@tiens.nguyen/gu-cli 1.0.896 → 1.0.898

package/mongo-mac.mjs

@@ -0,0 +1,166 @@
+/**
+ * MONGODB ON macOS 13 AND OLDER (GH #403).
+ *
+ * Homebrew's mongodb-community is 9.0, and every MongoDB from 8.0.6 on is built for macOS 14+
+ * (LC_BUILD_VERSION minos 14.0 — checked with otool on the 8.0.6 … 9.0.4 downloads). On macOS 13
+ * it installs fine and then cannot start: "dyld: Symbol not found … built for macOS 14.0".
+ * 8.0.5 is the last release built for older Macs (minos 10.14 on Intel, 11.0 on Apple Silicon).
+ *
+ * So on those Macs gu runs its own mongod 8.0.5, like the Windows one (#210): no Homebrew, no
+ * service, no sudo. Everything lives under ~/.gonext/mongodb and goes away with that folder:
+ *   bin/mongod   data/   mongod.log   launch.log   version.txt
+ *
+ * The .tgz is gzip, so unlike the Windows zip one file cannot be fetched on its own: the whole
+ * archive (~80-90 MB) is downloaded, checked against MongoDB's published SHA-256, and only
+ * bin/mongod is kept.
+ */
+import { createHash } from "node:crypto";
+import { execFile, execFileSync } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { mkdir, rename, rm, stat, writeFile, mkdtemp, chmod } from "node:fs/promises";
+import { homedir, release } from "node:os";
+import { join } from "node:path";
+
+export const MONGO_MAC_OLD_VERSION = "8.0.5";
+/** Homebrew's MongoDB (and every release after 8.0.5) needs this macOS or newer. */
+export const MONGO_MAC_BREW_MIN_MAJOR = 14;
+
+// From https://downloads.mongodb.org/full.json, and re-checked by downloading both (2026-11-07).
+export const MONGO_MAC_DOWNLOADS = {
+  x64: {
+    url: `https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${MONGO_MAC_OLD_VERSION}.tgz`,
+    sha256: "eb528846663ef106003b3c491dfe3722f918cb75d056670b23a620b339f7f6ec",
+  },
+  arm64: {
+    url: `https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${MONGO_MAC_OLD_VERSION}.tgz`,
+    sha256: "71e2510f0455ff24e1961aa0507eb0660b300c84f6da9899052be409090fb990",
+  },
+};
+
+/** "13.7.1" → 13. Darwin's kernel number is the fallback (Darwin 20-24 = macOS 11-15, 25 = 26). */
+export function macosMajor({ productVersion = null, darwin = release(), platform = process.platform } = {}) {
+  if (productVersion == null && platform !== "darwin") return 0; // not a Mac: no answer, not a guess
+  let v = productVersion;
+  if (v == null) {
+    try { v = execFileSync("sw_vers", ["-productVersion"], { encoding: "utf8", timeout: 5000 }); } catch { v = ""; }
+  }
+  const m = /^(\d+)/.exec(String(v).trim());
+  if (m) return Number(m[1]);
+  const d = parseInt(String(darwin), 10);
+  if (!Number.isFinite(d)) return 0;
+  return d >= 25 ? d + 1 : d >= 20 ? d - 9 : 10;
+}
+
+/** Does this Mac need gu's own MongoDB? 0 (unknown) keeps Homebrew — the path that worked before. */
+export function macNeedsOwnMongo(major) {
+  return major > 0 && major < MONGO_MAC_BREW_MIN_MAJOR;
+}
+
+/** Where gu keeps its own mongod on a Mac — the same layout as Windows. `home` for tests. */
+export function mongoMacPaths(home = homedir()) {
+  const dir = join(home, ".gonext", "mongodb");
+  return {
+    dir,
+    exe: join(dir, "bin", "mongod"),
+    data: join(dir, "data"),
+    log: join(dir, "mongod.log"),
+    launchLog: join(dir, "launch.log"),
+    version: join(dir, "version.txt"),
+  };
+}
+
+/** Is gu's own mongod there? */
+export async function macMongoInstalled(paths = mongoMacPaths()) {
+  try { return (await stat(paths.exe)).isFile(); } catch { return false; }
+}
+
+/** The download for this CPU, or null for one MongoDB does not build. */
+export function macMongoDownload(arch = process.arch) {
+  return MONGO_MAC_DOWNLOADS[arch] ?? null;
+}
+
+/**
