@tiens.nguyen/gu-cli 1.0.698 → 1.0.699

package/agent-model-command.mjs

@@ -18,6 +18,7 @@
  */
 
 import { modelRetired, ensureV1Root } from "./coding-provider-setup.mjs";
+import { isOllamaCloudUrl } from "./coding-key-prompt.mjs";
 
 
 /**
@@ -257,3 +258,94 @@ export function agentListSource(settings) {
 export function agentModelsFromBody(dialect, body, now = Date.now()) {
   return dialect === "openai" ? agentModelsFromProvider(body, now) : parseOllamaTags(body);
 }
+
+// ---------------------------------------------------------------------------------------------
+// #40 and #41 — the agent model on an OpenAI-compatible provider WITH ITS KEY, and on any Ollama.
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * Does listing (and using) this agent source need an API key?
+ *
+ * Reported (#40): /agent-model on api.openai.com said "HTTP 401" — the list was fetched with no
+ * Authorization header at all, so a provider that requires a key could never be listed, however
+ * correct the stored key was. An OpenAI-compatible row needs one; so does the Ollama CLOUD. A local
+ * or LAN Ollama does not.
+ */
+export function agentSourceNeedsKey(source) {
+  const row = source?.row;
+  if (!row) return false;
+  return source.dialect === "openai" || isOllamaCloudUrl(String(row.url ?? ""));
+}
+
+/** The headers a model-list request needs — the bearer only when there is a key to send. */
+export function agentListHeaders(key) {
+  const k = String(key ?? "").trim();
+  return k ? { Authorization: `Bearer ${k}` } : {};
+}
+
+/**
+ * An Ollama server as typed → where the agent points, and where its models are listed (#41).
+ *
+ * Forgiving about what people paste — "127.0.0.1:11434", "http://box:11434/v1", ".../api/tags",
+ * "ollama.com" — and strict about the result: the agent field gets `${root}/v1` (the shape every
+ * existing install stores, see daemon-control.mjs), the list is `${root}/api/tags`. A bare host is
+ * http, except ollama.com, which only answers https.
+ *
+ * Returns { ok: true, root, agentUrl, tagsUrl, host, cloud } or { ok: false, why }.
+ */
+export function ollamaAgentUrl(raw) {
+  let v = String(raw ?? "").trim();
+  if (!v) return { ok: false, why: "empty" };
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(v)) {
+    const bareHost = v.split(/[/:]/)[0].toLowerCase();
+    v = `${bareHost === "ollama.com" || bareHost.endsWith(".ollama.com") ? "https" : "http"}://${v}`;
+  }
+  let u;
+  try {
+    u = new URL(v);
+  } catch {
+    return { ok: false, why: "not a URL" };
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return { ok: false, why: "not http(s)" };
+  if (!u.hostname) return { ok: false, why: "no host" };
+  const path = u.pathname.replace(/\/+$/, "").replace(/\/(v1|api\/tags|api)$/i, "").replace(/\/+$/, "");
+  const root = `${u.protocol}//${u.host}${path}`;
+  return {
+    ok: true,
+    root,
+    agentUrl: `${root}/v1`,
+    tagsUrl: `${root}/api/tags`,
+    host: u.host,
+    cloud: isOllamaCloudUrl(root),
+  };
+}
+
+/**
+ * The server to offer by default: the one the agent already uses when that is an Ollama, else this
+ * machine's own Ollama.
+ */
+export function ollamaAgentDefault(settings) {
+  const source = agentListSource(settings);
+  if (source.url && source.dialect === "ollama") {
+    const r = ollamaAgentUrl(String(settings?.agentModelUrl ?? ""));
+    if (r.ok) return r.root;
+  }
+  return "http://127.0.0.1:11434";
+}
+
+/**
+ * The ways forward /agent-model offers when the list could not be read — and in which order.
