@tiens.nguyen/gu-cli 1.0.703 → 1.0.705

package/agent-model-command.mjs

@@ -466,3 +466,37 @@ export function agentProviderChoices(settings) {
   out.push({ action: "add", label: "add a new OpenAI-compatible provider…" });
   return out;
 }
+
+// ---------------------------------------------------------------------------------------------
+// The Ollama CLOUD's key is its OWN — and a key is never a key's name.
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * The key saved FOR this provider row, or null.
+ *
+ * Reported: /agent-model → Ollama → https://ollama.com listed "20 on https://ollama.com" and saved the
+ * agent without asking for a key; the coder on ollama.com then failed "REJECTED the coding API key".
+ * Two things hid it. ollama.com's /api/tags is PUBLIC (200 with no key), so a successful list proves
+ * nothing about a key. And "a key for this provider" counted UNBOUND keys — by design usable with any
+ * OpenAI-compatible provider — so the account's sk-… key was taken as ollama.com's, and refused there.
+ * For the Ollama cloud only a key BOUND to its row counts.
+ */
+export function boundKeyFor(keys, rowId) {
+  const id = String(rowId ?? "").trim();
+  if (!id || !Array.isArray(keys)) return null;
+  return keys.find((k) => k && k.backendId === id) ?? null;
+}
+
+/**
+ * Does what was typed as a key's NAME look like the key itself?
+ *
+ * Reported in the same log: a key named "sk-E8Iv…3E66" — the secret pasted into the name prompt — is
+ * printed in full wherever keys are listed ("API key sk-E8Iv…  ····3E66"). Names are shown; secrets
+ * must not be. Caught on the known prefixes, and on anything long, unbroken and mixed like a token.
+ */
+export function looksLikeSecret(name) {
+  const v = String(name ?? "").trim();
+  if (!v) return false;
+  if (/^(sk-|sk_|pk-|rk-|ghp_|gho_|github_pat_|xox[abp]-|AKIA|AIza|hf_|gsk_|ollama_)/i.test(v)) return true;
+  return v.length >= 24 && !/\s/.test(v) && /[A-Za-z]/.test(v) && /\d/.test(v);
+}

package/client-expert-api.mjs

@@ -753,14 +753,17 @@ export function mergeOllamaServerBackends(existing, fresh, { isCloud } = {}) {
   const cloud = typeof isCloud === "function" ? isCloud : () => false;
   const norm = (u) => String(u ?? "").trim().replace(/\/+$/, "").toLowerCase();
   const rows = Array.isArray(existing) ? existing.filter(Boolean) : [];
-  const replaced = rows.filter((b) => b.kind === "ollama" && !cloud(b.url));
-  const kept = rows.filter((b) => !(b.kind === "ollama" && !cloud(b.url)));
+  const freshOllama = (Array.isArray(fresh) ? fresh : []).filter((f) => f.kind === "ollama");
+  const newUrls = new Set(freshOllama.map((f) => norm(f.url)));
+  // A row already at the NEW server's URL is the same provider — the new server takes it over, id and
+  // all, so a key bound to it (the Ollama cloud's own key) keeps working and no twin row appears.
+  const sameServer = rows.filter((b) => newUrls.has(norm(b.url)));
+  const replaced = [...sameServer, ...rows.filter((b) => b.kind === "ollama" && !cloud(b.url) && !sameServer.includes(b))];
+  const kept = rows.filter((b) => !replaced.includes(b));
   const out = [];
-  for (const f of Array.isArray(fresh) ? fresh : []) {
-    if (f.kind === "ollama") {
-      const id = replaced.find((b) => b.id)?.id;
-      out.push(id ? { ...f, id } : f);
-    }
+  for (const f of freshOllama) {
+    const id = (sameServer.find((b) => b.id && norm(b.url) === norm(f.url)) ?? replaced.find((b) => b.id))?.id;
+    out.push(id ? { ...f, id } : f);
   }
   out.push(...kept);
   for (const f of Array.isArray(fresh) ? fresh : []) {

package/gonext_agent_chat.py

@@ -1329,6 +1329,11 @@ def _render_numbered_tool_list(tools) -> str:
     return ("\n".join(lines) + "\n") if lines else ""
 
