@tiens.nguyen/gu-cli 1.0.686

package/coding-key-prompt.mjs

@@ -0,0 +1,229 @@
+// The startup Kimi-K3 (cloud coding model) API-key prompt (task #127). Extracted from the
+// REPL so it's importable + testable with a mock `ask`/`save` — the REPL bin runs main() on
+// import, so the logic can't live there and be tested directly.
+//
+// When the resolved agent CODE model is an OpenAI-compatible cloud coder with NO key stored,
+// the API payload carries codingKeyMissing (+ codingKeyModel/codingKeyUrl). Here we ask the
+// user for the key (masked, via the injected askSecret) and save it. If they skip, the state
+// stays "waiting" SERVER-SIDE (coder configured, no key), so this fires again on the next
+// `gu` start until the key is set. Until then the agent falls back to the chat model for
+// coding (the coder is omitted from the job payload), so the terminal still works.
+
+const identity = (s) => s;
+
+/**
+ * The line that tells someone the key goes HERE (task #191).
+ *
+ * Reported as "its confused": the prompt was a bare `kimi-k3 API key:` and nothing else. It
+ * never said the key is typed or pasted at that point, never said how to finish, and — because
+ * askSecret mutes readline's echo so a secret can't reach the scrollback (task #127) — typing
+ * produced no visible change at that spot either. A prompt that does not react is read as a
+ * hang, not as a question.
+ *
+ * ONE STRING, TWO PROMPTS. The key is asked for in two places — at startup when none is stored,
+ * and on Ctrl+K to replace one — and they were two hand-written copies of the same idea. A hint
+ * added to one of them would have left the other exactly as confusing.
+ */
+export const SECRET_KEY_HINT = "type or paste the key, then press Enter — it stays masked";
+
+/**
+ * Hosts that serve an OpenAI-compatible API but authenticate NOTHING.
+ *
+ * The API marks a coder "key missing" whenever it is an OpenAI-compatible URL with no stored
+ * credential — which is right for a cloud provider and wrong for an Ollama. Ollama ignores the
+ * Authorization header entirely, so there is no key to enter: the prompt asks for something
+ * that does not exist and, worse, reappears on every start because it can never be satisfied.
+ *
+ * Reported live: a Client Expert machine whose coder is gemma4-quadro-49k on
+ * ollama1.gomarsic.cc being asked, at every launch, for that model's "API key".
+ *
+ * Matched on the HOST, not a substring: `evil.com/?x=gomarsic.cc` and
+ * `gomarsic.cc.attacker.net` must not be treated as ours — being wrong here would suppress a
+ * genuine prompt and leave someone's coder quietly unusable.
+ */
+export function isKeylessCodingHost(url) {
+  let host;
+  try {
+    host = new URL(String(url ?? "")).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]") return true;
+  return host === "gomarsic.cc" || host.endsWith(".gomarsic.cc");
+}
+
+/**
+ * @param payload  the /agent-payload `payload` object (reads codingKeyMissing/codingKeyModel).
+ * @param deps.askSecret  async (prompt) => string  — masked input; "" means the user skipped.
+ * @param deps.saveCodingKey  async (key) => boolean — persist the key (POST /coding-key).
+ * @param deps.log  (line) => void — printer.
+ * @param deps.colors  optional { dim, cyan, red } — identity in tests.
+ * @returns { asked, saved, model, url } — asked=false when there was no missing key.
+ *   model/url are present whenever the coder became usable, so the caller can fix the
+ *   already-printed banner and the bottom bar (task #190).
+ */
+export async function promptCodingKeyIfMissing(payload, { askSecret, saveCodingKey, log, colors = {} }) {
+  const dim = colors.dim ?? identity;
+  const cyan = colors.cyan ?? identity;
+  const red = colors.red ?? identity;
+
+  if (!payload?.codingKeyMissing) return { asked: false, saved: false };
+  // Hoisted above the keyless branch: every path that makes the coder usable reports the model
+  // back (see the return shape) so the caller can correct a banner it already printed.
