@tiens.nguyen/gu-cli 1.0.694 → 1.0.696

package/accent.mjs

@@ -0,0 +1,99 @@
+/**
+ * THE BRAND COLOUR, IN A TERMINAL.
+ *
+ * gu's accent was ANSI cyan — one of the original sixteen colours, chosen when the only question
+ * was "which of these eight-ish names looks least bad". The web app has a real palette now, built
+ * around indigo, and the terminal is the face of this product people see every day: two different
+ * accents makes them look like two different programs.
+ *
+ * THE COLOUR IS #a5b4fc — the web app's --accent-fg, the same token that paints the block wordmark
+ * on the landing page. Not --accent (#6366f1): that one is a BUTTON FILL, and as text on a dark
+ * terminal it is too dark to read comfortably. The web app makes exactly the same distinction.
+ *
+ * WHICH IS A PROBLEM, BECAUSE TERMINALS DISAGREE ABOUT COLOUR. There is no "purple" to ask for —
+ * there are three separate mechanisms, and a terminal supports one of them:
+ *
+ *   24-bit    \x1b[38;2;165;180;252m   the exact colour. iTerm2, VS Code, Windows Terminal,
+ *                                      kitty, alacritty, most modern emulators.
+ *   256       \x1b[38;5;147m           the nearest cell of the xterm cube (#afafff). Apple's
+ *                                      Terminal.app is here — it has never supported 24-bit.
+ *   16        \x1b[35m                 magenta, the only purple the original palette has. Old
+ *                                      terminals, CI logs, anything reporting a TERM it cannot
+ *                                      back up.
+ *
+ * Sending a 24-bit sequence to a terminal that does not understand it does not degrade — some
+ * print the escape as text, across the banner. So the capability is detected rather than assumed,
+ * and the fallbacks are deliberate rather than accidental.
+ *
+ * ESCAPE HATCHES, because a colour is a preference and someone will hate this one:
+ *   NO_COLOR=1        no colour at all (the standard; https://no-color.org)
+ *   GU_ACCENT=cyan    the old cyan, exactly as it was
+ *   GU_ACCENT=off     same as NO_COLOR, for people who only want gu quiet
+ */
+
+/** The web app's --accent-fg. Keep in step with web-v2/src/App.css. */
+export const ACCENT_RGB = [165, 180, 252];
+/** The nearest xterm-256 cube cell: #afafff. */
+export const ACCENT_256 = 147;
+
+export const TRUECOLOR = `\x1b[38;2;${ACCENT_RGB.join(";")}m`;
+export const COLOR_256 = `\x1b[38;5;${ACCENT_256}m`;
+export const COLOR_16 = "\x1b[35m";
+export const CYAN = "\x1b[36m";
+export const RESET = "\x1b[0m";
+
+/**
+ * The escape sequence this environment should get, or "" for no colour.
+ *
+ * Pure, and takes the environment, so every branch is testable — the alternative is a colour
+ * nobody can check without owning six terminal emulators.
+ */
+export function accentPrefix(env = process.env) {
+  const pref = String(env.GU_ACCENT ?? "").trim().toLowerCase();
+  if (pref === "off" || pref === "none") return "";
+  if (pref === "cyan") return CYAN;
+  // NO_COLOR: "when present and not an empty string, regardless of its value".
+  if (env.NO_COLOR != null && String(env.NO_COLOR) !== "") return "";
+
+  const term = String(env.TERM ?? "").toLowerCase();
+  if (term === "dumb") return "";
+
+  const colorterm = String(env.COLORTERM ?? "").trim().toLowerCase();
+  if (colorterm === "truecolor" || colorterm === "24bit") return TRUECOLOR;
+  // Windows Terminal supports 24-bit but sets neither TERM nor COLORTERM.
+  if (env.WT_SESSION) return TRUECOLOR;
+  if (/truecolor|direct/.test(term)) return TRUECOLOR;
+  if (term.includes("256color")) return COLOR_256;
+
+  // Everything else — including a TERM we have never heard of, and Windows consoles that report
+  // nothing — gets the sixteen-colour magenta. It is the conservative answer: every terminal that
+  // renders colour at all renders this one.
+  return COLOR_16;
+}
+
+/** Which mechanism was chosen. For `gu doctor`-style reporting, and for the tests. */
+export function accentMode(env = process.env) {
+  const prefix = accentPrefix(env);
+  if (prefix === "") return "none";
+  if (prefix === TRUECOLOR) return "truecolor";
+  if (prefix === COLOR_256) return "256";
+  if (prefix === CYAN) return "cyan";
+  return "16";
+}
+
+/**
+ * Wrap a string in the accent colour.
+ *
+ * Resolved ONCE at module load, like the colour helpers it replaces: these are called thousands of
+ * times while drawing a frame, and re-reading the environment for each would be work done to answer
+ * a question that cannot change.
+ */
+const PREFIX = accentPrefix();
+export function accent(s) {
+  return PREFIX ? `${PREFIX}${s}${RESET}` : String(s);
+}
+
+/** Bold accent — the startup banner's name. */
+export function accentBold(s) {
+  return PREFIX ? `\x1b[1m${PREFIX}${s}${RESET}` : String(s);
+}

package/client-expert-run.mjs

@@ -74,7 +74,8 @@ async function fetchOllamaTags(url) {
 
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
 const bold = (s) => `\x1b[1m${s}\x1b[0m`;
-const cyan = (s) => `\x1b[36m${s}\x1b[0m`;
+// The brand accent, shared with the REPL — see accent.mjs.
+import { accent as cyan } from "./accent.mjs";
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 const red = (s) => `\x1b[31m${s}\x1b[0m`;
 

package/coding-key-prompt.mjs

@@ -52,6 +52,34 @@ export function isKeylessCodingHost(url) {
   return host === "gomarsic.cc" || host.endsWith(".gomarsic.cc");
 }
 
