@tiens.nguyen/gu-cli 1.0.698 → 1.0.700

package/agent-model-command.mjs

@@ -18,6 +18,7 @@
  */
 
 import { modelRetired, ensureV1Root } from "./coding-provider-setup.mjs";
+import { isOllamaCloudUrl } from "./coding-key-prompt.mjs";
 
 
 /**
@@ -257,3 +258,161 @@ export function agentListSource(settings) {
 export function agentModelsFromBody(dialect, body, now = Date.now()) {
   return dialect === "openai" ? agentModelsFromProvider(body, now) : parseOllamaTags(body);
 }
+
+// ---------------------------------------------------------------------------------------------
+// #40 and #41 — the agent model on an OpenAI-compatible provider WITH ITS KEY, and on any Ollama.
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * Does listing (and using) this agent source need an API key?
+ *
+ * Reported (#40): /agent-model on api.openai.com said "HTTP 401" — the list was fetched with no
+ * Authorization header at all, so a provider that requires a key could never be listed, however
+ * correct the stored key was. An OpenAI-compatible row needs one; so does the Ollama CLOUD. A local
+ * or LAN Ollama does not.
+ */
+export function agentSourceNeedsKey(source) {
+  const row = source?.row;
+  if (!row) return false;
+  return source.dialect === "openai" || isOllamaCloudUrl(String(row.url ?? ""));
+}
+
+/** The headers a model-list request needs — the bearer only when there is a key to send. */
+export function agentListHeaders(key) {
+  const k = String(key ?? "").trim();
+  return k ? { Authorization: `Bearer ${k}` } : {};
+}
+
+/**
+ * An Ollama server as typed → where the agent points, and where its models are listed (#41).
+ *
+ * Forgiving about what people paste — "127.0.0.1:11434", "http://box:11434/v1", ".../api/tags",
+ * "ollama.com" — and strict about the result: the agent field gets `${root}/v1` (the shape every
+ * existing install stores, see daemon-control.mjs), the list is `${root}/api/tags`. A bare host is
+ * http, except ollama.com, which only answers https.
+ *
+ * Returns { ok: true, root, agentUrl, tagsUrl, host, cloud } or { ok: false, why }.
+ */
+export function ollamaAgentUrl(raw) {
+  let v = String(raw ?? "").trim();
+  if (!v) return { ok: false, why: "empty" };
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(v)) {
+    const bareHost = v.split(/[/:]/)[0].toLowerCase();
+    v = `${bareHost === "ollama.com" || bareHost.endsWith(".ollama.com") ? "https" : "http"}://${v}`;
+  }
+  let u;
+  try {
+    u = new URL(v);
+  } catch {
+    return { ok: false, why: "not a URL" };
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return { ok: false, why: "not http(s)" };
+  if (!u.hostname) return { ok: false, why: "no host" };
+  const path = u.pathname.replace(/\/+$/, "").replace(/\/(v1|api\/tags|api)$/i, "").replace(/\/+$/, "");
+  const root = `${u.protocol}//${u.host}${path}`;
+  return {
+    ok: true,
+    root,
+    agentUrl: `${root}/v1`,
+    tagsUrl: `${root}/api/tags`,
+    host: u.host,
+    cloud: isOllamaCloudUrl(root),
+  };
+}
+
+/**
+ * The server to offer by default: the one the agent already uses when that is an Ollama, else this
+ * machine's own Ollama.
+ */
+export function ollamaAgentDefault(settings) {
+  const source = agentListSource(settings);
+  if (source.url && source.dialect === "ollama") {
+    const r = ollamaAgentUrl(String(settings?.agentModelUrl ?? ""));
+    if (r.ok) return r.root;
+  }
+  return "http://127.0.0.1:11434";
+}
+
+/**
+ * The ways forward /agent-model offers when the list could not be read — and in which order.
