@tiens.nguyen/gu-cli 1.0.703 → 1.0.704

package/agent-model-command.mjs

@@ -466,3 +466,37 @@ export function agentProviderChoices(settings) {
   out.push({ action: "add", label: "add a new OpenAI-compatible provider…" });
   return out;
 }
+
+// ---------------------------------------------------------------------------------------------
+// The Ollama CLOUD's key is its OWN — and a key is never a key's name.
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * The key saved FOR this provider row, or null.
+ *
+ * Reported: /agent-model → Ollama → https://ollama.com listed "20 on https://ollama.com" and saved the
+ * agent without asking for a key; the coder on ollama.com then failed "REJECTED the coding API key".
+ * Two things hid it. ollama.com's /api/tags is PUBLIC (200 with no key), so a successful list proves
+ * nothing about a key. And "a key for this provider" counted UNBOUND keys — by design usable with any
+ * OpenAI-compatible provider — so the account's sk-… key was taken as ollama.com's, and refused there.
+ * For the Ollama cloud only a key BOUND to its row counts.
+ */
+export function boundKeyFor(keys, rowId) {
+  const id = String(rowId ?? "").trim();
+  if (!id || !Array.isArray(keys)) return null;
+  return keys.find((k) => k && k.backendId === id) ?? null;
+}
+
+/**
+ * Does what was typed as a key's NAME look like the key itself?
+ *
+ * Reported in the same log: a key named "sk-E8Iv…3E66" — the secret pasted into the name prompt — is
+ * printed in full wherever keys are listed ("API key sk-E8Iv…  ····3E66"). Names are shown; secrets
+ * must not be. Caught on the known prefixes, and on anything long, unbroken and mixed like a token.
+ */
+export function looksLikeSecret(name) {
+  const v = String(name ?? "").trim();
+  if (!v) return false;
+  if (/^(sk-|sk_|pk-|rk-|ghp_|gho_|github_pat_|xox[abp]-|AKIA|AIza|hf_|gsk_|ollama_)/i.test(v)) return true;
+  return v.length >= 24 && !/\s/.test(v) && /[A-Za-z]/.test(v) && /\d/.test(v);
+}

package/client-expert-api.mjs

@@ -753,14 +753,17 @@ export function mergeOllamaServerBackends(existing, fresh, { isCloud } = {}) {
   const cloud = typeof isCloud === "function" ? isCloud : () => false;
   const norm = (u) => String(u ?? "").trim().replace(/\/+$/, "").toLowerCase();
   const rows = Array.isArray(existing) ? existing.filter(Boolean) : [];
-  const replaced = rows.filter((b) => b.kind === "ollama" && !cloud(b.url));
-  const kept = rows.filter((b) => !(b.kind === "ollama" && !cloud(b.url)));
+  const freshOllama = (Array.isArray(fresh) ? fresh : []).filter((f) => f.kind === "ollama");
+  const newUrls = new Set(freshOllama.map((f) => norm(f.url)));
+  // A row already at the NEW server's URL is the same provider — the new server takes it over, id and
+  // all, so a key bound to it (the Ollama cloud's own key) keeps working and no twin row appears.
+  const sameServer = rows.filter((b) => newUrls.has(norm(b.url)));
+  const replaced = [...sameServer, ...rows.filter((b) => b.kind === "ollama" && !cloud(b.url) && !sameServer.includes(b))];
+  const kept = rows.filter((b) => !replaced.includes(b));
   const out = [];
-  for (const f of Array.isArray(fresh) ? fresh : []) {
-    if (f.kind === "ollama") {
-      const id = replaced.find((b) => b.id)?.id;
-      out.push(id ? { ...f, id } : f);
-    }
+  for (const f of freshOllama) {
+    const id = (sameServer.find((b) => b.id && norm(b.url) === norm(f.url)) ?? replaced.find((b) => b.id))?.id;
+    out.push(id ? { ...f, id } : f);
   }
   out.push(...kept);
   for (const f of Array.isArray(fresh) ? fresh : []) {