+ *
+ * A KEY PROBLEM GETS ITS OWN ENTRY, FIRST (#40): a 401, or a provider that needs a key with none
+ * stored, is fixed by entering the key — not by "adding a provider", which for an already-configured
+ * URL could only answer "already configured here". Returns [{ action, label }]; "leave" is always
+ * first so Esc and Enter-on-the-top-row both change nothing.
+ */
+export function agentRecoveryOptions({ keyProblem = false, host = "" } = {}) {
+  return [
+    { action: "leave", label: "leave it" },
+    ...(keyProblem ? [{ action: "key", label: `enter the API key for ${host || "this provider"}…` }] : []),
+    { action: "ollama", label: "use an Ollama server for the agent…" },
+    { action: "provider", label: "add an OpenAI-compatible provider for the agent…" },
+  ];
+}

package/gu-repl.mjs

@@ -5459,6 +5459,14 @@ async function addCodingProvider(roleName = "coding") {
     // ALREADY CONFIGURED is its own answer. Saving a second row for the same URL would give the
     // picker two rows that are identical in everything a person can see.
     const clash = existing.find((b) => ps.ensureV1Root(String(b.url ?? "")) === r.url);
+    if (clash && roleName === "agent") {
+      // FOR THE AGENT, "already configured" IS THE ANSWER, NOT A REFUSAL (#40). The provider and
+      // its key may well be there already; what is missing is the agent pointing at it. Sending the
+      // user to /model — the CODING picker — left no way to finish from here.
+      console.log(GUTTER + dim(`${r.host} is already configured — using it for the agent.`));
+      await pointAgentAtProvider(clash, r.host);
+      return;
+    }
     if (clash) {
       console.log(GUTTER + dim(`${r.host} is already configured here — pick its model in /model.`));
       continue;
@@ -5998,6 +6006,212 @@ async function chooseEmbedModel() {
   console.log(dim(`    Make sure it is pulled there:  ollama pull ${chosen}\n`));
 }
 
+/** Save the agent model on this machine: the URL the API sends turns to, and the model name. */
+async function saveAgentModel(agentUrl, model, host) {
+  const md = await import("./model-doctor.mjs");
+  const ok = await withPendingStatus("pointing the agent model at it", () =>
+    md.saveWorkerSettings(apiBase, workerKey, { agentModelUrl: agentUrl, agentModelName: model, agentModel: model })
+  );
+  if (!ok) {
+    console.log(red(`  couldn't save the agent model — nothing changed.`));
+    console.log(GUTTER + dim("if this machine's local API is old, restart it with `gu api restart`.\n"));
+    return false;
+  }
+  console.log(accent(`  ✓ agent model → ${model}`) + dim(`  · ${host}`));
+  console.log(dim("    takes effect on your next question.\n"));
+  return true;
+}
+
+/** Ask for a key and store it BOUND to this provider row. Returns the secret, or "" if cancelled. */
+async function askKeyForRow(row, host) {
+  console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
+  const name = (await ask("  key name: ")).trim();
+  console.log(GUTTER + dim(SECRET_KEY_HINT));
+  const secret = (await askSecret(`  API key for ${host}${name ? ` (${name})` : ""}: `)).trim();
+  if (!secret) {
+    console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+    return "";
+  }
+  const id = await withPendingStatus("saving the key", () => addCodingKey(name, secret, String(row?.id ?? "")));
+  if (!id) {
+    console.log(red("  couldn't save the key — nothing changed.\n"));
+    return "";
+  }
+  return secret;
+}
+
+/** #40: the key was the problem — enter it, then list again. */
+async function enterAgentProviderKey(row, host) {
+  if (!row) return;
+  if (!(await askKeyForRow(row, host))) return;
+  await chooseAgentModel();
+}
+
+/**
+ * #40: point the agent at a provider that is ALREADY configured — its key if it has none (or a
+ * rejected one), its model list, and the agent settings.