+ *
+ * A KEY PROBLEM GETS ITS OWN ENTRY, FIRST (#40): a 401, or a provider that needs a key with none
+ * stored, is fixed by entering the key — not by "adding a provider", which for an already-configured
+ * URL could only answer "already configured here". Returns [{ action, label }]; "leave" is always
+ * first so Esc and Enter-on-the-top-row both change nothing.
+ */
+export function agentRecoveryOptions({ keyProblem = false, host = "" } = {}) {
+  return [
+    { action: "leave", label: "leave it" },
+    ...(keyProblem ? [{ action: "key", label: `enter the API key for ${host || "this provider"}…` }] : []),
+    { action: "ollama", label: "use an Ollama server for the agent…" },
+    { action: "provider", label: "add an OpenAI-compatible provider for the agent…" },
+  ];
+}
+
+// ---------------------------------------------------------------------------------------------
+// #43 — /model's "change the Ollama server" flow, when the agent is NOT on an Ollama.
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * Is this machine's agent model on an OpenAI-compatible PROVIDER rather than an Ollama?
+ *
+ * Reported (#43): client mode, /model → change the Ollama server offered the agent's URL —
+ * https://api.openai.com — as the "agent + embedding server", probed it for Ollama's /api/tags, got
+ * 404, said "check that Ollama is listening", and asked again, with no way forward but typing "no".
+ * A provider is known two ways: a provider row for that URL says so, or the URL is one of the hosted
+ * APIs everyone knows is not an Ollama.
+ */
+const KNOWN_PROVIDER_HOSTS = [
+  "api.openai.com",
+  "openrouter.ai",
+  "api.together.xyz",
+  "api.moonshot.ai",
+  "api.groq.com",
+  "api.deepseek.com",
+  "api.mistral.ai",
+  "generativelanguage.googleapis.com",
+];
+
+export function agentIsOnProvider(settings) {
+  const source = agentListSource(settings);
+  if (!source.url) return false;
+  if (source.dialect === "openai") return true;
+  let host = "";
+  try {
+    host = new URL(String(settings?.agentModelUrl ?? "")).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return KNOWN_PROVIDER_HOSTS.some((h) => host === h || host.endsWith(`.${h}`));
+}
+
+/**
+ * The address to offer for the CODING server: the coder's own URL when it is not a known provider,
+ * else this machine's Ollama. Never the agent's provider URL — that is what put api.openai.com in an
+ * Ollama prompt.
+ */
+export function coderServerDefault(settings) {
+  const coder = String(settings?.agentCodingModelUrl ?? "").trim();
+  if (coder && !agentIsOnProvider({ ...settings, agentModelUrl: coder })) return coder;
+  const agent = String(settings?.agentModelUrl ?? "").trim();
+  if (agent && !agentIsOnProvider(settings)) return agent;
+  return "http://127.0.0.1:11434";
+}
+
+/**
+ * A server that ANSWERED but has no /api/tags is not an Ollama — an OpenAI-compatible API answers 404
+ * there. That is a different fix from "not listening", and saying the wrong one sends people to check
+ * a server that is working fine.
+ */
+export function describeNotOllama(host, role) {
+  return role === "agent"
+    ? [
+        `${host} answers, but it is not an Ollama server (no /api/tags).`,
+        "an OpenAI-compatible agent is changed with /agent-model — or type 'no' to skip this role.",
+      ]
+    : [
+        `${host} answers, but it is not an Ollama server (no /api/tags).`,
+        "for an OpenAI-compatible coder use /model → add or change an OpenAI-compatible provider — or type 'no' to skip.",
+      ];
+}