+  const model = String(payload.codingKeyModel || "the coding model").trim();
+  // A keyless host has no key to ask for — but NOT asking is only half the fix. The API omits
+  // the coder from the job payload while it believes a key is missing, so the agent silently
+  // falls back to the chat model and the coder the user chose is never used at all.
+  //
+  // So store the placeholder the request actually needs. Ollama ignores the Authorization
+  // header, while an OpenAI client refuses to send an empty key — "local" satisfies both, and
+  // is what the hosted API already uses for a local agent model. Once stored, the coder is
+  // included and this never runs again.
+  if (isKeylessCodingHost(payload.codingKeyUrl)) {
+    const ok = await saveCodingKey("local").catch(() => false);
+    return { asked: false, saved: Boolean(ok), keyless: true, model, url: payload.codingKeyUrl };
+  }
+
+  log(dim("\ngonext: your agent coding model (") + cyan(model) + dim(") needs an API key."));
+  log(dim("  Until it's set, coding falls back to your local model. Enter the key now,"));
+  log(dim("  or press Enter to skip (I'll ask again next time).\n"));
+
+  log(dim(`  ${SECRET_KEY_HINT}`));
+  const key = await askSecret(`  ${model} API key: `);
+  if (!key) {
+    log(dim("  ⏳ waiting for your ") + cyan(model) + dim(" API key — I'll ask again next time.\n"));
+    return { asked: true, saved: false };
+  }
+  const ok = await saveCodingKey(key);
+  log(
+    ok
+      ? cyan(`  ✓ saved — ${model} is now your coding model.\n`)
+      : red("  couldn't save the key — try again next start, or set it in web Settings → Agent.\n")
+  );
+  return { asked: true, saved: ok, model, url: payload.codingKeyUrl };
+}
+
+/**
+ * What the startup banner's `coder` row should read (task #190).
+ *
+ * The banner is painted from the startup payload BEFORE promptCodingKeyIfMissing runs, and the
+ * API omits codingModelId entirely while it believes the key is missing. So the row used to
+ * print "—" and then, three lines later, the prompt said "kimi-k3 is now your coding model" —
+ * a header contradicted by the very next thing on screen.
+ *
+ * There is a coder either way; what differs is whether it can be USED yet. Name it, and say so.
+ */
+export function codingBannerLabel(payload, { dim = identity, override = "" } = {}) {
+  const p = payload ?? {};
+  // A `/model` PICK WINS OVER THE ACCOUNT DEFAULT, because it is what the next turn will
+  // actually use. The payload carries the account's coder; the override is this folder's,
+  // restored from its session file at startup. Reading only the payload put two different
+  // coders on one screen — banner "gemma3:27b", bar "gemma4-quadro-49k:latest" — with the BAR
+  // right, which is the worse way round: the header is what you read first.
+  //
+  // Only possible since the pick started surviving an exit; before that the override was always
+  // empty at startup and the two could not disagree.
+  const pick = String(override ?? "").trim();
+  if (pick) return pick;
+  if (p.codingModelId) return String(p.codingModelId);
+  const name = String(p.codingKeyMissing ? p.codingKeyModel || "" : "").trim();
+  if (!name) return dim("—");
+  // A keyless host is never asked for anything — the prompt stores the placeholder itself and
+  // the coder is live moments later, so "(needs a key)" would be a lie with a shelf life of
+  // about one line.
+  if (isKeylessCodingHost(p.codingKeyUrl)) return name;
+  return name + dim(" (needs a key)");
+}
+
+/**
+ * What the worker should log when the key a turn asked for was NOT the key it got (#222, #223).
+ *
+ * Returns "" when nothing needs saying.
+ *
+ * WHY THIS IS A FUNCTION AND NOT AN INLINE TEMPLATE. There are three outcomes and they need
+ * three different sentences, because they need three different actions from the reader:
+ *
+ *   · the key was DELETED since this folder picked it  → pick one again
+ *   · the key belongs to ANOTHER PROVIDER and was refused → add a key for THIS provider
+ *   · nothing eligible existed at all → the turn has no coder; it fell back to the chat model
+ *
+ * Saying "is gone" for the second sends someone hunting for a key that is sitting in their list,
+ * perfectly intact. Reporting a fallback "to " with nothing after it, for the third, reads as a
+ * bug in the message rather than a fact about the turn.