+/**
+ * TRUE only for the Ollama CLOUD (https://ollama.com, or a subdomain of it). Mirrors
+ * isOllamaCloudUrl in api/src/store/settingsTypes.ts, web/src/lib/coderChoices.mjs and
+ * _isOllamaCloudUrl in gu-cli.mjs — keep them in step.
+ */
+export function isOllamaCloudUrl(url) {
+  const v = String(url ?? "").trim();
+  if (!/^https:\/\//i.test(v)) return false;
+  let host;
+  try {
+    host = new URL(v).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  return host === "ollama.com" || host.endsWith(".ollama.com");
+}
+
+/**
+ * DOES THIS CODER NEED AN API KEY? — an OpenAI-compatible provider, or Ollama's paid CLOUD.
+ *
+ * Reported: /model on kimi-k3 at https://ollama.com said "needs no API key — nothing to set", so
+ * there was no way to give it one. Every "needs a key" check had been `kind === "openai"`, on the
+ * belief that Ollama never authenticates — true of a local or LAN Ollama, false of ollama.com.
+ */
+export function codingNeedsKey(kind, url) {
+  return kind === "openai" || (kind === "ollama" && isOllamaCloudUrl(url));
+}
+
 /**
  * @param payload  the /agent-payload `payload` object (reads codingKeyMissing/codingKeyModel).
  * @param deps.askSecret  async (prompt) => string  — masked input; "" means the user skipped.
@@ -187,9 +215,10 @@ export function codingKeyFallbackLine(kj, jobId = "") {
  * when a choice HAS been made, and when only one key exists — with one there is nothing to
  * choose, and a warning on a correct setup is how warnings stop being read.
  */
-export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys = null } = {}) {
+export function unchosenKeyWarning({ codingKind = "", codingUrl = "", selectedKeyId = "", keys = null } = {}) {
   const quiet = { warn: false, using: null, why: "" };
-  if (codingKind !== "openai") return quiet; // Ollama and local MLX need no credential
+  // Local Ollama and MLX need no credential; the Ollama cloud does.
+  if (!codingNeedsKey(codingKind, codingUrl)) return quiet;
   if (!Array.isArray(keys) || keys.length < 2) return quiet;
   if (String(selectedKeyId ?? "").trim()) return quiet;
   return { warn: true, using: keys[0], why: "none-chosen" };
@@ -200,7 +229,8 @@ export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys =
  *
  * REPORTED: the bar's "key not chosen" mark only appeared after running /model. The startup gate
  * read `payload.codingKind`, and a payload fetched with NO override describes the ACCOUNT DEFAULT
- * — on the reporting machine that was kimi-k3 at ollama.com, kind "ollama", which needs no key —
+ * — on the reporting machine kimi-k3 at ollama.com, kind "ollama" (which, it turned out later,
+ * DOES need a key: see codingNeedsKey) —
  * while the folder was pointed at gpt-5, kind "openai". So the check answered a question about a
  * coder the folder was not using, said "nothing to warn about", and stayed silent. /model looked
  * right because it re-probes WITH the override.
@@ -212,6 +242,17 @@ export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys =
  * Matched by id OR by bare model name, mirroring that validation: a session saved before ids were
  * qualified ("<kind>::<model>", task #123) stores the bare form and is still a valid pick.
  */
+/** The folder's coder — its kind AND its URL, which together decide whether it needs a key. */
+export function effectiveCoder({ sessionCodingModel = "", choices = null, defaultKind = "", defaultUrl = "" } = {}) {
+  const want = String(sessionCodingModel ?? "").trim();
+  const list = Array.isArray(choices) ? choices : [];
+  if (want) {
+    const hit = list.find((c) => c?.id === want || c?.model === want);
+    if (hit) return { kind: String(hit.kind ?? ""), url: String(hit.url ?? "") };
+  }
+  return { kind: String(defaultKind ?? ""), url: String(defaultUrl ?? "") };
+}
+
 export function effectiveCoderKind({
   sessionCodingModel = "",
   choices = null,

package/gonext_agent_chat.py

@@ -9707,9 +9707,9 @@ def run_agent_chat(cfg):
                             raise _AgentConfigError(
                                 f"The agent coding backend ({_host}) rejected the request: "
                                 "NO coding API key was sent, so the local agent key was "
-                                "used instead. Set 'Coding backend' to OpenAI-compatible "
-                                "in Settings → Agent and enter the API key — the key field "
-                                "only appears once that backend is selected."
+                                "used instead. Enter the API key in Settings → Agent for "
+                                "this coding backend (OpenAI-compatible, or Ollama with an "
+                                "https://ollama.com URL — local Ollama needs no key)."
                             ) from e
                         if "404" in emsg and "not found" in emsg.lower():
                             # Probe with the CODING key when there is one: using the agent

package/gu-cli.mjs

@@ -12,13 +12,15 @@
 // FIRST, before anything that could itself fail on an old runtime: npm only WARNS about
 // `engines`, so an unsupported Node installs fine and then breaks somewhere unrelated.
 import { requireSupportedNode } from "./node-version.mjs";
+// The brand accent, shared with the REPL — see accent.mjs.
+import { accent } from "./accent.mjs";
 requireSupportedNode();
 import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { execFile as execFileCallback, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createTaskPool, createFolderQueue } from "./job-pools.mjs";
 import { ragJobConfig } from "./rag-job-config.mjs";
-import { codingKeyFallbackLine } from "./coding-key-prompt.mjs";
+import { codingKeyFallbackLine, isOllamaCloudUrl } from "./coding-key-prompt.mjs";
 // Pure layout helpers — safe to import here (no side effects on load, unlike gu-repl.mjs).
 // Shared so the mid-run picker and the REPL's post-stop advice cannot word the same budget
 // differently.
@@ -1207,7 +1209,7 @@ if (
   // shared ones, and `node --check` cannot see a missing helper — it is a syntax checker, not a
   // resolver. That precise shape has crashed this CLI before.
   const bold = (t) => `\x1b[1m${t}\x1b[0m`;
-  const cyan = (t) => `\x1b[36m${t}\x1b[0m`;
+  const cyan = (t) => accent(t);
   const red = (t) => `\x1b[31m${t}\x1b[0m`;
   const dim = (t) => `\x1b[2m${t}\x1b[0m`;
   console.log("\n" + bold("proxy") + dim("  — can this machine route model calls through a proxy?\n"));
@@ -1238,7 +1240,7 @@ if (args[0] === "rag" && (args.includes("--test") || args[1] === "test")) {
   // cannot see a missing one — it is a syntax checker, not a resolver. That exact shape has
   // crashed this CLI before.
   const bold = (t) => `\x1b[1m${t}\x1b[0m`;
-  const cyan = (t) => `\x1b[36m${t}\x1b[0m`;
+  const cyan = (t) => accent(t);
   const red = (t) => `\x1b[31m${t}\x1b[0m`;
   const dim = (t) => `\x1b[2m${t}\x1b[0m`;
   console.log("\n" + bold("rag") + dim("  — can this machine embed and retrieve?\n"));
@@ -3263,6 +3265,9 @@ function _isLocalCodingUrl(baseURL) {
   return !host.includes(".") && !host.includes(":");
 }
 
+/** The Ollama cloud check lives in coding-key-prompt.mjs, shared with the terminal. */
+const _isOllamaCloudUrl = isOllamaCloudUrl;
+
 /** Resolve to "ollama" | "openai" | "local". `kind` is the user's Settings choice
  *  ("ollama" | "openai" | "" = Auto). Only Auto costs a probe. */
 async function resolveCodingBackend(kind, baseURL) {
@@ -3445,7 +3450,9 @@ async function runAgentChatJob(job) {
   // anything else that endpoint doesn't exist, and on a cloud one we'd be pinging a paid
   // API every 4 minutes (which an Auto+cloud config did until #117 was fixed — the old
   // gate only skipped an EXPLICIT openai kind).
-  if (codingBackend === "ollama") {
+  // ...and NOT for the Ollama CLOUD (https://ollama.com): that is a paid API, so the
+  // keep-warm ping must not run against it — same rule as the key fetch below.
+  if (codingBackend === "ollama" && !_isOllamaCloudUrl(payload?.codingBaseURL)) {
     trackCodingModelForWarmup(payload?.codingBaseURL ?? "", payload?.codingModelId ?? "");
   }
 
@@ -3598,7 +3605,9 @@ async function runAgentChatJob(job) {
     // "openai" kind, and python's `coding_api_key or agent_api_key` fallback then
     // authenticated a cloud provider with the LOCAL agent key → 401.
     let codingApiKey = "";
-    if (codingBackend === "openai") {
+    // Ollama has no auth — EXCEPT the Ollama cloud (https://ollama.com), which requires a
+    // key like any other paid endpoint. A local/LAN Ollama gets no key (and ignores one).
+    if (codingBackend === "openai" || (codingBackend === "ollama" && _isOllamaCloudUrl(payload?.codingBaseURL))) {
       try {
         // NAME THE JOB (task #222 phase 2). Two turns run concurrently by default
         // (agentConcurrency = 2), and each may have chosen a different key — so the key is

package/gu-repl.mjs

@@ -133,6 +133,10 @@ import { createHoverController, applyToggleShift } from "./terminal-hover.mjs";
 // The required pair, imported rather than re-typed: the startup "no models" message names them,
 // and a second copy of these strings would drift from the check that enforces them.
 import { REQUIRED_AGENT_MODEL, REQUIRED_AGENT_PREFIX, REQUIRED_EMBED_MODEL } from "./ollama-setup.mjs";
+// The brand accent — indigo, the same token the web app paints its wordmark with. It is NOT a
+// plain SGR code: terminals disagree about colour, so accent.mjs picks 24-bit, 256 or the
+// sixteen-colour magenta from what this one actually claims to support.
+import { accent } from "./accent.mjs";
 import {
   createTranscript,
   displayRows,
@@ -169,7 +173,6 @@ const WS_FILE = join(homedir(), ".gonext", "workspaces.json");
 const SESSIONS_DIR = join(homedir(), ".gonext", "sessions");
 