+ */
+async function pointAgentAtProvider(row, host) {
+  const ps = await import("./coding-provider-setup.mjs");
+  const am = await import("./agent-model-command.mjs");
+  const { proxyFetch } = await import("./proxy-dispatcher.mjs");
+  const url = ps.ensureV1Root(String(row.url ?? ""));
+  let key = (await withPendingStatus(`reading the key for ${host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
+  if (!key) {
+    console.log(GUTTER + dim(`no API key is stored for ${host} yet.`));
+    key = await askKeyForRow(row, host);
+    if (!key) return;
+  }
+  const list = async (k) =>
+    withPendingStatus(`asking ${host} for its models`, async () => {
+      try {
+        const res = await proxyFetch(ps.modelsUrlFor(url), { headers: am.agentListHeaders(k), signal: AbortSignal.timeout(12_000) });
+        return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
+      } catch (err) {
+        return { err };
+      }
+    });
+  let probe = await list(key);
+  if (probe.status === 401 || probe.status === 403) {
+    console.log(yellow(`  ${host} rejected the stored key (HTTP ${probe.status}) — enter the right one.`));
+    key = await askKeyForRow(row, host);
+    if (!key) return;
+    probe = await list(key);
+  }
+  let models = [];
+  if (probe.body) {
+    models = am.agentModelsFromProvider(probe.body).map((m) => m.model);
+  } else {
+    for (const l of ps.describeProbeFailure(probe).lines) console.log(GUTTER + yellow(l));
+    console.log(GUTTER + dim("carrying on — you can type the model id yourself."));
+  }
+  const model = models.length ? await chooseFromModelList(models, "Which model talks?", 0) : (await ask("  model id: ")).trim();
+  if (!model) {
+    console.log(dim("  (cancelled — nothing was saved)\n"));
+    return;
+  }
+  await saveAgentModel(url, model, host);
+}
+
+/**
+ * #41: the agent model on an OLLAMA server — this machine's, a LAN box, or the Ollama cloud.
+ *
+ * Local and LAN Ollama take no key: the agent URL and model are saved, and the API sends its
+ * placeholder, which Ollama ignores. The CLOUD (https://ollama.com) needs one, and the API finds an
+ * agent's key through the provider row whose URL matches — so a cloud server reuses the row that is
+ * already there (a kimi-k3 coder on ollama.com has one), or gets one, with the key bound to it.
+ */
+async function addOllamaAgent() {
+  const am = await import("./agent-model-command.mjs");
+  const ps = await import("./coding-provider-setup.mjs");
+  const md = await import("./model-doctor.mjs");
+  const { proxyFetch } = await import("./proxy-dispatcher.mjs");
+  const settings = await withPendingStatus("reading your model settings", fetchWorkerSettings);
+  if (!settings) {
+    console.log(red("  couldn't reach the API to read your current settings.\n"));
+    return;
+  }
+  const dflt = am.ollamaAgentDefault(settings);
+  console.log(dim("  An Ollama server: this machine, a box on your network, or https://ollama.com (needs a key)."));
+  console.log(dim(`  Enter uses ${dflt}  ·  Esc cancels\n`));
+
+  let target = null;
+  for (let attempt = 0; attempt < 3 && !target; attempt++) {
+    const typed = (await ask("  Ollama server: ")).trim();
+    const r = am.ollamaAgentUrl(typed || dflt);
+    if (!r.ok) {
+      console.log(GUTTER + dim(`"${typed}" is ${r.why} — try host:port, e.g. 127.0.0.1:11434`));
+      continue;
+    }
+    target = r;
+  }
+  if (!target) {
+    console.log(dim("  (nothing saved)\n"));
+    return;
+  }
+
+  // THE CLOUD NEEDS A KEY, and the key has to belong to a provider row with this URL.