package/client-expert-api.mjs

@@ -734,3 +734,37 @@ export async function seedSettings({
     await client.close().catch(() => {});
   }
 }
+
+/**
+ * THE NEW OLLAMA SERVER'S ROWS, MERGED INTO WHAT IS ALREADY THERE — never replacing it (#43).
+ *
+ * Found while fixing #43: choosing a coding server in /model → "change the Ollama server" saved
+ * codingBackendsForClientExpert(...) AS the whole list — one Ollama row and the Kimi row — deleting
+ * every provider the user had added: an api.openai.com row the AGENT's key is found through, an
+ * ollama.com cloud row. Their keys, bound to those row ids, were orphaned.
+ *
+ * Replaced: the local/LAN Ollama row(s) — that is what "the Ollama server this machine uses" means —
+ * with the new one, which keeps the first replaced row's id so anything bound to it still resolves.
+ * Kept, ids and all: every OpenAI-compatible row, and any Ollama CLOUD row (a paid provider, not
+ * "this machine's server"). The template's default provider row is added only when no row already
+ * has its URL.
+ */
+export function mergeOllamaServerBackends(existing, fresh, { isCloud } = {}) {
+  const cloud = typeof isCloud === "function" ? isCloud : () => false;
+  const norm = (u) => String(u ?? "").trim().replace(/\/+$/, "").toLowerCase();
+  const rows = Array.isArray(existing) ? existing.filter(Boolean) : [];
+  const replaced = rows.filter((b) => b.kind === "ollama" && !cloud(b.url));
+  const kept = rows.filter((b) => !(b.kind === "ollama" && !cloud(b.url)));
+  const out = [];
+  for (const f of Array.isArray(fresh) ? fresh : []) {
+    if (f.kind === "ollama") {
+      const id = replaced.find((b) => b.id)?.id;
+      out.push(id ? { ...f, id } : f);
+    }
+  }
+  out.push(...kept);
+  for (const f of Array.isArray(fresh) ? fresh : []) {
+    if (f.kind !== "ollama" && !out.some((b) => norm(b.url) === norm(f.url))) out.push(f);
+  }
+  return out;
+}

package/gu-repl.mjs

@@ -4721,12 +4721,13 @@ async function reconfigureOllamaServer() {
     const res = await withPendingStatus(`loading models from ${n.host}`, () =>
       proxyFetch(os.tagsUrlFor(n), { signal: AbortSignal.timeout(8000) })
     );
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    // The status is kept: a 404 here means "answered, but not an Ollama" (#43), not "unreachable".
+    if (!res.ok) throw Object.assign(new Error(`HTTP ${res.status}`), { httpStatus: res.status });
     return am.parseOllamaTags(await res.json().catch(() => null));
   };
 
   /** Ask for one server and load it. Returns {normalized, models} or null (declined/failed). */
-  const askServer = async (label, dflt, { require = false, short = "server" } = {}) => {
+  const askServer = async (label, dflt, { require = false, short = "server", role = "coder" } = {}) => {
     for (let attempt = 0; attempt < 3; attempt++) {
       // The address goes ABOVE, in full — it is long, it is the thing Enter accepts, and the
       // frozen row is too narrow to hold it without truncating exactly that. The row itself
@@ -4766,6 +4767,12 @@ async function reconfigureOllamaServer() {
         }
       }
       if (!n) {
+        if (lastErr?.httpStatus === 404) {
+          // IT ANSWERED — it is simply not an Ollama (#43). "Couldn't reach … is Ollama listening"
+          // sent people to debug a server that was working.
+          for (const l of am.describeNotOllama(candidates[0].host, role)) console.log(yellow(`  ${l}`));
+          continue;
+        }
         // One address typed, one failure reported — naming every candidate would be two errors
         // for one mistake, and neither would be the address they gave.
         console.log(red(`  couldn't reach ${candidates[0].host}: ${os.networkReason(lastErr)}`));
@@ -4795,18 +4802,31 @@ async function reconfigureOllamaServer() {
     return null;
   };
 
+  // AN AGENT ON A PROVIDER IS NOT ASKED ABOUT HERE (#43). This flow is for Ollama boxes; offering
+  // https://api.openai.com as the "agent + embedding server" could only fail its /api/tags probe and
+  // ask again. Keep it, say where it is changed, and go on to the coder.
+  const agentOnProvider = am.agentIsOnProvider(settings);
   const curAgent =
     String(settings.agentModelUrl ?? "").trim() || "https://ollama1.gomarsic.cc/v1";
-  const curCode = String(settings.agentCodingModelUrl ?? "").trim() || curAgent;
+  const curCode = am.coderServerDefault(settings);
 
-  console.log(dim("  TWO servers may be used: the agent + embedder on one, the coder on another."));
-  console.log(dim("  Enter keeps the current address; type 'no' to skip a role."));
-  const agent = await askServer("Agent + embedding server", curAgent, {
-    require: true,
-    short: "agent + embed server",
-  });
+  let agent = null;
+  if (agentOnProvider) {
+    const host = hostOf(String(settings.agentModelUrl ?? ""));
+    console.log(dim(`  The agent model is on ${host} (OpenAI-compatible) — kept as it is; change it with /agent-model.`));
+    console.log(dim("  Enter keeps the current address; type 'no' to skip."));
+  } else {
+    console.log(dim("  TWO servers may be used: the agent + embedder on one, the coder on another."));
+    console.log(dim("  Enter keeps the current address; type 'no' to skip a role."));
+    agent = await askServer("Agent + embedding server", curAgent, {
+      require: true,
+      short: "agent + embed server",
+      role: "agent",
+    });
+  }
   const coder = await askServer("Coding-model server", agent?.normalized?.url ?? curCode, {
     short: "coding server",
+    role: "coder",
   });
 