 
+# A step line only `gu --verbose` shows (#45): retry notices and context trimming are how the
+# agent keeps itself going, and the user can do nothing with them.
+_VERBOSE_PREFIX = "__VERBOSE__::"
+
+
 def _summarise_step(step_log):
     """Return a short human-readable description of an agent step."""
     tool_calls = getattr(step_log, "tool_calls", None) or []
@@ -1337,6 +1342,9 @@ def _summarise_step(step_log):
     step_num = getattr(step_log, "step_number", None)
 
     parts = []
+    # A retry the agent recovers from by itself is machinery, not progress: the terminal shows
+    # it only under `gu --verbose` (#45). The model still gets smolagents' exact error text.
+    verbose_only = False
     for tc in tool_calls:
         name = getattr(tc, "name", "")
         args = getattr(tc, "arguments", None)
@@ -1404,15 +1412,18 @@ def _summarise_step(step_log):
             # step loop), so the model keeps the precise wording it needs to self-correct.
             _msg = "the model wrote no code this step — asking again"
             parts.append(f"→ {_msg}" if parts else _msg)
+            verbose_only = True
         elif "code parsing failed" in err.lower() or "syntaxerror" in err.lower():
             # The sibling shape: there WAS a block, and its body would not compile.
             _msg = "the model's code wouldn't run — asking again"
             parts.append(f"→ {_msg}" if parts else _msg)
+            verbose_only = True
         else:
             parts.append(f"→ Error: {_clip(err, 160)}")
 
     # No numeric "Step N:" prefix — show only the semantic action.
-    return (" | ".join(parts) if parts else "thinking…")
+    text = " | ".join(parts) if parts else "thinking…"
+    return f"{_VERBOSE_PREFIX}{text}" if verbose_only else text
 
 
 # Keywords that strongly indicate the user wants to make an HTTP/network request,
@@ -8689,7 +8700,7 @@ def run_agent_chat(cfg):
             # once, and that answer is remembered. The line exists so the figure is not mistaken
             # for something the endpoint reported — see the "measured vs remembered" note above.
             _emit({"type": "step", "text": (
-                f"context window {_ctx_window // 1000}k for {coding_model_id} (published default — "
+                f"{_VERBOSE_PREFIX}context window {_ctx_window // 1000}k for {coding_model_id} (published default — "
                 f"this endpoint does not report one). Corrects itself only if it is too HIGH; "
                 f"/context-window to set it yourself")})
     else:
@@ -8705,7 +8716,7 @@ def run_agent_chat(cfg):
         # command immediately and cannot act on an env var without leaving, editing a file and
         # restarting — which is how this stayed unset long enough to matter.
         _emit({"type": "step", "text": (
-            f"context window unknown — compacting at ~{_compact_at // 1000}k tokens; "
+            f"{_VERBOSE_PREFIX}context window unknown — compacting at ~{_compact_at // 1000}k tokens; "
             "run /context-window <tokens> to use more")})
 
     # Task #90 Phase 3 — completion gate (code-enforced, complements the prompt). Fires at
@@ -8958,7 +8969,7 @@ def run_agent_chat(cfg):
                         if _cs and not _compact_state["told"]:
                             _compact_state["told"] = True
                             _emit({"type": "step", "text": (
-                                f"Context reached ~{_in_tok // 1000}k tokens — trimming older "
+                                f"{_VERBOSE_PREFIX}Context reached ~{_in_tok // 1000}k tokens — trimming older "
                                 "steps to stay fast (files are re-readable)")})
                         if _cs:
                             _log(f"context compact: saved ~{_cs} chars "
@@ -9477,9 +9488,9 @@ def run_agent_chat(cfg):
                 # to say. On empty-content there is genuinely nothing to show — the model spent
                 # the turn in its reasoning channel and wrote nothing — so a short line stays.
                 _emit({"type": "step", "text": (
-                    "The model thought but didn't act — asking it again…"
+                    f"{_VERBOSE_PREFIX}The model thought but didn't act — asking it again…"
                     if why == "empty-content"
-                    else "Asking the model to take the action it described…")})
+                    else f"{_VERBOSE_PREFIX}Asking the model to take the action it described…")})
                 retry_kwargs = dict(completion_kwargs)
                 retry_kwargs["messages"] = list(completion_kwargs.get("messages") or []) + [
                     {"role": "user", "content": self._CODE_NOW_DIRECTIVE}

