@tiens.nguyen/gu-cli 1.0.695 → 1.0.696

package/coding-key-prompt.mjs

@@ -52,6 +52,34 @@ export function isKeylessCodingHost(url) {
   return host === "gomarsic.cc" || host.endsWith(".gomarsic.cc");
 }
 
+/**
+ * TRUE only for the Ollama CLOUD (https://ollama.com, or a subdomain of it). Mirrors
+ * isOllamaCloudUrl in api/src/store/settingsTypes.ts, web/src/lib/coderChoices.mjs and
+ * _isOllamaCloudUrl in gu-cli.mjs — keep them in step.
+ */
+export function isOllamaCloudUrl(url) {
+  const v = String(url ?? "").trim();
+  if (!/^https:\/\//i.test(v)) return false;
+  let host;
+  try {
+    host = new URL(v).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  return host === "ollama.com" || host.endsWith(".ollama.com");
+}
+
+/**
+ * DOES THIS CODER NEED AN API KEY? — an OpenAI-compatible provider, or Ollama's paid CLOUD.
+ *
+ * Reported: /model on kimi-k3 at https://ollama.com said "needs no API key — nothing to set", so
+ * there was no way to give it one. Every "needs a key" check had been `kind === "openai"`, on the
+ * belief that Ollama never authenticates — true of a local or LAN Ollama, false of ollama.com.
+ */
+export function codingNeedsKey(kind, url) {
+  return kind === "openai" || (kind === "ollama" && isOllamaCloudUrl(url));
+}
+
 /**
  * @param payload  the /agent-payload `payload` object (reads codingKeyMissing/codingKeyModel).
  * @param deps.askSecret  async (prompt) => string  — masked input; "" means the user skipped.
@@ -187,9 +215,10 @@ export function codingKeyFallbackLine(kj, jobId = "") {
  * when a choice HAS been made, and when only one key exists — with one there is nothing to
  * choose, and a warning on a correct setup is how warnings stop being read.
  */
-export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys = null } = {}) {
+export function unchosenKeyWarning({ codingKind = "", codingUrl = "", selectedKeyId = "", keys = null } = {}) {
   const quiet = { warn: false, using: null, why: "" };
-  if (codingKind !== "openai") return quiet; // Ollama and local MLX need no credential
+  // Local Ollama and MLX need no credential; the Ollama cloud does.
+  if (!codingNeedsKey(codingKind, codingUrl)) return quiet;
   if (!Array.isArray(keys) || keys.length < 2) return quiet;
   if (String(selectedKeyId ?? "").trim()) return quiet;
   return { warn: true, using: keys[0], why: "none-chosen" };
@@ -200,7 +229,8 @@ export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys =
  *
  * REPORTED: the bar's "key not chosen" mark only appeared after running /model. The startup gate
  * read `payload.codingKind`, and a payload fetched with NO override describes the ACCOUNT DEFAULT
- * — on the reporting machine that was kimi-k3 at ollama.com, kind "ollama", which needs no key —
+ * — on the reporting machine kimi-k3 at ollama.com, kind "ollama" (which, it turned out later,
+ * DOES need a key: see codingNeedsKey) —
  * while the folder was pointed at gpt-5, kind "openai". So the check answered a question about a
  * coder the folder was not using, said "nothing to warn about", and stayed silent. /model looked
  * right because it re-probes WITH the override.
@@ -212,6 +242,17 @@ export function unchosenKeyWarning({ codingKind = "", selectedKeyId = "", keys =
  * Matched by id OR by bare model name, mirroring that validation: a session saved before ids were
  * qualified ("<kind>::<model>", task #123) stores the bare form and is still a valid pick.
  */
+/** The folder's coder — its kind AND its URL, which together decide whether it needs a key. */
+export function effectiveCoder({ sessionCodingModel = "", choices = null, defaultKind = "", defaultUrl = "" } = {}) {
+  const want = String(sessionCodingModel ?? "").trim();
+  const list = Array.isArray(choices) ? choices : [];
+  if (want) {
+    const hit = list.find((c) => c?.id === want || c?.model === want);
+    if (hit) return { kind: String(hit.kind ?? ""), url: String(hit.url ?? "") };
+  }
+  return { kind: String(defaultKind ?? ""), url: String(defaultUrl ?? "") };
+}
+
 export function effectiveCoderKind({
   sessionCodingModel = "",
   choices = null,