   if (!agent && !coder) {
@@ -4912,12 +4932,18 @@ async function reconfigureOllamaServer() {
       agentCodingModelName: code,
       agentCodingModelKind: "ollama",
       agentCodingDefaultKind: "ollama",
-      agentCodingBackends: (await import("./client-expert-api.mjs")).codingBackendsForClientExpert({
-        url: coder.normalized.url,
-        chat: agent ? chat : code,
-        code,
-        altCoders: extras,
-      }),
+      // MERGED, not replaced (#43): the providers already configured — and the keys bound to them —
+      // survive choosing a new Ollama server.
+      agentCodingBackends: (await import("./client-expert-api.mjs")).mergeOllamaServerBackends(
+        (await import("./coding-provider-setup.mjs")).existingBackendRows(settings),
+        (await import("./client-expert-api.mjs")).codingBackendsForClientExpert({
+          url: coder.normalized.url,
+          chat: agent ? chat : code,
+          code,
+          altCoders: extras,
+        }),
+        { isCloud: (await import("./coding-key-prompt.mjs")).isOllamaCloudUrl }
+      ),
     });
   }
 
@@ -5459,6 +5485,14 @@ async function addCodingProvider(roleName = "coding") {
     // ALREADY CONFIGURED is its own answer. Saving a second row for the same URL would give the
     // picker two rows that are identical in everything a person can see.
     const clash = existing.find((b) => ps.ensureV1Root(String(b.url ?? "")) === r.url);
+    if (clash && roleName === "agent") {
+      // FOR THE AGENT, "already configured" IS THE ANSWER, NOT A REFUSAL (#40). The provider and
+      // its key may well be there already; what is missing is the agent pointing at it. Sending the
+      // user to /model — the CODING picker — left no way to finish from here.
+      console.log(GUTTER + dim(`${r.host} is already configured — using it for the agent.`));
+      await pointAgentAtProvider(clash, r.host);
+      return;
+    }
     if (clash) {
       console.log(GUTTER + dim(`${r.host} is already configured here — pick its model in /model.`));
       continue;
@@ -5998,6 +6032,212 @@ async function chooseEmbedModel() {
   console.log(dim(`    Make sure it is pulled there:  ollama pull ${chosen}\n`));
 }
 
