused, so prefer read / console) · console (the page's console messages since the last call) · tabs · switch (tab) · close
                 url: for open — a full http(s):// or file:// url (localhost:3000 is taken as http://localhost:3000)
                 ref: an element's [n] from the last read, for click/hover/type
                 x: page x coordinate for click/hover (from read's @x,y or the screenshot), when no ref
@@ -16090,6 +16190,16 @@ def run_agent_chat(cfg):
                     "Finish with final_answer(<summary>): the answer in a few sentences, then the "
                     "relevant files as `path:start-end — what is there`, one per line. At most "
                     "about 250 words; never paste whole files.")
+                # ITS OWN CONTEXT, ITS OWN "ALREADY SHOWN" (#378, GitHub #160). The sub-agent runs the
+                # same tool functions, so its reads went into the turn's re-read guard — and the main
+                # agent was then refused lines it had never been shown ("already in this
+                # conversation"): 3 refused steps in one measured turn, then a whole-file read
+                # (50k chars carried by every later step) to get round it. The guards are swapped
+                # for empty ones while the sub-agent runs, and the main agent's put back after.
+                _guards = (_reads, _read_ranges, _seen_calls)
+                _saved = tuple(dict(g) for g in _guards)
+                for g in _guards:
+                    g.clear()
                 try:
                     with contextlib.redirect_stdout(sys.stderr):
                         out = sub.run(sub_task)
@@ -16097,6 +16207,10 @@ def run_agent_chat(cfg):
                     msg = f"Error: explore failed: {type(e).__name__}: {_clip(str(e), 200)}"
                     _last_obs["text"] = msg
                     return msg
+                finally:
+                    for g, old in zip(_guards, _saved):
+                        g.clear()
+                        g.update(old)
                 n = sum(1 for s in getattr(sub.memory, "steps", []) if type(s).__name__ == "ActionStep")
                 _emit({"type": "step", "text": f"Explored → {n} step(s), in its own context"})
                 _log(f"explore: {n} sub-step(s), {len(str(out))} chars back")

package/gu_browser.py

@@ -19,7 +19,7 @@ import urllib.request
 HERE = os.path.dirname(os.path.abspath(__file__))
 EXT_SRC = os.path.join(HERE, "browser-extension")
 EXT_FILES = ("manifest.json", "background.js", "actions.js", "popup.html", "popup.js",
-             "icons/icon16.png", "icons/icon48.png", "icons/icon128.png")
+             "icons/icon16.png", "icons/icon32.png", "icons/icon48.png", "icons/icon128.png")
 BRIDGE = os.path.join(HERE, "browser-bridge.mjs")
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.836",
+  "version": "1.0.838",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",