+ * Download the archive, check its SHA-256, keep only bin/mongod. → { bytes }.
+ * Throws a plain reason; nothing half-written is left at paths.exe.
+ * `fetchFn` and `extract` are injectable so tests never touch the network or tar.
+ */
+export async function downloadMongodMac({
+  paths = mongoMacPaths(),
+  arch = process.arch,
+  fetchFn = fetch,
+  extract = extractMongod,
+  log = () => {},
+  version = MONGO_MAC_OLD_VERSION,
+  dl = macMongoDownload(arch),
+} = {}) {
+  if (!dl) throw new Error(`MongoDB has no macOS build for ${arch}`);
+  await mkdir(paths.dir, { recursive: true });
+  const tgz = join(paths.dir, "mongodb.tgz.part");
+  const res = await fetchFn(dl.url);
+  if (!res.ok || !res.body) throw new Error(`download failed (HTTP ${res.status})`);
+  const total = Number(res.headers?.get?.("content-length")) || 0;
+  const mb = (n) => (n / 1048576).toFixed(0);
+  const hash = createHash("sha256");
+  const out = createWriteStream(tgz);
+  let got = 0;
+  let shown = -1;
+  try {
+    const reader = res.body.getReader();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      hash.update(value);
+      got += value.length;
+      if (!out.write(value)) await new Promise((r) => out.once("drain", r));
+      if (total) {
+        const pct = Math.floor((got / total) * 10) * 10;
+        if (pct !== shown) { shown = pct; log(`  … ${pct}%  (${mb(got)} of ${mb(total)} MB)`); }
+      }
+    }
+  } finally {
+    await new Promise((r) => out.end(r));
+  }
+  try {
+    if (hash.digest("hex") !== dl.sha256) throw new Error("the download is damaged (SHA-256 does not match) — run gu again");
+    const tmp = await mkdtemp(join(paths.dir, "unpack-"));
+    try {
+      const mongod = await extract(tgz, tmp);
+      await mkdir(join(paths.dir, "bin"), { recursive: true });
+      await rm(paths.exe, { force: true });
+      await rename(mongod, paths.exe);
+      await chmod(paths.exe, 0o755);
+    } finally {
+      await rm(tmp, { recursive: true, force: true });
+    }
+  } finally {
+    await rm(tgz, { force: true });
+  }
+  await writeFile(paths.version, `${version}\n`);
+  return { bytes: got };
+}
+
+/** tar -x of only the archive's bin/mongod into `dir` → the extracted file's path. */
+export function extractMongod(tgz, dir) {
+  return new Promise((resolve, reject) => {
+    execFile("tar", ["-xzf", tgz, "-C", dir, "--strip-components", "2", "*/bin/mongod"], { timeout: 300000 }, (err, _o, stderr) => {
+      if (err) reject(new Error(`could not unpack the archive: ${String(stderr || err.message).trim().split("\n").pop()}`));
+      else resolve(join(dir, "mongod"));
+    });
+  });
+}
+
+/**
+ * Can this mongod run here at all? `mongod --version` stops at once with a dyld error when the
+ * build is for a newer macOS — the failure this module exists for — so ask it before starting it
+ * detached, where that would only show up as "not answering". → { ok, why }.
+ */
+export function mongodRunsMac(exe, { execFn = execFile, timeoutMs = 20000 } = {}) {
+  return new Promise((resolve) => {
+    execFn(exe, ["--version"], { timeout: timeoutMs }, (err, stdout, stderr) => {
+      if (!err) return resolve({ ok: true, why: "" });
+      const text = `${stderr || ""}\n${stdout || ""}`;
+      const newer = /built for macOS ([\d.]+) which is newer/.exec(text);
+      resolve({ ok: false, why: newer ? `it is built for macOS ${newer[1]} or newer` : (text.trim().split("\n")[0] || String(err.message)) });
+    });
+  });
+}

package/node-version.mjs

@@ -12,6 +12,9 @@
  *
  * Checked at the TOP of both entry points, before any import that might itself fail.
  */
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+
 export const MIN_NODE_MAJOR = 18;
 