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
-const cyan = (s) => `\x1b[36m${s}\x1b[0m`;
 const red = (s) => `\x1b[31m${s}\x1b[0m`;
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 const white = (s) => `\x1b[37m${s}\x1b[0m`;
@@ -327,11 +330,11 @@ const renderBanner = (statusRows) => {
   if (GUTTER.length + LOGO_W + gap.length + widest <= cols) {
     const n = Math.max(LOGO.length, statusRows.length);
     for (let i = 0; i < n; i++) {
-      const left = i < LOGO.length ? cyan(LOGO[i].padEnd(LOGO_W)) : " ".repeat(LOGO_W);
+      const left = i < LOGO.length ? accent(LOGO[i].padEnd(LOGO_W)) : " ".repeat(LOGO_W);
       out.push(GUTTER + left + gap + (statusRows[i] ?? ""));
     }
   } else {
-    for (const r of LOGO) out.push(GUTTER + cyan(r));
+    for (const r of LOGO) out.push(GUTTER + accent(r));
     for (const r of statusRows) out.push(GUTTER + clipVisible(r, cols - 1 - GUTTER.length));
   }
   return out.join("\n");
@@ -503,7 +506,7 @@ const brightText = (s) => s; // default terminal colour (un-dimmed) — the "pop
 // forward reference here is a startup crash, not a lint warning.
 const BULLET_STYLE = {
   fail: { mark: CROSS, markColor: red, textColor: brightText },
-  ok: { mark: CHECK, markColor: cyan, textColor: dim },
+  ok: { mark: CHECK, markColor: accent, textColor: dim },
   info: { mark: BULLET, markColor: dim, textColor: dim },
 };
 const classifyBullet = (text) => BULLET_STYLE[bulletKind(text)];
@@ -536,7 +539,7 @@ const cliVerdict = classifyCliArg(argv, CLI_SUBCOMMANDS);
 if (cliVerdict.kind === "unknown") {
   console.error(red(`gu: unknown command "${cliVerdict.typed}"`));
   if (cliVerdict.suggestion) {
-    console.error(cyan(`  did you mean:  gu ${cliVerdict.suggestion}`));
+    console.error(accent(`  did you mean:  gu ${cliVerdict.suggestion}`));
   }
   console.error(dim(`  commands:  ${CLI_SUBCOMMANDS.join(" · ")}`));
   console.error(dim("  gu --help   what each one does  ·  gu   (no command) opens the agent"));
@@ -625,7 +628,7 @@ if (!workerKey || !apiBase) {
         output: process.stdout,
       });
       const ask0 = (q) =>
-        new Promise((res) => rl0.question(cyan(q), (a) => res(String(a || ""))));
+        new Promise((res) => rl0.question(accent(q), (a) => res(String(a || ""))));
       let typed = "";
       // Set when Client Expert setup stops on something the user must do first: the run ends
       // after the instructions instead of continuing into questions that assume a paired,
@@ -739,7 +742,7 @@ if (!workerKey || !apiBase) {
   } else {
     console.error(
       red("gu: no worker key / API base found.") +
-        `\nRun ${cyan("gu-cli login")} to sign in, or configure manually:` +
+        `\nRun ${accent("gu-cli login")} to sign in, or configure manually:` +
         "\n  gu-cli set <workerKey> --api-base https://chat-api-v2.gomarsic.cc"
     );
     process.exit(1);
@@ -820,8 +823,8 @@ function hintRows(cmds, sel) {
   cmds.forEach((c, i) => {
     const label = c.usage ?? c.name;
     const alias = c.aliases?.length ? dim(` (${c.aliases.join(", ")})`) : "";
-    const body = `${cyan(label)}${alias}${dim(" — " + c.desc)}`;
-    rows.push(i === sel ? `${cyan("❯")} ${bold(body)}` : `  ${body}`);
+    const body = `${accent(label)}${alias}${dim(" — " + c.desc)}`;
+    rows.push(i === sel ? `${accent("❯")} ${bold(body)}` : `  ${body}`);
   });
   return rows;
 }
@@ -1329,7 +1332,7 @@ if (IS_TTY) {
 // the user's typed input lands on the SAME text column (GUTTER+1) as the agent's bullets and
 // answer. ">> " is exactly GUTTER-wide, so input aligns; the ">>" right-edge sits at the same
 // column the ● / ✓ / ✗ markers hang at (markers right-aligned in the margin, text in one column).
-const PROMPT = cyan(">> ");
+const PROMPT = accent(">> ");
 // …and once a question has been SUBMITTED, its marker recedes to grey. Cyan then means exactly
 // one thing on screen — "this is the line you are typing" — while the questions already asked
 // are history, the same way completed actions dim (see the UI hierarchy in #41/#115).
@@ -1748,7 +1751,7 @@ const ragSegmentText = () => {
     // one's. Showing it bright would claim the current prompt has been measured when it has
     // not; showing nothing would put a misleading 0 there. Dim says "last known".
     if (b.stale) return dim(" · rag ") + dim(`${fmtTokens(b.rag)} ${pct}%·`) + lexSeg;
-    return dim(" · rag ") + cyan(`${fmtTokens(b.rag)} ${pct}%`) + lexSeg;
+    return dim(" · rag ") + accent(`${fmtTokens(b.rag)} ${pct}%`) + lexSeg;
   }
   // A STATE, NOT A MEASUREMENT — and states are verbose-only (user, 2026-09-05: "we need to
   // hide rag - not indexed, only show if user go with gu --verbose").
@@ -1853,7 +1856,7 @@ function announceCliUpdate() {
   cliNoticeShown = true;
   console.log("");
   for (const l of lines) {
-    if (l.kind === "head") console.log(cyan("  ⭯ " + l.text));
+    if (l.kind === "head") console.log(accent("  ⭯ " + l.text));
     else if (l.kind === "cmd") console.log("    " + l.text);
     else console.log(dim("    " + l.text));
   }
@@ -1909,7 +1912,7 @@ async function runUpdate() {
             r.stderr ? ` — ${String(r.stderr).trim().split("\n").slice(-1)[0]}` : ""}`);
         }
       });
-      console.log(cyan(`  ✓ API updated to ${api}\n`));
+      console.log(accent(`  ✓ API updated to ${api}\n`));
       availableUpdates = { ...availableUpdates, api: "", any: Boolean(availableUpdates.cli) };
     } else {
       await withPendingStatus(`updating gu to ${cli}`, async () => {
@@ -1930,7 +1933,7 @@ async function runUpdate() {
       });
       // NOT "updated" — the files changed, THIS process did not. Claiming otherwise is the one
       // way this feature could lie to someone.
-      console.log(cyan(`  ✓ gu ${cli} installed`) +
+      console.log(accent(`  ✓ gu ${cli} installed`) +
                   dim(` — ${updateRestartNote()}\n`));
       availableUpdates = { ...availableUpdates, cli: "", any: Boolean(availableUpdates.api) };
     }
@@ -1978,7 +1981,7 @@ const identityLineText = () =>
       folder: folderLabel(),
       keyUnchosen: keyChoicePending,
     },
-    { orange, cyan, dim, red },
+    { orange, cyan: accent, dim, red },
   );
 