+/** Save the agent model on this machine: the URL the API sends turns to, and the model name. */
+async function saveAgentModel(agentUrl, model, host) {
+  const md = await import("./model-doctor.mjs");
+  const ok = await withPendingStatus("pointing the agent model at it", () =>
+    md.saveWorkerSettings(apiBase, workerKey, { agentModelUrl: agentUrl, agentModelName: model, agentModel: model })
+  );
+  if (!ok) {
+    console.log(red(`  couldn't save the agent model — nothing changed.`));
+    console.log(GUTTER + dim("if this machine's local API is old, restart it with `gu api restart`.\n"));
+    return false;
+  }
+  console.log(accent(`  ✓ agent model → ${model}`) + dim(`  · ${host}`));
+  console.log(dim("    takes effect on your next question.\n"));
+  return true;
+}
+
+/** Ask for a key and store it BOUND to this provider row. Returns the secret, or "" if cancelled. */
+async function askKeyForRow(row, host) {
+  console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
+  const name = (await ask("  key name: ")).trim();
+  console.log(GUTTER + dim(SECRET_KEY_HINT));
+  const secret = (await askSecret(`  API key for ${host}${name ? ` (${name})` : ""}: `)).trim();
+  if (!secret) {
+    console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+    return "";
+  }
+  const id = await withPendingStatus("saving the key", () => addCodingKey(name, secret, String(row?.id ?? "")));
+  if (!id) {
+    console.log(red("  couldn't save the key — nothing changed.\n"));
+    return "";
+  }
+  return secret;
+}
+
+/** #40: the key was the problem — enter it, then list again. */
+async function enterAgentProviderKey(row, host) {
+  if (!row) return;
+  if (!(await askKeyForRow(row, host))) return;
+  await chooseAgentModel();
+}
+
+/**
+ * #40: point the agent at a provider that is ALREADY configured — its key if it has none (or a
+ * rejected one), its model list, and the agent settings.
+ */
+async function pointAgentAtProvider(row, host) {
+  const ps = await import("./coding-provider-setup.mjs");
+  const am = await import("./agent-model-command.mjs");
+  const { proxyFetch } = await import("./proxy-dispatcher.mjs");
+  const url = ps.ensureV1Root(String(row.url ?? ""));
+  let key = (await withPendingStatus(`reading the key for ${host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
+  if (!key) {
+    console.log(GUTTER + dim(`no API key is stored for ${host} yet.`));
+    key = await askKeyForRow(row, host);
+    if (!key) return;
+  }
+  const list = async (k) =>
+    withPendingStatus(`asking ${host} for its models`, async () => {
+      try {
+        const res = await proxyFetch(ps.modelsUrlFor(url), { headers: am.agentListHeaders(k), signal: AbortSignal.timeout(12_000) });
+        return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
+      } catch (err) {
+        return { err };
+      }
+    });
+  let probe = await list(key);
+  if (probe.status === 401 || probe.status === 403) {
+    console.log(yellow(`  ${host} rejected the stored key (HTTP ${probe.status}) — enter the right one.`));
+    key = await askKeyForRow(row, host);
+    if (!key) return;
+    probe = await list(key);
+  }
+  let models = [];
+  if (probe.body) {
+    models = am.agentModelsFromProvider(probe.body).map((m) => m.model);
+  } else {
+    for (const l of ps.describeProbeFailure(probe).lines) console.log(GUTTER + yellow(l));
+    console.log(GUTTER + dim("carrying on — you can type the model id yourself."));
+  }
+  const model = models.length ? await chooseFromModelList(models, "Which model talks?", 0) : (await ask("  model id: ")).trim();
+  if (!model) {
+    console.log(dim("  (cancelled — nothing was saved)\n"));
+    return;
+  }
+  await saveAgentModel(url, model, host);
+}
+
+/**
+ * #41: the agent model on an OLLAMA server — this machine's, a LAN box, or the Ollama cloud.
+ *
+ * Local and LAN Ollama take no key: the agent URL and model are saved, and the API sends its
+ * placeholder, which Ollama ignores. The CLOUD (https://ollama.com) needs one, and the API finds an
+ * agent's key through the provider row whose URL matches — so a cloud server reuses the row that is
+ * already there (a kimi-k3 coder on ollama.com has one), or gets one, with the key bound to it.
+ */
+async function addOllamaAgent() {
+  const am = await import("./agent-model-command.mjs");
+  const ps = await import("./coding-provider-setup.mjs");
+  const md = await import("./model-doctor.mjs");
+  const { proxyFetch } = await import("./proxy-dispatcher.mjs");
+  const settings = await withPendingStatus("reading your model settings", fetchWorkerSettings);
+  if (!settings) {