 /** The message for a too-old runtime, or "" when this one is fine. Pure, so it is testable. */
@@ -52,11 +55,30 @@ export function nodeAtLeast(version, min) {
   return true;
 }
 
+/**
+ * The Node versions nvm has installed when THIS node is one of nvm's, else []. Found on the 2017
+ * MacBook Pro (GH #406): nvm's default was 18 while 22 was already installed, and "install a new
+ * Node" was the wrong advice — one `nvm alias default` was the whole fix.
+ */
+export function nvmNodeVersions({ env = process.env, execPath = process.execPath, list = null } = {}) {
+  const dir = env.NVM_DIR;
+  if (!dir || !String(execPath).startsWith(dir)) {return [];}
+  let names = list;
+  if (!names) {
+    try { names = readdirSync(join(dir, "versions", "node")); } catch { return []; }
+  }
+  return names.filter((n) => /^v\d+\.\d+\.\d+$/.test(n));
+}
+
 /** Why Local mode cannot run on this node, with what to do — or "" when it can. Pure. */
-export function localModeNodeProblem(version = process.version, platform = process.platform) {
+export function localModeNodeProblem(version = process.version, platform = process.platform, { nvmVersions = [] } = {}) {
   if (nodeAtLeast(version, LOCAL_API_MIN_NODE)) {return "";}
-  const how =
-    platform === "win32"
+  // nvm already has a new enough Node: switch to it, nothing to install.
+  const ready = nvmVersions.filter((v) => nodeAtLeast(v, LOCAL_API_MIN_NODE))
+    .sort((a, b) => (nodeAtLeast(a, b) ? -1 : 1))[0];
+  const how = ready
+    ? [`  nvm already has ${ready}. Make it the default, then open a new terminal:`, `    nvm alias default ${ready.replace(/^v/, "")}`]
+    : platform === "win32"
       ? ["  winget install OpenJS.NodeJS.LTS      (or: nvm install lts with nvm-windows)"]
       : platform === "darwin"
         ? ["  brew install node                     (or: nvm install --lts)"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.896",
-  "description": "gu: the coding agent in your terminal. It reads your repo, makes the change and runs the tests, with your own models (Ollama or any OpenAI-compatible provider). Free installs run entirely on your machine. macOS, Linux and Windows.",
+  "version": "1.0.898",
+  "description": "gu: the coding agent in your terminal. It reads your repo, makes the change and runs the tests, with your own models (Ollama or any OpenAI-compatible provider). Free installs keep the agent, its API and its database on your machine. macOS, Linux and Windows.",
   "keywords": [
     "ai",
     "coding-agent",
@@ -74,6 +74,7 @@
     "turn-stop.mjs",
     "workspace-revert.mjs",
     "mongo-native.mjs",
+    "mongo-mac.mjs",
     "mongo-windows.mjs",
     "python-windows.mjs",
     "terminal-hover.mjs",

package/platform-tools.mjs

@@ -30,8 +30,15 @@ const run = (cmd, args, opts = {}) =>
 
 /* ------------------------------------------------------------------ process listing ----- */
 
-/** The command that lists every process with its full command line. */
-export function processListCommand(platform = process.platform) {
+/**
+ * The command that lists every process with its full command line.
+ *
+ * `ownUser` (GH #396): only THIS user's processes, on macOS and Linux. Another account on the same machine has its
+ * own HOME, worker.env and daemon: counting its gu daemon as "ours is running" meant a second account's daemon
+ * was never started (found on a Mac shared by two accounts: "start it with `gu start`"), and it is not ours to stop.
+ * Windows keeps the full list: a daemon started by a scheduled task runs in a different session than the terminal.
+ */
+export function processListCommand(platform = process.platform, { ownUser = false, uid = process.getuid?.() } = {}) {
   return platform === "win32"
     ? {
         // CIM over WMIC: wmic is deprecated and absent from newer Windows 11 images, and
@@ -43,7 +50,7 @@ export function processListCommand(platform = process.platform) {
           "Get-CimInstance Win32_Process | ForEach-Object { \"$($_.ProcessId) $($_.CommandLine)\" }",
         ],
       }
-    : { cmd: "ps", args: ["-A", "-o", "pid=,command="] };
+    : { cmd: "ps", args: [...(ownUser && Number.isInteger(uid) ? ["-U", String(uid)] : ["-A"]), "-o", "pid=,command="] };
 }
 