+  const existing = ps.existingBackendRows(settings);
+  let row = target.cloud
+    ? existing.find((b) => ps.ensureV1Root(String(b.url ?? "")).toLowerCase() === target.agentUrl.toLowerCase()) ?? null
+    : null;
+  let key = "";
+  let newRow = null;
+  if (target.cloud) {
+    if (row) key = (await withPendingStatus(`reading the key for ${target.host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
+    if (!key) {
+      if (!row) {
+        if (existing.length >= ps.MAX_BACKENDS) {
+          console.log(yellow(`  ${ps.MAX_BACKENDS} providers is the limit — remove one in web Settings → Agent first.\n`));
+          return;
+        }
+        newRow = { id: ps.mintProviderId(existing.map((b) => String(b.id ?? ""))), kind: "ollama", enabled: true, url: target.agentUrl, defaultModel: "", models: [] };
+      }
+      console.log(GUTTER + dim(`${target.host} is the Ollama cloud — it needs an API key.`));
+      console.log(GUTTER + dim(SECRET_KEY_HINT));
+      key = (await askSecret(`  API key for ${target.host}: `)).trim();
+      if (!key) {
+        console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+        return;
+      }
+    }
+  }
+
+  // ITS MODELS, LIVE — with the key when it is the cloud.
+  const probe = await withPendingStatus(`asking ${target.host} for its models`, async () => {
+    try {
+      const res = await proxyFetch(target.tagsUrl, { headers: am.agentListHeaders(key), signal: AbortSignal.timeout(12_000) });
+      return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
+    } catch (err) {
+      return { err: err?.name === "TimeoutError" ? "no response in 12s" : (err?.message ?? String(err)) };
+    }
+  });
+  if (!probe.body) {
+    const why = probe.status ? `HTTP ${probe.status}` : probe.err;
+    console.log(red(`  couldn't list the models on ${target.host} — ${why}.`));
+    if (probe.status === 401 || probe.status === 403) console.log(GUTTER + dim("the key was rejected — nothing was saved.\n"));
+    else console.log(GUTTER + dim("check the server is running and reachable (and /proxy if this machine needs one) — nothing was saved.\n"));
+    return;
+  }
+  const models = am.parseOllamaTags(probe.body);
+  if (!models.length) {
+    console.log(yellow(`  ${target.host} answered but lists no models — pull one there first (ollama pull …).\n`));
+    return;
+  }
+  const rows = am.agentModelRows(models, am.currentAgentModel(settings));
+  console.log(dim(`  ${models.length} on ${target.root}  (${PICK_HINT}):`));
+  const idx = await pickFromList(
+    rows.map((r) => r.model + (r.embedder ? dim("  · embedding model, not for chat") : "") + (r.current ? accent("  (current)") : "")),
+    Math.max(0, rows.findIndex((r) => r.current))
+  );
+  if (idx < 0) {
+    console.log(dim("  (cancelled — nothing was saved)\n"));
+    return;
+  }
+  const model = rows[idx].model;
+
+  // SAVE: the cloud's row and key first (the agent's key is found through them), then the agent.
+  if (newRow) {
+    const ok = await withPendingStatus("saving the Ollama cloud provider", () =>
+      md.saveWorkerSettings(apiBase, workerKey, { agentCodingBackends: [...existing, { ...newRow, defaultModel: model }] })
+    );
+    if (!ok) {
+      console.log(red("  couldn't save the provider — nothing changed.\n"));
+      return;
+    }
+    row = newRow;
+    console.log(GUTTER + dim(`${target.host} is also offered in /model now.`));
+  }
+  if (target.cloud && key && !(await fetchCodingKey(String(row?.id ?? ""))).key) {
+    const id = await withPendingStatus("saving the key", () => addCodingKey("Ollama cloud", key, String(row?.id ?? "")));
+    if (!id) {
+      console.log(red("  couldn't save the key — the agent was not changed.\n"));
+      return;
+    }
+  }
+  await saveAgentModel(target.agentUrl, model, target.host);
+}
+
 /**
  * `/agent-model` — switch the model that TALKS, from what the Ollama box actually has (#169).
  *
@@ -6029,7 +6243,23 @@ async function chooseAgentModel() {
   let models = [];
   let failure = null;
   let proxied = false;
-  if (!url) {
+  // THE KEY, WHEN THIS PROVIDER NEEDS ONE (#40). The list used to be fetched with no Authorization
+  // at all, so api.openai.com answered 401 however right the stored key was. Asked for the key
+  // bound to THIS provider row — the same one the API will send with each turn.
