@tiens.nguyen/gu-cli 1.0.859 → 1.0.861

package/command-allow.mjs

@@ -0,0 +1,35 @@
+// "Yes, always in this folder" for the destructive-command question (GH #215).
+// The agent reads the same file (gonext_agent_chat._cmd_allowed_in) before it asks. Only the SOFT
+// question ("a destructive command ...") can be skipped by it - sudo, the denylist and deletes
+// outside the project are never covered by it.
+import { readFileSync, writeFileSync, mkdirSync, realpathSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+import { homedir } from "node:os";
+
+export const commandAllowPath = () => process.env.GU_COMMAND_ALLOW || join(homedir(), ".gonext", "command-allow.json");
+const real = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+};
+export function commandAllowList() {
+  try {
+    const f = JSON.parse(readFileSync(commandAllowPath(), "utf8")).folders;
+    return Array.isArray(f) ? f : [];
+  } catch {
+    return [];
+  }
+}
+/** Is `folder` on the list, or inside a folder that is (a project covers its subfolders)? */
+export function commandAllowedIn(folder) {
+  const f = real(folder);
+  return commandAllowList().some((r) => f === r || f.startsWith(r.replace(/[\\/]+$/, "") + sep));
+}
+export function commandAllowIn(folder, allow = true) {
+  const f = real(folder);
+  const folders = [...commandAllowList().filter((x) => x !== f), ...(allow ? [f] : [])];
+  mkdirSync(dirname(commandAllowPath()), { recursive: true });
+  writeFileSync(commandAllowPath(), JSON.stringify({ folders }, null, 2));
+}

package/gonext_agent_chat.py

@@ -7971,8 +7971,19 @@ def _ws_shell_command_risk(scan, denyset, wd="", allowset=None, roots=None):
             return (None, None, f"it runs text as code ({a[0]})")
         if "$" in a[0] or "`" in a[0]:
             return (None, None, f"the program to run is only known at run time ({a[0][:40]})")
+    # `cd sub && rm -rf x`: judge a delete from the folder the shell will be in when it runs.
+    cwds, cur = {}, wd
+    for c in top:
+        a = c["argv"]
+        if a and a[0] == "cd" and len(a) >= 2 and c["sep"] not in ("|", "|&"):
+            cur = os.path.normpath(os.path.join(cur or os.getcwd(),
+                                                os.path.expanduser(_shell_path_to_native(a[1]))))
+        cwds[id(c)] = cur
     for c in every:
-        if _WS_DESTRUCTIVE_RE.search(" ".join(c["argv"])) and not _agent_created_owns_delete(c["argv"], wd):
+        here = cwds.get(id(c), wd)
+        if (_WS_DESTRUCTIVE_RE.search(" ".join(c["argv"]))
+                and not _agent_created_owns_delete(c["argv"], wd)
+                and not _ws_delete_inside_only(c["argv"], here, roots)):
             return (None, None, "a destructive command (deletes files / wipes disk / powers off)")
     return (None, None, None)
 
@@ -8905,6 +8916,42 @@ def _ws_is_inside(path, roots):
     return any(path == r or path.startswith(r.rstrip(os.sep) + os.sep) for r in roots)
 
 
+def _ws_delete_inside_only(argv, wd, roots=None):
+    """True when `argv` is an rm/rmdir/unlink whose EVERY target is inside a registered project
+    (the user's own build output, node_modules, scratch files...) - deleting those is the normal
+    work of a project, so the destructive question is not asked. Still asks for: the project root
+    itself, its .git folder, a path only known at run time ($VAR, `cmd`), anything outside."""
+    if not argv:
+        return False
+    runner = os.path.basename(argv[0]).lower()
+    if runner.endswith(".exe"):
+        runner = runner[:-4]
+    if runner not in ("rm", "rmdir", "unlink"):
+        return False
+    targets = _ws_delete_targets(argv)
+    if not targets:
+        return False
+    ws = [os.path.realpath(r["path"]) for r in (_WS_ROOTS if roots is None else roots) if r.get("path")]
+    if not ws:
+        return False
+    for t in targets:
+        if "$" in t or "`" in t:
+            return False
+        if any(ch in t for ch in "*?[") and os.path.basename(t).startswith("."):
+            return False  # `.*` would also match .git
+        p = os.path.expanduser(_shell_path_to_native(t))
+        try:
+            p = os.path.realpath(p if os.path.isabs(p) else os.path.join(wd or os.getcwd(), p))
+        except OSError:
+            return False
+        home = next((r for r in ws if _ws_is_inside(p, [r])), None)
+        if home is None or p == home:
+            return False
+        if os.path.relpath(p, home).split(os.sep)[0] == ".git":
+            return False
+    return True
+
+
 def _ws_delete_outside_reason(argv, wd, roots=None):
     """Why this delete needs the user's yes, or None when every target is inside a workspace or
     the temp folder. Paths are resolved from `wd`, with ~ expanded and symlinks followed."""
@@ -9015,6 +9062,29 @@ def _with_attribution(argv, settings):
     return argv, ""
 