 /**

package/server-keys.mjs

@@ -49,7 +49,6 @@ export function keyTags(k, { folderKeyId = "", inUseId = "" } = {}) {
   if (k.id === folderKeyId) tags.push("this folder");
   else if (k.id === inUseId) tags.push("in use");
   if (k.default) tags.push("default");
-  if (k.first) tags.push("first key");
   if (!k.backendId) tags.push("not tied to a server yet");
   return tags;
 }

package/terminal-layout.mjs

@@ -557,26 +557,50 @@ export function createMouseKeyWindow({ maxRun = 24 } = {}) {
  * "^" is only held while the terminal is reporting the mouse (`plainLeads`), so typing them is
  * not slowed down otherwise.
  */
-const MOUSE_LEADS = ["\x1b[<", "^[[<", "[<"];
 const MOUSE_BODY_DONE = /^(\d+;\d+;\d+[Mm])$/;
 const MOUSE_BODY_PART = /^\d*(?:;\d*){0,2}$/;
+// Windows "win32-input-mode" key records: ESC [ Vk ; Sc ; Uc ; Kd ; Cs ; Rc _ (six numbers).
+const WIN32_BODY_DONE = /^\d+(?:;\d+){5}_$/;
+const WIN32_BODY_PART = /^\d*(?:;\d*){0,5}$/;
+/**
+ * What `text` (the held keys, ESC written as "\x1b") is so far. Leads: a real ESC, ESC spelled
+ * "^[", or no ESC at all. The last two only while the mouse is reported (`plainLeads`), and a
+ * bare "[" only for a MOUSE report: "[I" or "[1;2" are things people type.
+ *   done + report "35;114;22M"  a mouse report
+ *   done + report null          a terminal message with nothing to do: focus in/out ("I"/"O",
+ *                               sent when the window is minimised and restored — GH #365) or a
+ *                               win32 key record the console let through
+ */
 function mouseTextVerdict(text, plainLeads) {
-  for (const lead of MOUSE_LEADS) {
-    if (!plainLeads && lead !== "\x1b[<") continue;
+  for (const lead of ["\x1b[", "^[[", "["]) {
+    if (!plainLeads && lead !== "\x1b[") continue;
     if (lead.startsWith(text)) return { kind: "partial" };
     if (!text.startsWith(lead)) continue;
     const body = text.slice(lead.length);
-    if (MOUSE_BODY_DONE.test(body)) return { kind: "done", report: body };
-    if (body.length <= 20 && MOUSE_BODY_PART.test(body)) return { kind: "partial" };
+    if (body.startsWith("<")) {
+      const m = body.slice(1);
+      if (MOUSE_BODY_DONE.test(m)) return { kind: "done", report: m };
+      if (m.length <= 20 && MOUSE_BODY_PART.test(m)) return { kind: "partial" };
+      continue;
+    }
+    if (lead === "[") {
+      if (body === "") return { kind: "partial" };
+      continue;
+    }
+    if (body === "I" || body === "O" || WIN32_BODY_DONE.test(body)) return { kind: "done", report: null };
+    if (body.length <= 40 && WIN32_BODY_PART.test(body)) return { kind: "partial" };
   }
   return { kind: "bad" };
 }
 export function createMouseReportReader() {
   let held = null; // [str, key] pairs
+  // A CSI node could not name ("\x1b[I", or "\x1b[17;29" with the rest still to come) is held
+  // by its sequence; a named one (an arrow, F3, Ctrl+Up) is a key and never starts a report.
+  const unnamedCsi = (key) => key?.name === "undefined" && /^\x1b\[/.test(key?.sequence ?? "");
   const textOf = (str, key) =>
-    key?.code === "[<" ? "\x1b[<" : key?.name === "escape" ? "\x1b" : typeof str === "string" ? str : "";
+    key?.code === "[<" ? "\x1b[<" : unnamedCsi(key) ? key.sequence : key?.name === "escape" ? "\x1b" : typeof str === "string" ? str : "";
   const startsOne = (str, key, plainLeads) =>
-    key?.code === "[<" || key?.name === "escape" || (plainLeads && (str === "[" || str === "^"));
+    key?.code === "[<" || unnamedCsi(key) || key?.name === "escape" || (plainLeads && (str === "[" || str === "^"));
   return {
     holding: () => held !== null,
     /**
@@ -595,6 +619,8 @@ export function createMouseReportReader() {
         const v = mouseTextVerdict(textOf(str, key), plainLeads);
         if (v.kind === "partial") return { action: "hold" };
         held = null;
+        // Whole in one key ("\x1b[O"): node would drop it anyway, but it is ours to drop.
+        if (v.kind === "done") return { action: "consume", report: v.report };
         return { action: "pass" };
       }
       held.push([str, key]);
@@ -626,7 +652,9 @@ export function createMouseReportReader() {
 