 const tokenLineText = () => {
@@ -2015,10 +2018,10 @@ const tokenLineText = () => {
     // `ctx` and `sent`, which do drive decisions, need more.
     ragSegmentText() +
     dim(" · ") +
-    cyan(`↓ out ${fmtTokens(lastTurnOutputTokens)}`) +
+    accent(`↓ out ${fmtTokens(lastTurnOutputTokens)}`) +
     dim(" · ") +
     dim("total ") +
-    cyan(`↓ ${fmtTokens(Math.max(globalOutputTokens, lastTurnTotalOutput))}`)
+    accent(`↓ ${fmtTokens(Math.max(globalOutputTokens, lastTurnTotalOutput))}`)
   );
 };
 // The newest RAG index file the agent reported writing (task #136), and where it lives.
@@ -2034,7 +2037,7 @@ const ragLineText = () => {
   const parts = lastRagFile.split("/").filter(Boolean);
   const shortName = parts.slice(-2).join("/") || lastRagFile;
   return (
-    dim("rag · wrote ") + (isS3 ? cyan(`s3:…/${shortName}`) : shortName) +
+    dim("rag · wrote ") + (isS3 ? accent(`s3:…/${shortName}`) : shortName) +
     dim(isS3 ? "  (cloud)" : "  (local)")
   );
 };
@@ -2146,7 +2149,7 @@ function frozenZone() {
   const zone = inputZoneRows({
     headControl,
     width,
-    prompt: secretInput && secretPrompt ? cyan(secretPrompt) : inlinePrompt ? cyan(inlinePrompt) : PROMPT,
+    prompt: secretInput && secretPrompt ? accent(secretPrompt) : inlinePrompt ? accent(inlinePrompt) : PROMPT,
     // WHILE A SECRET IS OPEN, THIS ROW IS THE PROMPT — "kimi-k3 API key: ••••" rather than
     // ">> ••••". Same row, same masking; what changes is that it now says what it wants. The
     // width is measured, not assumed: the label is caller-supplied and every offset in here
@@ -2199,11 +2202,11 @@ function frozenZone() {
   agentsRowTarget = null;
   if (scrolledBack()) {
     const hint = jumpToBottomRow({ below: scrollOffset, width });
-    rows[sep] = clipVisible(cyan(hint.text), width - 1);
+    rows[sep] = clipVisible(accent(hint.text), width - 1);
   } else if (availableUpdates.any) {
     const up = updateRow({ ...availableUpdates, width });
     if (up) {
-      rows[sep] = clipVisible(dim(up.text.slice(0, up.from)) + cyan(up.text.slice(up.from)), width - 1);
+      rows[sep] = clipVisible(dim(up.text.slice(0, up.from)) + accent(up.text.slice(up.from)), width - 1);
       updateRowTarget = { from: up.from, to: up.to };
     }
   } else if (agentsIndicator(otherAgents)) {
@@ -2216,7 +2219,7 @@ function frozenZone() {
     const len = visibleLen(label);
     if (len + 4 <= width - 1) {
       const from = width - 1 - len;
-      rows[sep] = clipVisible(dim("\u2500".repeat(Math.max(0, from - 1)) + " ") + cyan(label), width - 1);
+      rows[sep] = clipVisible(dim("\u2500".repeat(Math.max(0, from - 1)) + " ") + accent(label), width - 1);
       agentsRowTarget = { from, to: from + len };
     }
   }
@@ -2904,7 +2907,7 @@ function paintCopyBadge(row, place, ok = true) {
   //
   // \x1b7/\x1b8 is the ONE save slot the whole REPL shares — the output caret lives in it
   // (task #141) — so this moves and returns explicitly instead of borrowing it.
-  ui(`\x1b[${row};${place.col}H` + (ok ? cyan(place.text) : dim(place.text)));
+  ui(`\x1b[${row};${place.col}H` + (ok ? accent(place.text) : dim(place.text)));
   paintBar(); // put the caret back on the input line
   if (copyBadgeTimer) clearTimeout(copyBadgeTimer);
   copyBadgeTimer = setTimeout(() => {
@@ -4014,12 +4017,12 @@ async function ensureWorkspace() {
   wsSync = { enabled: allowSync, name: basename(cwd), path: cwd, run: allowRun };
   console.log(
     GUTTER +
-      cyan(`✓ workspace registered: ${basename(cwd)}`) +
-      (allowRun ? cyan(" (run-commands enabled)") : dim(" (run-commands disabled)")) +
+      accent(`✓ workspace registered: ${basename(cwd)}`) +
+      (allowRun ? accent(" (run-commands enabled)") : dim(" (run-commands disabled)")) +
       (isClientExpert()
         ? ""
         : allowSync
-          ? cyan(workspaceSyncLabel({ allowSync, clientExpert: false }))
+          ? accent(workspaceSyncLabel({ allowSync, clientExpert: false }))
           : dim(workspaceSyncLabel({ allowSync, clientExpert: false })))
   );
 }
@@ -4676,7 +4679,7 @@ async function runModelDoctor() {
   console.log(
     "\n" + GUTTER +
       (bad.length === 0
-        ? cyan("✓ every configured model answered.")
+        ? accent("✓ every configured model answered.")
         : red(`✗ ${bad.length} of ${results.length} did not answer.`)) +
       "\n"
   );
@@ -4944,7 +4947,7 @@ async function reconfigureOllamaServer() {
     if (g !== null) globalOutputTokens = g;
   }
   paintBar(); // …and show all of it now, not at the next keystroke
-  console.log(cyan("  ✓ models saved"));
+  console.log(accent("  ✓ models saved"));
   if (agent) {
     console.log(dim(`      chat   ${chat}  @ ${agent.normalized.host}`));
     console.log(dim(`      RAG    ${os.REQUIRED_EMBED_MODEL}  @ ${agent.normalized.host}`));
@@ -5221,7 +5224,7 @@ async function changeProviderModel(ps, rows, p) {
     await saveSessionCoding(resolve(process.cwd()));
     console.log(GUTTER + dim("this folder's pick named the old model — cleared it."));
   }
-  console.log(cyan(`  ✓ ${p.host} → ${model}`) + dim("  ·  pick it in /model\n"));
+  console.log(accent(`  ✓ ${p.host} → ${model}`) + dim("  ·  pick it in /model\n"));
 }
 
 /** Point a provider at a different URL, keeping its id so saved picks still resolve. */
@@ -5258,7 +5261,7 @@ async function changeProviderUrl(ps, rows, p) {
   }
   // The KEY still belongs to this row, because the row id did not change — which is the whole
   // reason an id is not derived from the URL.
-  console.log(cyan(`  ✓ ${p.host} → ${r.host}`) + dim("  ·  its key still applies\n"));
+  console.log(accent(`  ✓ ${p.host} → ${r.host}`) + dim("  ·  its key still applies\n"));
 }
 