package/gu-repl.mjs

@@ -112,7 +112,7 @@ import {
   shouldCancelPrompt,
 } from "./terminal-layout.mjs";
 import { completedFlush } from "./completed-flush.mjs";
-import { codingBannerLabel, SECRET_KEY_HINT } from "./coding-key-prompt.mjs";
+import { codingBannerLabel, isOllamaCloudUrl, SECRET_KEY_HINT } from "./coding-key-prompt.mjs";
 import { codingChoiceTags, coderDisplayName, ollamaWhere } from "./coding-choice-tags.mjs";
 import {
   isDoubleClick,
@@ -4955,6 +4955,28 @@ async function reconfigureOllamaServer() {
     console.log(GUTTER + dim("if this machine's local API is old, restart it with `gu api restart`.\n"));
     return;
   }
+  // THE OLLAMA CLOUD NEEDS ITS OWN KEY. Reported: choosing https://ollama.com here listed its 20 models
+  // (that list is public) and saved, without a key — and the next turn failed "REJECTED the coding API
+  // key", having borrowed an unrelated sk-… key. Asked for now, bound to the row just saved.
+  {
+    const cloudUrls = [coder?.normalized?.url, agent?.normalized?.url].filter(
+      (u, i, all) => u && all.indexOf(u) === i && isOllamaCloudUrl(u)
+    );
+    if (cloudUrls.length) {
+      const fresh = await withPendingStatus("checking the Ollama cloud key", fetchWorkerSettings);
+      const keys = await fetchCodingKeys();
+      const ps = await import("./coding-provider-setup.mjs");
+      for (const u of cloudUrls) {
+        const row = ps
+          .existingBackendRows(fresh ?? {})
+          .find((b) => ps.ensureV1Root(String(b.url ?? "")).toLowerCase() === ps.ensureV1Root(u).toLowerCase());
+        if (row && !am.boundKeyFor(keys, row.id)) {
+          console.log(yellow(`  ${hostOf(u)} is the Ollama cloud — it needs its own API key (the model list worked without one).`));
+          await askKeyForRow(row, hostOf(u));
+        }
+      }
+    }
+  }
   // THE ACCOUNT DEFAULT JUST CHANGED — say so in memory, or the bar reports the old one.
   //
   // The override is cleared just below, correctly: what was picked here IS the account default
@@ -5514,7 +5536,7 @@ async function addCodingProvider(roleName = "coding") {
   // NOT DEFAULTED, by request. An empty name becomes "Unknown" at the API, which is the same
   // thing every other add-a-key path produces — the URL default was asked for, this was not.
   console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
-  const name = (await ask("  key name: ")).trim();
+  const name = await askKeyName();
   console.log(GUTTER + dim(SECRET_KEY_HINT));
   const secret = (await askSecret(`  API key${name ? ` for ${name}` : ""}: `)).trim();
   if (!secret) {
@@ -6048,10 +6070,25 @@ async function saveAgentModel(agentUrl, model, host) {
   return true;
 }
 
+/**
+ * Ask for a key's NAME — and refuse the key itself as a name: names are printed wherever keys are
+ * listed, so a pasted secret there is a secret on screen (reported: "API key sk-E8Iv…  ····3E66").
+ */
+async function askKeyName(prompt = "  key name: ") {
+  const am = await import("./agent-model-command.mjs");
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const name = (await ask(prompt)).trim();
+    if (!am.looksLikeSecret(name)) return name;
+    console.log(yellow("  that looks like the API key itself — the NAME is shown on screen, so it must not be the key."));
+    console.log(GUTTER + dim('type a short label like "work", or press Enter for none — the key comes next.'));
+  }
+  return "";
+}
+
 /** Ask for a key and store it BOUND to this provider row. Returns the secret, or "" if cancelled. */
 async function askKeyForRow(row, host) {
   console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
-  const name = (await ask("  key name: ")).trim();
+  const name = await askKeyName();
   console.log(GUTTER + dim(SECRET_KEY_HINT));
   const secret = (await askSecret(`  API key for ${host}${name ? ` (${name})` : ""}: `)).trim();
   if (!secret) {
@@ -6186,9 +6223,15 @@ async function addOllamaAgent() {
     : null;
   let key = "";
   let newRow = null;
+  let hasBoundKey = false;
   if (target.cloud) {
-    if (row) key = (await withPendingStatus(`reading the key for ${target.host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
-    if (!key) {
+    // A KEY SAVED FOR THIS PROVIDER — not any key the account holds. ollama.com's model list answers
+    // without a key, so listing cannot catch a borrowed one; only asking can.
+    if (row) {
+      const keys = await withPendingStatus(`reading the keys for ${target.host}`, fetchCodingKeys);
+      hasBoundKey = Boolean(am.boundKeyFor(keys, row.id));
+    }
+    if (!hasBoundKey) {
       if (!row) {
         if (existing.length >= ps.MAX_BACKENDS) {
           console.log(yellow(`  ${ps.MAX_BACKENDS} providers is the limit — remove one in web Settings → Agent first.\n`));
@@ -6251,7 +6294,7 @@ async function addOllamaAgent() {
     row = newRow;
     console.log(GUTTER + dim(`${target.host} is also offered in /model now.`));
   }
-  if (target.cloud && key && !(await fetchCodingKey(String(row?.id ?? ""))).key) {
+  if (target.cloud && key && !hasBoundKey) {
     const id = await withPendingStatus("saving the key", () => addCodingKey("Ollama cloud", key, String(row?.id ?? "")));
     if (!id) {
       console.log(red("  couldn't save the key — the agent was not changed.\n"));
@@ -7191,7 +7234,7 @@ async function deleteCodingKey(id) {
  */
 async function promptNewCodingKey(backendId = "", provider = "") {
   console.log("\n" + GUTTER + dim("A name just tells them apart — \"work\", \"personal\".\n"));
-  const name = (await ask("  Name for this key: ")).trim();
+  const name = await askKeyName("  Name for this key: ");
   console.log(GUTTER + dim(SECRET_KEY_HINT));
   const secret = (await askSecret(`  API key${name ? ` for ${name}` : ""}: `)).trim();
   if (!secret) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.703",
+  "version": "1.0.704",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",