package/gu-cli.mjs

@@ -20,7 +20,7 @@ import { execFile as execFileCallback, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createTaskPool, createFolderQueue } from "./job-pools.mjs";
 import { ragJobConfig } from "./rag-job-config.mjs";
-import { codingKeyFallbackLine } from "./coding-key-prompt.mjs";
+import { codingKeyFallbackLine, isOllamaCloudUrl } from "./coding-key-prompt.mjs";
 // Pure layout helpers — safe to import here (no side effects on load, unlike gu-repl.mjs).
 // Shared so the mid-run picker and the REPL's post-stop advice cannot word the same budget
 // differently.
@@ -3265,22 +3265,8 @@ function _isLocalCodingUrl(baseURL) {
   return !host.includes(".") && !host.includes(":");
 }
 
-/** TRUE only for the Ollama CLOUD endpoint (https://ollama.com[/...]) — the one Ollama
- *  backend that actually requires an API key. Any other Ollama URL (localhost, a LAN
- *  box, a self-hosted remote) has no auth and gets no key. Mirrors isOllamaCloudUrl in
- *  web/src/lib/coderChoices.mjs — keep the two in step. */
-function _isOllamaCloudUrl(baseURL) {
-  const v = String(baseURL || "").trim();
-  if (!/^https:\/\//i.test(v)) return false;
-  let host = "";
-  try {
-    host = new URL(v).hostname.toLowerCase().replace(/\.$/, "");
-  } catch {
-    return false;
-  }
-  return host === "ollama.com" || host.endsWith(".ollama.com");
-}
-
+/** The Ollama cloud check lives in coding-key-prompt.mjs, shared with the terminal. */
+const _isOllamaCloudUrl = isOllamaCloudUrl;
 
 /** Resolve to "ollama" | "openai" | "local". `kind` is the user's Settings choice
  *  ("ollama" | "openai" | "" = Auto). Only Auto costs a probe. */

package/gu-repl.mjs

@@ -6779,7 +6779,9 @@ async function coderKeyState(override = "") {
     const active = override
       ? choices.find((c) => c.id === override)
       : choices.find((c) => c.isDefault);
-    const needsKey = active?.kind === "openai";
+    // Kind AND url: an Ollama coder at https://ollama.com needs a key; a local one does not.
+    const { codingNeedsKey } = await import("./coding-key-prompt.mjs");
+    const needsKey = codingNeedsKey(active?.kind, active?.url);
     return {
       needsKey,
       model: p.codingKeyModel || active?.model || "the coding model",
@@ -9561,7 +9563,7 @@ async function main() {
       // folder has not chosen, and more than one is stored.
       try {
         if (!keyRes?.saved) {
-          const { unchosenKeyWarning, effectiveCoderKind } = await import(
+          const { unchosenKeyWarning, effectiveCoder, codingNeedsKey } = await import(
             "./coding-key-prompt.mjs"
           );
           // THE RULE LIVES IN THE MODULE so it can be tested by calling it. Open-coded here it
@@ -9574,15 +9576,17 @@ async function main() {
           // machine an Ollama coder, which needs no key — while the folder was on gpt-5. Reading
           // it directly made this check answer about a coder nobody was using, and the mark only
           // appeared after /model, which re-probes WITH the override.
-          const kind = effectiveCoderKind({
+          const { kind, url } = effectiveCoder({
             sessionCodingModel,
             choices: probe?.codingChoices,
             defaultKind: p?.codingKind,
+            defaultUrl: probe?.codingChoices?.find?.((c) => c?.isDefault)?.url ?? "",
           });
           const allKeys =
-            kind === "openai" && !sessionCodingKeyId ? await fetchCodingKeys() : null;
+            codingNeedsKey(kind, url) && !sessionCodingKeyId ? await fetchCodingKeys() : null;
           const w = unchosenKeyWarning({
             codingKind: kind,
+            codingUrl: url,
             selectedKeyId: sessionCodingKeyId,
             keys: allKeys,
           });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.695",
+  "version": "1.0.696",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",