 
+# GH #215: "Yes, always in this folder" for the SOFT destructive question. ~/.gonext/command-allow.json
+# ({"folders": [...]}) is written by the terminal (command-allow.mjs). It never covers a hard reason
+# (sudo, denylist, delete outside the project) - those keep asking.
+_CMD_ALLOW_ASK = "a destructive command"
+
+
+def _cmd_allow_path():
+    return os.environ.get("GU_COMMAND_ALLOW") or os.path.join(os.path.expanduser("~"), ".gonext", "command-allow.json")
+
+
+def _cmd_allowed_in(folder):
+    """Is `folder` on the always-allow list, or inside a folder that is?"""
+    if not folder:
+        return False
+    try:
+        with open(_cmd_allow_path(), encoding="utf-8") as f:
+            folders = json.load(f).get("folders") or []
+        real = os.path.realpath(folder)
+        return any(isinstance(r, str) and _ws_is_inside(real, [r]) for r in folders)
+    except (OSError, ValueError, AttributeError):
+        return False
+
+
 def _ws_command_risk(command, argv, denyset, wd=""):
     """Classify a command for the run policy. Returns (hard_reason, ask_reason), either
     None when N/A:
@@ -9037,7 +9107,8 @@ def _ws_command_risk(command, argv, denyset, wd=""):
     outside = _ws_delete_outside_reason(argv, wd)
     if outside:
         return (outside, outside)
-    if _WS_DESTRUCTIVE_RE.search(cmd) and not _agent_created_owns_delete(argv, wd):
+    if (_WS_DESTRUCTIVE_RE.search(cmd) and not _agent_created_owns_delete(argv, wd)
+            and not _ws_delete_inside_only(argv, wd)):
         return (None, "a destructive command (deletes files / wipes disk / powers off)")
     return (None, None)
 
@@ -15709,6 +15780,13 @@ def run_agent_chat(cfg):
                            f"Needs {_priv} → cannot run here ({_ws_access_line(_facts)})"})
                     _last_obs["text"] = msg
                     return msg
+                # GH #215: the user said "Yes, always in this folder" to the destructive question.
+                if (_ask_reason and not _hard_reason and _ask_reason.startswith(_CMD_ALLOW_ASK)
+                        and _cmd_allowed_in(wd or _WS_ACTIVE or _default_ws_root())):
+                    # accept-edits OFF still confirms every command, so only the destructive
+                    # question is dropped, not that one.
+                    _ask_reason = None if _accept_edits else (
+                        "accept edits is off, so every command is confirmed first")
                 if _ask_reason:
                     if _priv and _facts:
                         _ask_reason += f" — {_facts['why']}"