+ *
+ * IT MUST NOT BE SILENT in any of the three. A turn that quietly runs on a different key than the
+ * one chosen is a bill with no explanation, which is the whole reason the id is recorded per job.
+ */
+export function codingKeyFallbackLine(kj, jobId = "") {
+  if (!kj?.fellBack) return "";
+  const asked = String(kj.requestedKeyId ?? "") || "?";
+  const used = String(kj.keyId ?? "");
+  const why =
+    kj.reason === "other-provider" ? "is for a different coding provider" : "is gone";
+  const to = used
+    ? `falling back to ${used}`
+    : "no key for this provider — the coder will fall back to the chat model";
+  return `[gu-worker]${jobId ? ` job ${jobId}:` : ""} coding key ${asked} ${why} — ${to}`;
+}
+
+/**
+ * SHOULD STARTUP WARN THAT NOBODY CHOSE A KEY? — the decision, extracted so it can be TESTED.
+ *
+ * Asked for after the bug it guards against: "can we have a test tool to make sure this issue
+ * will not happen again … in case later i accidentally modify your code of this fix".
+ *
+ * The reported failure was a folder running an OpenAI coder while silently using the FIRST key on
+ * the account — the old ollama.com one — because nothing had ever chosen a key there and no
+ * screen said so. Guarding that with a regex over gu-repl.mjs would pin the WORDING, not the
+ * conduct: reword the line and the test fails for nothing; delete the call and leave a similar
+ * string behind and it passes while the warning is gone. So the rule lives here, in a function
+ * that can be called with arguments and checked.
+ *
+ * Returns { warn, using, why } — `using` is the key that will be used, `why` names the case:
+ *   ""            nothing to say
+ *   "none-chosen" several keys stored, this folder picked none, the first one wins by ordering
+ *
+ * Silent when the coder needs NO key, when nothing is stored (a different prompt handles that),
+ * when a choice HAS been made, and when only one key exists — with one there is nothing to
+ * choose, and a warning on a correct setup is how warnings stop being read.
+ */
+export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys = null } = {}) {
+  const quiet = { warn: false, using: null, why: "" };
+  if (codingKind !== "openai") return quiet; // Ollama and local MLX need no credential
+  if (!Array.isArray(keys) || keys.length < 2) return quiet;
+  if (String(selectedKeyId ?? "").trim()) return quiet;
+  return { warn: true, using: keys[0], why: "none-chosen" };
+}
+
+/**
+ * WHICH CODER IS THIS FOLDER ACTUALLY ON? — the account default is not the answer.
+ *
+ * REPORTED: the bar's "key not chosen" mark only appeared after running /model. The startup gate
+ * read `payload.codingKind`, and a payload fetched with NO override describes the ACCOUNT DEFAULT
+ * — on the reporting machine that was kimi-k3 at ollama.com, kind "ollama", which needs no key —
+ * while the folder was pointed at gpt-5, kind "openai". So the check answered a question about a
+ * coder the folder was not using, said "nothing to warn about", and stayed silent. /model looked
+ * right because it re-probes WITH the override.
+ *
+ * The folder's pick is in `sessionCodingModel`, and `codingChoices` already carries the kind of
+ * each — the startup path validates the pick against that same list a few lines earlier. So the
+ * answer needs no extra request, only the right question.
+ *
+ * Matched by id OR by bare model name, mirroring that validation: a session saved before ids were
+ * qualified ("<kind>::<model>", task #123) stores the bare form and is still a valid pick.
+ */
+export function effectiveCoderKind({
+  sessionCodingModel = "",
+  choices = null,
+  defaultKind = "",
+} = {}) {
+  const want = String(sessionCodingModel ?? "").trim();
+  const list = Array.isArray(choices) ? choices : [];
+  if (want) {
+    const hit = list.find((c) => c?.id === want || c?.model === want);
+    // A pick that matches nothing means the list could not be read, or the pick is stale and is
+    // about to be cleared by the caller — either way the account default is the honest fallback.
+    if (hit) return String(hit.kind ?? "");
+  }
+  return String(defaultKind ?? "");
+}