+  const needsKey = am.agentSourceNeedsKey(source);
+  const listHost = url ? hostOf(url) : "";
+  let listKey = "";
+  let keyProblem = false;
+  if (needsKey) {
+    listKey = (await withPendingStatus(`reading the key for ${listHost}`, () => fetchCodingKey(String(source.row?.id ?? "")))).key;
+    if (!listKey) {
+      keyProblem = true;
+      failure = `no API key is stored for ${listHost}`;
+    }
+  }
+  if (failure) {
+    // already decided — no request without the key it needs
+  } else if (!url) {
     failure = "no agent model URL is configured for this machine";
   } else {
     try {
@@ -6041,9 +6271,10 @@ async function chooseAgentModel() {
       // terminal that ignored the command. The host is named in the label because on a slow
       // one that IS the useful information while you wait.
       const r = await withPendingStatus(`asking ${hostOf(url)} for its models`, () =>
-        proxyFetch(url, { signal: AbortSignal.timeout(10000) })
+        proxyFetch(url, { headers: am.agentListHeaders(listKey), signal: AbortSignal.timeout(10000) })
       );
       if (!r.ok) failure = `HTTP ${r.status}`;
+      if (!r.ok && needsKey && (r.status === 401 || r.status === 403)) keyProblem = true;
       else models = am.agentModelsFromBody(source.dialect, await r.json().catch(() => null));
       // A 200 with nothing in it is not a working list. Saying "the box answered but listed no
       // models" is a different diagnosis from "unreachable", and the user can act on it.
@@ -6061,11 +6292,18 @@ async function chooseAgentModel() {
     // printed the diagnosis and stopped, leaving no way forward from the place the problem was
     // found. /model had the same dead end before #223, and this is the same remedy: offer the
     // way out from where the reader already is.
+    if (keyProblem) console.log(GUTTER + dim(`${listHost} needs an API key — enter one below to list its models.`));
+    // By ACTION, not by position: the key entry is only there when a key is the problem (#40), and
+    // the Ollama entry is new (#41) — indices would mean different things on different days.
+    const options = am.agentRecoveryOptions({ keyProblem, host: listHost });
     const go = await pickFromList(
-      [dim("leave it"), "add an OpenAI-compatible provider for the agent…"],
-      1
+      options.map((o, i) => (i === 0 ? dim(o.label) : o.label)),
+      keyProblem ? 1 : 0
     );
-    if (go === 1) await addCodingProvider("agent");
+    const action = go >= 0 ? options[go].action : "leave";
+    if (action === "key") await enterAgentProviderKey(source.row, listHost);
+    else if (action === "ollama") await addOllamaAgent();
+    else if (action === "provider") await addCodingProvider("agent");
     else console.log("");
     return;
   }
@@ -6101,17 +6339,23 @@ async function chooseAgentModel() {
   // because "which model on the box I am pointed at" and "I want a different provider" are
   // different questions, and only the first is answered by the rows above.
   labels.push("add an OpenAI-compatible provider for the agent…");
+  // #41, appended AFTER the provider entry so no existing index moves.
+  labels.push("use an Ollama server for the agent…");
   const idx = await pickFromList(labels, Math.max(0, rows.findIndex((r) => r.current)));
   if (idx < 0) {
     console.log(dim("  (cancelled)\n"));
     return;
   }
-  // labels is now ONE LONGER than rows. Reading rows[idx] for the appended entry would
-  // dereference undefined and take the picker down, so it is answered before rows is touched.
+  // labels is now TWO LONGER than rows. Reading rows[idx] for an appended entry would
+  // dereference undefined and take the picker down, so they are answered before rows is touched.
   if (idx === rows.length) {
     await addCodingProvider("agent");
     return;
   }
+  if (idx === rows.length + 1) {
+    await addOllamaAgent();
+    return;
+  }
   const chosen = rows[idx].model;
   if (chosen === current) {
     console.log(dim(`  already using ${current} — nothing changed.\n`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.698",
+  "version": "1.0.699",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",