+    console.log(red("  couldn't reach the API to read your current settings.\n"));
+    return;
+  }
+  const dflt = am.ollamaAgentDefault(settings);
+  console.log(dim("  An Ollama server: this machine, a box on your network, or https://ollama.com (needs a key)."));
+  console.log(dim(`  Enter uses ${dflt}  ·  Esc cancels\n`));
+
+  let target = null;
+  for (let attempt = 0; attempt < 3 && !target; attempt++) {
+    const typed = (await ask("  Ollama server: ")).trim();
+    const r = am.ollamaAgentUrl(typed || dflt);
+    if (!r.ok) {
+      console.log(GUTTER + dim(`"${typed}" is ${r.why} — try host:port, e.g. 127.0.0.1:11434`));
+      continue;
+    }
+    target = r;
+  }
+  if (!target) {
+    console.log(dim("  (nothing saved)\n"));
+    return;
+  }
+
+  // THE CLOUD NEEDS A KEY, and the key has to belong to a provider row with this URL.
+  const existing = ps.existingBackendRows(settings);
+  let row = target.cloud
+    ? existing.find((b) => ps.ensureV1Root(String(b.url ?? "")).toLowerCase() === target.agentUrl.toLowerCase()) ?? null
+    : null;
+  let key = "";
+  let newRow = null;
+  if (target.cloud) {
+    if (row) key = (await withPendingStatus(`reading the key for ${target.host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
+    if (!key) {
+      if (!row) {
+        if (existing.length >= ps.MAX_BACKENDS) {
+          console.log(yellow(`  ${ps.MAX_BACKENDS} providers is the limit — remove one in web Settings → Agent first.\n`));
+          return;
+        }
+        newRow = { id: ps.mintProviderId(existing.map((b) => String(b.id ?? ""))), kind: "ollama", enabled: true, url: target.agentUrl, defaultModel: "", models: [] };
+      }
+      console.log(GUTTER + dim(`${target.host} is the Ollama cloud — it needs an API key.`));
+      console.log(GUTTER + dim(SECRET_KEY_HINT));
+      key = (await askSecret(`  API key for ${target.host}: `)).trim();
+      if (!key) {
+        console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+        return;
+      }
+    }
+  }
+
+  // ITS MODELS, LIVE — with the key when it is the cloud.
+  const probe = await withPendingStatus(`asking ${target.host} for its models`, async () => {
+    try {
+      const res = await proxyFetch(target.tagsUrl, { headers: am.agentListHeaders(key), signal: AbortSignal.timeout(12_000) });
+      return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
+    } catch (err) {
+      return { err: err?.name === "TimeoutError" ? "no response in 12s" : (err?.message ?? String(err)) };
+    }
+  });
+  if (!probe.body) {
+    const why = probe.status ? `HTTP ${probe.status}` : probe.err;
+    console.log(red(`  couldn't list the models on ${target.host} — ${why}.`));
+    if (probe.status === 401 || probe.status === 403) console.log(GUTTER + dim("the key was rejected — nothing was saved.\n"));
+    else console.log(GUTTER + dim("check the server is running and reachable (and /proxy if this machine needs one) — nothing was saved.\n"));
+    return;
+  }
+  const models = am.parseOllamaTags(probe.body);
+  if (!models.length) {
+    console.log(yellow(`  ${target.host} answered but lists no models — pull one there first (ollama pull …).\n`));
+    return;
+  }
+  const rows = am.agentModelRows(models, am.currentAgentModel(settings));
+  console.log(dim(`  ${models.length} on ${target.root}  (${PICK_HINT}):`));
+  const idx = await pickFromList(
+    rows.map((r) => r.model + (r.embedder ? dim("  · embedding model, not for chat") : "") + (r.current ? accent("  (current)") : "")),
+    Math.max(0, rows.findIndex((r) => r.current))
+  );
+  if (idx < 0) {
+    console.log(dim("  (cancelled — nothing was saved)\n"));
+    return;
+  }
+  const model = rows[idx].model;
+
+  // SAVE: the cloud's row and key first (the agent's key is found through them), then the agent.
+  if (newRow) {
+    const ok = await withPendingStatus("saving the Ollama cloud provider", () =>
+      md.saveWorkerSettings(apiBase, workerKey, { agentCodingBackends: [...existing, { ...newRow, defaultModel: model }] })
+    );
+    if (!ok) {
+      console.log(red("  couldn't save the provider — nothing changed.\n"));
+      return;
+    }
+    row = newRow;
+    console.log(GUTTER + dim(`${target.host} is also offered in /model now.`));
+  }
+  if (target.cloud && key && !(await fetchCodingKey(String(row?.id ?? ""))).key) {
+    const id = await withPendingStatus("saving the key", () => addCodingKey("Ollama cloud", key, String(row?.id ?? "")));
+    if (!id) {
+      console.log(red("  couldn't save the key — the agent was not changed.\n"));
+      return;
+    }
+  }
+  await saveAgentModel(target.agentUrl, model, target.host);
+}
+
 /**