 /** Remove a provider, and the keys that would be stranded by its removal. */
@@ -5314,7 +5317,7 @@ async function removeCodingProvider(ps, rows, p) {
     console.log(GUTTER + dim("this folder was using it — cleared the pick.\n"));
   }
   console.log(
-    cyan(`  ✓ removed ${p.host}`) +
+    accent(`  ✓ removed ${p.host}`) +
       (stranded.length ? dim(`  ·  ${deleted} key${deleted === 1 ? "" : "s"} deleted`) : "") +
       "\n"
   );
@@ -5622,7 +5625,7 @@ async function addCodingProvider(roleName = "coding") {
       console.log(GUTTER + dim("run /agent-model to finish, or check the API is reachable.\n"));
       return;
     }
-    console.log(cyan(`  ✓ agent model → ${model}`) + dim(`  · ${host}`));
+    console.log(accent(`  ✓ agent model → ${model}`) + dim(`  · ${host}`));
     console.log(dim(`    API key ${name || "Unknown"} ····${secret.slice(-4)}  ·  this machine\n`));
     // Restart advice, because the banner and the running daemon both read this at startup: a
     // machine that keeps talking to the old model after a successful save looks like the save
@@ -5692,7 +5695,7 @@ async function addCodingProvider(roleName = "coding") {
   // The key question for this coder is now answered — leaving the flag set would warn about a
   // key that was just entered, which reads as the save having failed.
   codingKeyMissingKnown = false;
-  console.log(cyan(`  ✓ coding model → ${model}`) + dim(`  · ${host}`));
+  console.log(accent(`  ✓ coding model → ${model}`) + dim(`  · ${host}`));
   console.log(dim(`    API key ${name || "Unknown"} ····${secret.slice(-4)}  ·  this folder only\n`));
   // A HOSTED PROVIDER NEEDS ITS WINDOW SET (requirement 11). With nothing set gu assumes
   // 24,000 prompt tokens and compacts there — on a large hosted model that throws history away
@@ -5826,7 +5829,7 @@ async function chooseModel() {
   await saveSessionCoding(resolve(process.cwd()));
   const where = showTag ? ` (${tags[idx]})` : "";
   console.log(
-    cyan(`  ✓ coding model → ${chosen.model}${where}${chosen.id === def ? " (default)" : ""}\n`)
+    accent(`  ✓ coding model → ${chosen.model}${where}${chosen.id === def ? " (default)" : ""}\n`)
   );
   // DOES THIS ONE NEED AN API KEY? (task #181) Reported live on Windows 11 / Client Expert:
   // picking kimi-k3 here and asking a question just span — the coder needs a key, none was
@@ -5870,7 +5873,7 @@ async function chooseModel() {
       host: ks.provider,
     });
     console.log(
-      dim("    API key ") + cyan(line.text) +
+      dim("    API key ") + accent(line.text) +
         (line.note ? orange(`  ·  ${line.note}`) : "") +
         dim(`  ·  ctrl+k to ${line.verb} it`)
     );
@@ -5928,7 +5931,7 @@ async function chooseEmbedModel() {
   console.log(dim(`  Choose the embedder  (${PICK_HINT}):`));
   const labels = rows.map(
     (r) => `${r.model}${r.dims ? dim(`  · ${r.dims}d`) : ""}${dim(`  · ${r.note}`)}` +
-      (r.current ? cyan("  (current)") : "")
+      (r.current ? accent("  (current)") : "")
   );
   const idx = await pickFromList(labels, Math.max(0, rows.findIndex((r) => r.current)));
   if (idx < 0) {
@@ -5966,7 +5969,7 @@ async function chooseEmbedModel() {
     console.log(red(`  couldn't save that to your account — still using ${current}.\n`));
     return;
   }
-  console.log(cyan(`  ✓ embedding model → ${chosen}`));
+  console.log(accent(`  ✓ embedding model → ${chosen}`));
   if (plan.stale.length) {
     console.log(
       dim(`    ${plan.stale.length} knowledge base${plan.stale.length === 1 ? "" : "s"} ` +
@@ -6073,7 +6076,7 @@ async function chooseAgentModel() {
       // "· an embedding model · embedding model, not for chat".
       (!r.note && r.embedder ? dim("  · embedding model, not for chat") : "") +
       (r.missing ? dim("  · not on the box any more") : "") +
-      (r.current ? cyan("  (current)") : "")
+      (r.current ? accent("  (current)") : "")
     );
   });
   // APPENDED LAST, after every model, for the reason #223 records: a new entry must never shift
@@ -6125,7 +6128,7 @@ async function chooseAgentModel() {
     console.log(GUTTER + dim("`gu api restart` to pick up the current version.\n"));
     return;
   }
-  console.log(cyan(`  ✓ agent model → ${chosen}`));
+  console.log(accent(`  ✓ agent model → ${chosen}`));
   console.log(dim("    takes effect on your next question.\n"));
 }
 
@@ -6222,7 +6225,7 @@ async function runContextWindowCommand(line) {
       console.log(GUTTER + dim(`  set by GONEXT_CODING_CONTEXT_WINDOW=${fromEnv} in the environment —`));
       console.log(GUTTER + dim("  that wins over anything stored here."));
     } else if (stored) {
-      console.log(GUTTER + `  context window: ${cyan(fmtTokens(stored))}` +
+      console.log(GUTTER + `  context window: ${accent(fmtTokens(stored))}` +
         dim(`  (compacting above ~${fmtTokens(Math.floor(stored * 2 / 3))})`));
     } else {
       console.log(GUTTER + dim("  context window: not set — the worker probes the server, falls"));
@@ -6238,7 +6241,7 @@ async function runContextWindowCommand(line) {
   if (!arg) return show();
   if (arg === "auto" || arg === "clear" || arg === "off") {
     await ctl.setCodingContextWindow(0);
-    console.log(GUTTER + cyan("✓ cleared") + dim(" — probing the model server again.\n"));
+    console.log(GUTTER + accent("✓ cleared") + dim(" — probing the model server again.\n"));
     return;
   }
   // "1m" / "128k" as well as digits: the number people quote is the round one.
@@ -6251,7 +6254,7 @@ async function runContextWindowCommand(line) {
     console.log(GUTTER + dim("  give a token count above 4096 — e.g. 128k, 1m, or 1000000.\n"));
     return;
   }
-  console.log(GUTTER + cyan(`✓ context window → ${fmtTokens(saved)}`) +
+  console.log(GUTTER + accent(`✓ context window → ${fmtTokens(saved)}`) +
     dim(`  · compacting above ~${fmtTokens(Math.floor(saved * 2 / 3))}`));
   console.log(GUTTER + dim("    takes effect on your next question.\n"));
 }
@@ -6329,7 +6332,7 @@ async function runS3Command(line) {
     const { ok, rows } = s3.describeS3Test(res);
     for (const row of rows) console.log(GUTTER + (ok ? dim(`  ${row}`) : `  ${dim(row)}`));
     console.log(
-      GUTTER + (ok ? cyan("✓ S3 is reachable, readable and writable.\n") : red("✗ S3 is not usable yet.\n"))
+      GUTTER + (ok ? accent("✓ S3 is reachable, readable and writable.\n") : red("✗ S3 is not usable yet.\n"))
     );
     return ok;
   };
@@ -6406,7 +6409,7 @@ async function runS3Command(line) {
     console.log(GUTTER + dim("  if this machine's local API is old, restart it with `gu api restart`.\n"));
     return;
   }
-  console.log(GUTTER + cyan("✓ saved.") + dim(" now checking it actually works…\n"));
+  console.log(GUTTER + accent("✓ saved.") + dim(" now checking it actually works…\n"));
   // Tested with what was just SAVED (no body) rather than what was typed: that proves the
   // stored config works, which is the thing every later turn will use.
   await runTest({});
@@ -6452,7 +6455,7 @@ async function runProxyCommand(line) {
     // just said they are no longer using, and off an office network those fail slowly.
     resetDispatchers();
     console.log(
-      GUTTER + (action === "on" ? cyan("proxy on") : dim("proxy off")) +
+      GUTTER + (action === "on" ? accent("proxy on") : dim("proxy off")) +
         dim(action === "on" ? " — model calls will be routed." : " — model calls go out directly (credentials kept).") + "\n"
     );
     return;
@@ -6469,7 +6472,7 @@ async function runProxyCommand(line) {
     const proxy = await store.loadProxy();
     console.log(GUTTER + dim("checking the proxy against your configured model…"));
     const res = await cmd.verifyProxy({ proxy, settings, fetchImpl: proxyFetch });
-    console.log(GUTTER + (res.ok ? cyan("✓ ") : yellow("✗ ")) + dim(res.detail) + "\n");
+    console.log(GUTTER + (res.ok ? accent("✓ ") : yellow("✗ ")) + dim(res.detail) + "\n");
     return;
   }
 