package/gu-repl.mjs

@@ -140,6 +140,7 @@ import {
 import { completedFlush, splitLiveStream } from "./completed-flush.mjs";
 import { isScaffoldStep, isGroupableStep, stepGroupMark, stepGroupRows, relativizePaths } from "./step-group.mjs";
 import { clearLogsNoticeText } from "./clear-logs.mjs";
+import { commandAllowIn, commandAllowedIn } from "./command-allow.mjs";
 import { allowIn, allowedIn, bridgeCommand, browserReport, bridgeStatus, extensionDir, findDevInstalls, helpInstall, installExtensionFiles, installSteps, localLeftovers, openExtensionsPage, removeLocalFiles, STORE_URL, stopBridge } from "./browser-command.mjs";
 import { commandLogFile, killShell, logTail, markAnnounced, readShells, recapQuestion, runningShells, shellsToRecap, statusText as shellStatusText, renderShellDetails, shellPanelRows, shellPickerLabel, shellState, shellsNotice } from "./shell-details.mjs";
 import { discoverSkills, matchSkillCommand } from "./skills.mjs";
@@ -10699,6 +10700,9 @@ let approvalOpenedOver = null;
 let approvalDeadline = 0;
 let listDeadline = 0;
 let listTimeoutIndex = -1;
+/** How long a command approval ("Allow running this command?") waits before it answers No by itself.
+ *  GH #214: was 170 s; under 30 s so an absent user does not stall the turn. The python side waits 180 s. */
+const COMMAND_APPROVAL_MS = 25000;
 /** "2:49" above a minute, "45s" below; never negative. */
 function countdownLabel(msLeft) {
   const s = Math.max(0, Math.ceil(msLeft / 1000));
@@ -10774,7 +10778,7 @@ function onApprovalKey(key) {
   // Ctrl+C is delivered via readline "SIGINT" (onInterrupt), which also denies — see there.
 }
 // Show the picker and resolve to the user's choice. Non-TTY (piped) can't pick → deny
-// (safe). Auto-denies after ~170s so an absent user never hangs the turn (and stays
+// (safe). A command approval auto-denies after COMMAND_APPROVAL_MS (25s, GH #214) so an absent user never hangs the turn (well
 // under the python side's 180s wait); Enter is instant since Yes is preselected.
 // The command carries a "__MAXSTEP__::<message>" sentinel when it's the step-budget
 // continue prompt (task #80) rather than a risky-command approval. That case shows a
@@ -10941,7 +10945,7 @@ async function approvalPrompt(command) {
     const idx = await pickFromList(
       ["Yes", "Yes for all later ones (turns accept edits on)", "No"],
       0,
-      { timeoutMs: 170000, timeoutIndex: 2 }
+      { timeoutMs: COMMAND_APPROVAL_MS, timeoutIndex: 2 }
     );
     if (idx === 1 && editMode === "manual") {
       switchEditMode();
@@ -10949,6 +10953,27 @@ async function approvalPrompt(command) {
     }
     return { allow: idx === 0 || idx === 1, dontAsk: false };
   }
+  // GH #215 — "Yes, always in this folder". ONLY for the soft "a destructive command" question
+  // (the reason text comes from _ws_command_risk in gonext_agent_chat.py). sudo, the denylist and
+  // deletes outside the project give a different reason, so they keep the plain Yes/No below.
+  if (process.stdin.isTTY && why.startsWith("a destructive command")) {
+    printApprovalCommand(shown, { toggle: false }); // a list picker follows — shown whole, wrapped
+    process.stdout.write(indentBlock(why, { indent: GUTTER, paint: dim }) + "\n");
+    const idx = await pickFromList(
+      ["Yes", "Yes, always in this folder", "No"],
+      0,
+      { timeoutMs: COMMAND_APPROVAL_MS, timeoutIndex: 2 }
+    );
+    if (idx === 1) {
+      try {
+        commandAllowIn(resolve(process.cwd()), true);
+        process.stdout.write(dim("  (won't ask about destructive commands in this folder again — /command forget undoes it)\n"));
+      } catch (e) {
+        process.stdout.write(yellow(`  could not save that (${e?.message || e}) — allowed this once\n`));
+      }
+    }
+    return { allow: idx === 0 || idx === 1, dontAsk: false };
+  }
   const allow = await new Promise((resolve) => {
     if (!process.stdin.isTTY) {
       process.stdout.write("\n" + GUTTER + dim(`(approval needed for: ${shown}${why ? ` — ${why}` : ""} — no interactive terminal, skipping)`) + "\n");
@@ -10960,9 +10985,9 @@ async function approvalPrompt(command) {
     approvalSel = 0;
     approvalResolve = resolve;
     approvalActive = true;
-    approvalDeadline = Date.now() + 170000;
+    approvalDeadline = Date.now() + COMMAND_APPROVAL_MS;
     drawApprovalOptions(false);
-    const t = setTimeout(() => finishApproval(false, true), 170000);
+    const t = setTimeout(() => finishApproval(false, true), COMMAND_APPROVAL_MS);
     // #135: redraw the two option rows once a second so the countdown on "No" ticks down.
     const tick = setInterval(() => {
       if (approvalActive) drawApprovalOptions(true);
@@ -14564,6 +14589,17 @@ async function main() {
       paintBar();
       continue;
     }
+    if (line === "/command forget" || line === "/command status") {
+      const here = resolve(process.cwd());
+      if (line === "/command forget") commandAllowIn(here, false);
+      console.log("\n" + GUTTER + (line === "/command forget"
+        ? accent("✓ gu asks again before a destructive command in this folder.")
+        : (commandAllowedIn(here)
+          ? accent("Destructive commands run without asking in this folder.") + dim(" (/command forget undoes it)")
+          : dim("gu asks before a destructive command in this folder."))) + "\n");
+      paintBar();
+      continue;
+    }
     if (line === "/model") {
       await chooseModel();
       await refreshNoModelAtAll(); // #188: a coding model may have just been set → drop its row

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.859",
+  "version": "1.0.861",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -131,6 +131,7 @@
     "proc-identity.mjs",
     "win-path.mjs",
     "browser-command.mjs",
+    "command-allow.mjs",
     "browser-bridge.mjs",
     "browser-chrome.mjs",
     "browser-extension/manifest.json",