  * `/agent-model` — switch the model that TALKS, from what the Ollama box actually has (#169).
  *
@@ -6029,7 +6269,23 @@ async function chooseAgentModel() {
   let models = [];
   let failure = null;
   let proxied = false;
-  if (!url) {
+  // THE KEY, WHEN THIS PROVIDER NEEDS ONE (#40). The list used to be fetched with no Authorization
+  // at all, so api.openai.com answered 401 however right the stored key was. Asked for the key
+  // bound to THIS provider row — the same one the API will send with each turn.
+  const needsKey = am.agentSourceNeedsKey(source);
+  const listHost = url ? hostOf(url) : "";
+  let listKey = "";
+  let keyProblem = false;
+  if (needsKey) {
+    listKey = (await withPendingStatus(`reading the key for ${listHost}`, () => fetchCodingKey(String(source.row?.id ?? "")))).key;
+    if (!listKey) {
+      keyProblem = true;
+      failure = `no API key is stored for ${listHost}`;
+    }
+  }
+  if (failure) {
+    // already decided — no request without the key it needs
+  } else if (!url) {
     failure = "no agent model URL is configured for this machine";
   } else {
     try {
@@ -6041,9 +6297,10 @@ async function chooseAgentModel() {
       // terminal that ignored the command. The host is named in the label because on a slow
       // one that IS the useful information while you wait.
       const r = await withPendingStatus(`asking ${hostOf(url)} for its models`, () =>
-        proxyFetch(url, { signal: AbortSignal.timeout(10000) })
+        proxyFetch(url, { headers: am.agentListHeaders(listKey), signal: AbortSignal.timeout(10000) })
       );
       if (!r.ok) failure = `HTTP ${r.status}`;
+      if (!r.ok && needsKey && (r.status === 401 || r.status === 403)) keyProblem = true;
       else models = am.agentModelsFromBody(source.dialect, await r.json().catch(() => null));
       // A 200 with nothing in it is not a working list. Saying "the box answered but listed no
       // models" is a different diagnosis from "unreachable", and the user can act on it.
@@ -6061,11 +6318,18 @@ async function chooseAgentModel() {
     // printed the diagnosis and stopped, leaving no way forward from the place the problem was
     // found. /model had the same dead end before #223, and this is the same remedy: offer the
     // way out from where the reader already is.
+    if (keyProblem) console.log(GUTTER + dim(`${listHost} needs an API key — enter one below to list its models.`));
+    // By ACTION, not by position: the key entry is only there when a key is the problem (#40), and
+    // the Ollama entry is new (#41) — indices would mean different things on different days.
+    const options = am.agentRecoveryOptions({ keyProblem, host: listHost });
     const go = await pickFromList(
-      [dim("leave it"), "add an OpenAI-compatible provider for the agent…"],
-      1
+      options.map((o, i) => (i === 0 ? dim(o.label) : o.label)),
+      keyProblem ? 1 : 0
     );
-    if (go === 1) await addCodingProvider("agent");
+    const action = go >= 0 ? options[go].action : "leave";
+    if (action === "key") await enterAgentProviderKey(source.row, listHost);
+    else if (action === "ollama") await addOllamaAgent();
+    else if (action === "provider") await addCodingProvider("agent");
     else console.log("");
     return;
   }
@@ -6101,17 +6365,23 @@ async function chooseAgentModel() {
   // because "which model on the box I am pointed at" and "I want a different provider" are
   // different questions, and only the first is answered by the rows above.
   labels.push("add an OpenAI-compatible provider for the agent…");
+  // #41, appended AFTER the provider entry so no existing index moves.
+  labels.push("use an Ollama server for the agent…");
   const idx = await pickFromList(labels, Math.max(0, rows.findIndex((r) => r.current)));
   if (idx < 0) {
     console.log(dim("  (cancelled)\n"));
     return;
   }
-  // labels is now ONE LONGER than rows. Reading rows[idx] for the appended entry would
-  // dereference undefined and take the picker down, so it is answered before rows is touched.
+  // labels is now TWO LONGER than rows. Reading rows[idx] for an appended entry would
+  // dereference undefined and take the picker down, so they are answered before rows is touched.
   if (idx === rows.length) {
     await addCodingProvider("agent");
     return;
   }
+  if (idx === rows.length + 1) {
+    await addOllamaAgent();
+    return;
+  }
   const chosen = rows[idx].model;
   if (chosen === current) {
     console.log(dim(`  already using ${current} — nothing changed.\n`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.698",
+  "version": "1.0.700",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",