@@ -6496,14 +6499,14 @@ async function runProxyCommand(line) {
   const proxy = await store.saveProxy({ enabled: true, host, port, username, password });
   resetDispatchers();
   const { describeProxy } = await import("./proxy-config.mjs");
-  console.log(GUTTER + cyan("saved") + dim(` — ${describeProxy(proxy)}`));
+  console.log(GUTTER + accent("saved") + dim(` — ${describeProxy(proxy)}`));
 
   // VERIFY NOW, while the user still has the password in their head. A proxy that is merely
   // stored fails later, mid-turn, as an error the model cannot act on.
   console.log(GUTTER + dim("checking it against your configured model…"));
   const res = await cmd.verifyProxy({ proxy, settings, fetchImpl: proxyFetch });
   if (res.ok) {
-    console.log(GUTTER + cyan("✓ ") + dim(res.detail) + "\n");
+    console.log(GUTTER + accent("✓ ") + dim(res.detail) + "\n");
   } else {
     console.log(GUTTER + yellow("✗ ") + dim(res.detail));
     // Left ENABLED on purpose: the user asked for it, and the failure may be the model host
@@ -6555,7 +6558,7 @@ async function chooseServer() {
   }
   const s = servers[idx];
   selectedServer = { name: s.name, host: s.host, user: s.user };
-  console.log(cyan(`  ✓ deploy target → ${s.name} (${s.user}@${s.host})`));
+  console.log(accent(`  ✓ deploy target → ${s.name} (${s.user}@${s.host})`));
   await checkServerKeyAuth(selectedServer);
   console.log("");
 }
@@ -6709,7 +6712,7 @@ async function stopOtherAgent(jobId, shortName) {
     if (r?.ok) {
       // "asked", not "stopped": this marks the job cancelled, and the worker kills the agent
       // when it next sees that. Claiming the process is already gone would be a guess.
-      console.log(GUTTER + cyan("✓ asked it to stop") + dim(" — the worker ends it within a few seconds.\n"));
+      console.log(GUTTER + accent("✓ asked it to stop") + dim(" — the worker ends it within a few seconds.\n"));
       // Drop it from the cached list NOW so the separator's count stops offering an agent the
       // user has just ended; the 20s poll would otherwise leave it there until it catches up.
       otherAgents = otherAgents.filter((a) => a.id !== jobId);
@@ -6776,7 +6779,9 @@ async function coderKeyState(override = "") {
     const active = override
       ? choices.find((c) => c.id === override)
       : choices.find((c) => c.isDefault);
-    const needsKey = active?.kind === "openai";
+    // Kind AND url: an Ollama coder at https://ollama.com needs a key; a local one does not.
+    const { codingNeedsKey } = await import("./coding-key-prompt.mjs");
+    const needsKey = codingNeedsKey(active?.kind, active?.url);
     return {
       needsKey,
       model: p.codingKeyModel || active?.model || "the coding model",
@@ -6904,7 +6909,7 @@ async function promptNewCodingKey(backendId = "", provider = "") {
   const id = await addCodingKey(name, secret, backendId);
   console.log(
     id
-      ? cyan(`  ✓ added ${name || "Unknown"}`) +
+      ? accent(`  ✓ added ${name || "Unknown"}`) +
           (backendId && provider ? dim(`  · for ${provider}`) : "") + "\n"
       : red("  couldn't save the key — try again, or set it in web Settings → Agent\n")
   );
@@ -6974,7 +6979,7 @@ async function replaceCodingKey() {
   // would collect something with nowhere to go. The original prompt is exactly right here.
   console.log(
     "\n" + dim(`  ${ks.model} API key `) +
-      (ks.stored ? dim("(replacing ") + cyan(maskKey(ks.stored)) + dim(")") : dim("(none stored)")) +
+      (ks.stored ? dim("(replacing ") + accent(maskKey(ks.stored)) + dim(")") : dim("(none stored)")) +
       dim("  ·  Enter alone cancels, \"clear\" removes it\n")
   );
   console.log(GUTTER + dim(SECRET_KEY_HINT));
@@ -6989,8 +6994,8 @@ async function replaceCodingKey() {
   console.log(
     ok
       ? clearing
-        ? cyan(`  ✓ ${ks.model} API key removed`) + dim(" — coding falls back to your local model\n")
-        : cyan(`  ✓ ${ks.model} API key saved\n`)
+        ? accent(`  ✓ ${ks.model} API key removed`) + dim(" — coding falls back to your local model\n")
+        : accent(`  ✓ ${ks.model} API key saved\n`)
       : red("  couldn't save the key — try again, or set it in web Settings → Agent\n")
   );
   paintBar();
@@ -7007,15 +7012,15 @@ async function manageCodingKeys(ks, keys) {
   const current = sessionCodingKeyId;
   const rows = keys.map(
     (k) =>
-      `${k.name}${dim(`  ····${k.tail}`)}${k.id === current ? cyan("  (this folder)") : ""}`
+      `${k.name}${dim(`  ····${k.tail}`)}${k.id === current ? accent("  (this folder)") : ""}`
   );
   const ADD = rows.length;
   rows.push(dim("add a new key…"));
   console.log(
     "\n" + GUTTER +
       (keys.length > 1
-        ? dim(`Which key should ${folderLabel()} use for `) + cyan(ks.model) + dim("?\n")
-        : dim(`${folderLabel()} uses this key for `) + cyan(ks.model) + dim(" — or add another.\n"))
+        ? dim(`Which key should ${folderLabel()} use for `) + accent(ks.model) + dim("?\n")
+        : dim(`${folderLabel()} uses this key for `) + accent(ks.model) + dim(" — or add another.\n"))
   );
   console.log(GUTTER + dim("Enter chooses · ctrl+d deletes the highlighted key\n"));
   const at = Math.max(0, keys.findIndex((k) => k.id === current));
@@ -7059,7 +7064,7 @@ async function manageCodingKeys(ks, keys) {
   keyChoicePending = false; // chosen — the bar's mark comes off
   codingKeyMissingKnown = false;
   console.log(
-    cyan(`  ✓ ${folderLabel()} → ${keys[idx].name}`) + dim(`  ····${keys[idx].tail}\n`)
+    accent(`  ✓ ${folderLabel()} → ${keys[idx].name}`) + dim(`  ····${keys[idx].tail}\n`)
   );
   paintBar();
 }
@@ -7110,7 +7115,7 @@ async function deleteCodingKeyFlow(ks, keys, idx) {
     sessionCodingKeyId = "";
     await saveSessionCodingKeyId(resolve(process.cwd()));
   }
-  console.log(cyan(`  ✓ deleted ${out.name || victim.name}`) +
+  console.log(accent(`  ✓ deleted ${out.name || victim.name}`) +
     dim(`  ····${victim.tail}  ·  ${out.remaining} key(s) left\n`));
   paintBar();
 }
@@ -7138,7 +7143,7 @@ async function promptForCodingKey(override = "") {
     askSecret,
     saveCodingKey,
     log: (s) => console.log(s),
-    colors: { dim, cyan, red },
+    colors: { dim, cyan: accent, red },
   });
 }
 