 /** Last line of defence at submit: a report that got past every reader is not a question. */
 export function stripLeakedMouseReports(line) {
-  return String(line).replace(/(?:\x1b|\^\[)?\[<\d+;\d+;\d+[Mm]/g, "");
+  return String(line)
+    .replace(/(?:\x1b|\^\[)?\[<\d+;\d+;\d+[Mm]/g, "")
+    .replace(/(?:\x1b|\^\[)\[(?:[IO]|\d+(?:;\d+){5}_)/g, "");
 }
 
 /**
@@ -2762,29 +2790,6 @@ export function resizeRepaintTarget({ barPinned, modal, busy, scrolledBack }) {
   return scrolledBack ? "scrollback" : "live";
 }
 
-/**
- * Should the workspace "sync chat history to the cloud?" question be ASKED? (task #154)
- *
- * Not on a Client Expert machine. There is no cloud there: the API and the database are on
- * this box, "your account" is a local row, and there is no web app to see it on — so every
- * clause of the question is false. Asking a question whose premise is wrong is worse than not
- * asking, because the answer cannot mean what the reader thinks it means.
- *
- * The sync itself still happens — it writes to the local database, which is where that
- * machine's conversations already live — so the value is true and it is stated rather than
- * asked. Reported live: a Client Expert machine on Windows offering to send chat to a cloud
- * it does not have.
- */
-export function workspaceSyncQuestion({ clientExpert }) {
-  return clientExpert
-    ? {
-        ask: false,
-        value: true,
-        note: "chat history is kept in the local database on this machine (Local mode)",
-      }
-    : { ask: true, value: null, note: "" };
-}
-
 /**
  * The ONE first-run question for a new folder (GitHub #192). It used to be two or three separate
  * Y/n prompts (register, trust to run commands, then the browser on first use). They are one
@@ -2900,8 +2905,9 @@ export function identityRow(
   // The mark only means anything beside a named coder: with none shown there is nothing for it
   // to be about, and it would read as a fault in the folder.
   const mark = name && keyUnchosen ? red(" key not chosen") : "";
-  // API key tail: show the last 4 characters of the API key when available (e.g., "| abcd")
-  const keyIndicator = apiKeyTail ? dim(" | ") + dim(apiKeyTail) : "";
+  // API key tail, LABELLED (GH #397): a bare "| VW3Y" between the model and the folder read as a
+  // stray code. Same "····" form every key line in gu uses.
+  const keyIndicator = apiKeyTail ? dim(" | ") + dim(`key ····${apiKeyTail}`) : "";
   return (name ? orange(name) + mark + keyIndicator + dim(" | ") : "") + cyan(where);
 }
 
@@ -2910,7 +2916,7 @@ export function identityRow(
  *
  * ON CLIENT EXPERT, NOTHING. That mode's whole promise is that the machine keeps everything —
  * API, database, models — and shares none of it, so "cloud sync on" is not merely noise, it
- * contradicts the mode the user chose (reported 2026-09-04). workspaceSyncQuestion already
+ * contradicts the mode the user chose (reported 2026-09-04). The workspace record already
  * knows this and stores `true` meaning "persist it", but the LABEL read that value as "to the
  * cloud", which is the one place it does not go.
  *