@@ -7225,15 +7230,15 @@ function drawApprovalOptions(redraw) {
   // is 2 cols so Yes/No align; the \x1b[2A row-up count is unchanged (still 2 rows).
   // Both rows are a handful of columns wide, so they survive any resize on ONE physical row
   // each and the \x1b[2A count stays exact — which is why a resize can simply redraw here.
-  const yes = approvalSel === 0 ? cyan("▸ Yes") : dim("  Yes");
-  const no = approvalSel === 1 ? cyan("▸ No") : dim("  No");
+  const yes = approvalSel === 0 ? accent("▸ Yes") : dim("  Yes");
+  const no = approvalSel === 1 ? accent("▸ No") : dim("  No");
   regionUi((redraw ? "\x1b[2A" : "") + "\x1b[K" + GUTTER + yes + "\n\x1b[K" + GUTTER + no + "\n");
 }
 function finishApproval(allow) {
   if (!approvalActive) return;
   approvalActive = false;
   // Settle the picker: overwrite the two option lines with a single result line.
-  process.stdout.write("\x1b[2A\x1b[J" + GUTTER + (allow ? cyan("▸ Yes — running it") : red("▸ No — skipped")) + "\n");
+  process.stdout.write("\x1b[2A\x1b[J" + GUTTER + (allow ? accent("▸ Yes — running it") : red("▸ No — skipped")) + "\n");
   const r = approvalResolve;
   approvalResolve = null;
   if (r) r(!!allow);
@@ -7398,7 +7403,7 @@ function drawList(redraw) {
     // multi-select feel like it forgot what you chose.
     const box = listMulti ? (listChecked.has(i) ? "[x] " : "[ ] ") : "";
     const body = box + listItems[i];
-    return clipVisible(GUTTER + (i === listSel ? cyan("▸ " + body) : dim("  " + body)), width - 1);
+    return clipVisible(GUTTER + (i === listSel ? accent("▸ " + body) : dim("  " + body)), width - 1);
   };
   const marker = (text) => clipVisible(GUTTER + dim(text), width - 1);
   const rows = [];
@@ -8283,7 +8288,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
     // figure holds rather than jittering against flowing output.
     shownOutputTokens = easeCount(shownOutputTokens, latestOutputTokens);
     const outLabel =
-      shownOutputTokens > 0 ? dim(" · ↓ ") + cyan(fmtTokens(shownOutputTokens)) : "";
+      shownOutputTokens > 0 ? dim(" · ↓ ") + accent(fmtTokens(shownOutputTokens)) : "";
     // Task #96: the thought line is "clickable" only when the fuller thought has MORE text than
     // fits on line 1 (a live command / bare "Thinking" / a thought that already fits has nothing
     // to reveal). Line 1 (what's happening now): a live command > the model's current Thought >
@@ -8388,7 +8393,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
     const clipRow = (r) => clipVisible(r, Math.max(20, process.stdout.columns || 80) - 1);
     const contentRows = [];
     for (let i = 0; i < LEAD_ROWS; i++) contentRows.push(""); // the separator — see LEAD_ROWS
-    contentRows.push(clipRow(`${markLine(cyan(BULLET))}${hovering ? hoverThought(label) : cyan(label)}`));
+    contentRows.push(clipRow(`${markLine(accent(BULLET))}${hovering ? hoverThought(label) : accent(label)}`));
     for (const dr of detailRows) contentRows.push(clipRow(dim(dr)));
     for (const wl of expLines) contentRows.push(clipRow(GUTTER + dim(wl)));
     for (let i = 0; i < WORD_GAP; i++) contentRows.push(""); // see WORD_GAP
@@ -8623,7 +8628,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
         onContent();
         inEditCard = true;
         openBullet();
-        process.stdout.write(markLine(cyan("⏺")) + bold(line.slice(1).replace(/^\s+/, "")) + "\n");
+        process.stdout.write(markLine(accent("⏺")) + bold(line.slice(1).replace(/^\s+/, "")) + "\n");
         lastWasBlank = false;
         lastContentAt = Date.now();
         continue;
@@ -8634,7 +8639,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
           const m = EDIT_DIFF_RE.exec(line);
           if (m) {
             // "    19 -  old text" → dim line number, red/cyan signed content.
-            const paintDiff = m[3] === "+" ? cyan : red;
+            const paintDiff = m[3] === "+" ? accent : red;
             process.stdout.write(`${GUTTER}${m[1]}${dim(m[2])} ${paintDiff(`${m[3]} ${m[4]}`)}\n`);
           } else {
             process.stdout.write(GUTTER + dim(line) + "\n"); // "└ summary" / "… (+N more)"
@@ -9349,7 +9354,7 @@ async function main() {
             servers: await (await import("./model-doctor.mjs")).discoverModelServers(),
           });
       const statusRows = [
-        bold(cyan("GU AGENT")) + dim(`  v${REPL_VERSION}`),
+        bold(accent("GU AGENT")) + dim(`  v${REPL_VERSION}`),
         // Task #134: a client machine OVERRIDES the account's agent model locally (the
         // account value points at the model host's own server). Show what will actually be
         // used, not a value this machine can't reach.
@@ -9383,10 +9388,10 @@ async function main() {
         ...(() => {
           const m = modeRow({ clientExpert: isClientExpert(), clientMode: clientModeBanner });
           if (!m) return [];
-          const name = m.label === "client expert" ? cyan(m.label + " ") : m.label + " ";
+          const name = m.label === "client expert" ? accent(m.label + " ") : m.label + " ";
           return [lbl("mode") + name + dim(m.detail)];
         })(),
-        sessionTestAuto ? cyan("auto-test on") : dim("auto-test off"),
+        sessionTestAuto ? accent("auto-test on") : dim("auto-test off"),
         // Same reason as workspaceSyncLabel: on Client Expert there is no cloud to sync TO, so
       // the banner must not advertise one.
       lbl("folder") +
@@ -9534,7 +9539,7 @@ async function main() {
         askSecret,
         saveCodingKey,
         log: (s) => console.log(s),
-        colors: { dim, cyan, red },
+        colors: { dim, cyan: accent, red },
       });
       // Task #190: saving the key is the moment the coder becomes real, and the payload that
       // seeded defaultCodingModel above was fetched BEFORE that — it carried no coder at all.
@@ -9558,7 +9563,7 @@ async function main() {
       // folder has not chosen, and more than one is stored.
       try {
         if (!keyRes?.saved) {
-          const { unchosenKeyWarning, effectiveCoderKind } = await import(
+          const { unchosenKeyWarning, effectiveCoder, codingNeedsKey } = await import(
             "./coding-key-prompt.mjs"
           );
           // THE RULE LIVES IN THE MODULE so it can be tested by calling it. Open-coded here it
@@ -9571,15 +9576,17 @@ async function main() {
           // machine an Ollama coder, which needs no key — while the folder was on gpt-5. Reading
           // it directly made this check answer about a coder nobody was using, and the mark only
           // appeared after /model, which re-probes WITH the override.
-          const kind = effectiveCoderKind({
+          const { kind, url } = effectiveCoder({
             sessionCodingModel,
             choices: probe?.codingChoices,
             defaultKind: p?.codingKind,
+            defaultUrl: probe?.codingChoices?.find?.((c) => c?.isDefault)?.url ?? "",
           });
           const allKeys =
-            kind === "openai" && !sessionCodingKeyId ? await fetchCodingKeys() : null;
+            codingNeedsKey(kind, url) && !sessionCodingKeyId ? await fetchCodingKeys() : null;
           const w = unchosenKeyWarning({
             codingKind: kind,
+            codingUrl: url,
             selectedKeyId: sessionCodingKeyId,
             keys: allKeys,
           });
@@ -9892,7 +9899,7 @@ async function main() {
       // default; this opts in for the session. Ctrl+T expands the thought either way.
       hoverMouse = !hoverMouse;
       console.log(
-        (hoverMouse ? cyan("hover: ON") : dim("hover: OFF")) +
+        (hoverMouse ? accent("hover: ON") : dim("hover: OFF")) +
           dim(
             hoverMouse
               ? " — mouse hover/click expands the thinking line; scrolling and drag-select are captured while a turn runs.\n"
@@ -9908,7 +9915,7 @@ async function main() {
       sessionShowThought = !sessionShowThought;
       await saveSessionShowThought(resolve(process.cwd()), sessionShowThought);
       console.log(
-        (sessionShowThought ? cyan("thought: ON") : dim("thought: OFF")) +
+        (sessionShowThought ? accent("thought: ON") : dim("thought: OFF")) +
           dim(
             sessionShowThought
               ? " — the model's reasoning prints in grey as it works; click a block (or Ctrl+T) to expand it.\n"
@@ -9958,7 +9965,7 @@ async function main() {
       sessionTestAuto = !sessionTestAuto;
       await saveSession(cwd, history); // persist the choice for this folder
       console.log(
-        (sessionTestAuto ? cyan("auto-test: ON") : dim("auto-test: OFF")) +
+        (sessionTestAuto ? accent("auto-test: ON") : dim("auto-test: OFF")) +
           dim(
             sessionTestAuto
               ? " — the agent will verify its work and fix until it passes, for this folder.\n"
@@ -9973,7 +9980,7 @@ async function main() {
       await saveSessionSkip(cwd, "skipModelSetupPrompt", false);
       await saveSessionSkip(cwd, "skipDaemonPrompt", false);
       console.log(
-        cyan("host mode") +
+        accent("host mode") +
           dim(" — this machine will run turns again. Start the worker with `gu start`, ") +
           dim("and `gu doctor` to set up models here.\n")
       );
@@ -9996,7 +10003,7 @@ async function main() {
             (r) =>
               r.label +
               dim(`  · ${r.note}`) +
-              (r.id === sessionRagStorage ? cyan("  (current)") : "")
+              (r.id === sessionRagStorage ? accent("  (current)") : "")
           ),
           Math.max(0, RAG_STORAGE.findIndex((r) => r.id === sessionRagStorage))
         );
@@ -10017,7 +10024,7 @@ async function main() {
       // switching to cloud leaves the local shards on disk unread, and switching to local
       // leaves the S3 ones untouched — either way the new store is built by the next index.
       console.log(
-        cyan(`  ✓ RAG storage → ${row.label}`) +
+        accent(`  ✓ RAG storage → ${row.label}`) +
           dim(`\n    ${row.note}`) +
           dim("\n    Existing shards are not moved — the new store fills as this folder is re-indexed.\n")
       );
@@ -10046,7 +10053,7 @@ async function main() {
         0
       );
       console.log(
-        GUTTER + cyan("prompt sent to the coding model") +
+        GUTTER + accent("prompt sent to the coding model") +
           dim(`  ·  ${fmtTokens(total)} tokens in the newest request`) +
           // The per-folder maximum (task #84), which used to sit on the bottom bar. It answers
           // "have I ever come close to this model's window?" — a question you ask once, not
@@ -10064,7 +10071,7 @@ async function main() {
           GUTTER + dim(r.label.padEnd(21)) +
             String(fmtTokens(r.tokens)).padStart(7) +
             dim(` ${String(r.percent).padStart(3)}% `) +
-            (r.tokens ? cyan(bar) : "") + (r.note ? dim(`  ${r.note}`) : "")
+            (r.tokens ? accent(bar) : "") + (r.note ? dim(`  ${r.note}`) : "")
         );
       }
       console.log("");
@@ -10087,7 +10094,7 @@ async function main() {
         // The bar takes the FRESHER of the two totals, so the last turn's copy has to be
         // zeroed too or the reset wouldn't show up in it.
         lastTurnTotalOutput = 0;
-        console.log(GUTTER + cyan("✓ global + workspace output-token totals reset to 0.\n"));
+        console.log(GUTTER + accent("✓ global + workspace output-token totals reset to 0.\n"));
       } else {
         console.log(GUTTER + dim("Could not reset the output-token totals (API error).\n"));
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.694",
+  "version": "1.0.696",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -42,6 +42,7 @@
     "test:bearer-e2e": "bash scripts/bearer-e2e.sh"
   },
   "files": [
+    "accent.mjs",
     "gu-cli.mjs",
     "gu-repl.mjs",
     "terminal-hover.mjs",

package/terminal-viewport.mjs

@@ -516,13 +516,14 @@ export function dragEventKind(btn, press) {
   return (b & 0b11) === 0 ? "press" : null;
 }
 
-// The selection's colours (task #178). THE LOGO'S CYAN, as a BACKGROUND — not as text.
+// The selection's colours (task #178). THE LOGO'S COLOUR, as a BACKGROUND — not as text.
 //
-// 46 is the background of `\x1b[36m`, the exact colour the startup chevron is drawn in, so the
-// selection is the product's own colour rather than a fourth one invented for it. It is the
-// user's palette cyan, which means it still inherits their theme — unlike a 256-colour or
-// truecolor background, which would fight every custom scheme and every light terminal, the
-// same argument that kept syntax colour out of the edit cards.
+// 105 is bright magenta, the sixteen-colour palette's purple, following the accent from cyan to
+// indigo when the brand moved (accent.mjs). Still a PALETTE colour, not the exact #a5b4fc: a
+// background inherits the user's theme this way, where a 256-colour or truecolor background would
+// fight every custom scheme and every light terminal — the same argument that kept syntax colour
+// out of the edit cards. The bright variant rather than 45, because black text on a dark magenta
+// is where this stops being legible.
 //
 // A BACKGROUND, because the cyan FOREGROUND is already spoken for: the ">> " prompt, where it
 // means "this is the line you are typing", and the jump-to-bottom hint. A foreground also
@@ -530,12 +531,12 @@ export function dragEventKind(btn, press) {
 // reserves for "you must not miss this" would be erased by looking at it. A background leaves
 // every foreground meaning intact and reads as a REGION, which is what a selection is.
 //
-// The explicit 30 (black) is not decoration: the prompt and the jump hint are CYAN TEXT, and
-// cyan on cyan is invisible. Flattening the foreground inside the selection costs colour
+// The explicit 30 (black) is not decoration: the prompt and the jump hint are ACCENT TEXT, and
+// accent on accent is invisible. Flattening the foreground inside the selection costs colour
 // meaning for as long as the selection lasts, and is the price of legibility. Reverse video
 // (\x1b[7m) avoids it by letting the terminal swap whatever is there; a named colour was chosen
 // deliberately over it, so the selection looks like gu rather than like the terminal.
-export const SELECTION_SGR = "\x1b[46;30m";
+export const SELECTION_SGR = "\x1b[105;30m";
 
 /**
  * One row with the visible columns [from, to) highlighted.