package/gu-repl.mjs

@@ -112,7 +112,7 @@ import {
   shouldCancelPrompt,
 } from "./terminal-layout.mjs";
 import { completedFlush } from "./completed-flush.mjs";
-import { codingBannerLabel, SECRET_KEY_HINT } from "./coding-key-prompt.mjs";
+import { codingBannerLabel, isOllamaCloudUrl, SECRET_KEY_HINT } from "./coding-key-prompt.mjs";
 import { codingChoiceTags, coderDisplayName, ollamaWhere } from "./coding-choice-tags.mjs";
 import {
   isDoubleClick,
@@ -137,6 +137,7 @@ import { REQUIRED_AGENT_MODEL, REQUIRED_AGENT_PREFIX, REQUIRED_EMBED_MODEL } fro
 // plain SGR code: terminals disagree about colour, so accent.mjs picks 24-bit, 256 or the
 // sixteen-colour magenta from what this one actually claims to support.
 import { accent } from "./accent.mjs";
+import { isNoCodeRetry, splitVerboseLine, stepHasCode } from "./verbose-lines.mjs";
 import {
   createTranscript,
   displayRows,
@@ -4955,6 +4956,28 @@ async function reconfigureOllamaServer() {
     console.log(GUTTER + dim("if this machine's local API is old, restart it with `gu api restart`.\n"));
     return;
   }
+  // THE OLLAMA CLOUD NEEDS ITS OWN KEY. Reported: choosing https://ollama.com here listed its 20 models
+  // (that list is public) and saved, without a key — and the next turn failed "REJECTED the coding API
+  // key", having borrowed an unrelated sk-… key. Asked for now, bound to the row just saved.
+  {
+    const cloudUrls = [coder?.normalized?.url, agent?.normalized?.url].filter(
+      (u, i, all) => u && all.indexOf(u) === i && isOllamaCloudUrl(u)
+    );
+    if (cloudUrls.length) {
+      const fresh = await withPendingStatus("checking the Ollama cloud key", fetchWorkerSettings);
+      const keys = await fetchCodingKeys();
+      const ps = await import("./coding-provider-setup.mjs");
+      for (const u of cloudUrls) {
+        const row = ps
+          .existingBackendRows(fresh ?? {})
+          .find((b) => ps.ensureV1Root(String(b.url ?? "")).toLowerCase() === ps.ensureV1Root(u).toLowerCase());
+        if (row && !am.boundKeyFor(keys, row.id)) {
+          console.log(yellow(`  ${hostOf(u)} is the Ollama cloud — it needs its own API key (the model list worked without one).`));
+          await askKeyForRow(row, hostOf(u));
+        }
+      }
+    }
+  }
   // THE ACCOUNT DEFAULT JUST CHANGED — say so in memory, or the bar reports the old one.
   //
   // The override is cleared just below, correctly: what was picked here IS the account default
@@ -5514,7 +5537,7 @@ async function addCodingProvider(roleName = "coding") {
   // NOT DEFAULTED, by request. An empty name becomes "Unknown" at the API, which is the same
   // thing every other add-a-key path produces — the URL default was asked for, this was not.
   console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
-  const name = (await ask("  key name: ")).trim();
+  const name = await askKeyName();
   console.log(GUTTER + dim(SECRET_KEY_HINT));
   const secret = (await askSecret(`  API key${name ? ` for ${name}` : ""}: `)).trim();
   if (!secret) {
@@ -6048,10 +6071,25 @@ async function saveAgentModel(agentUrl, model, host) {
   return true;
 }
 
+/**
+ * Ask for a key's NAME — and refuse the key itself as a name: names are printed wherever keys are
+ * listed, so a pasted secret there is a secret on screen (reported: "API key sk-E8Iv…  ····3E66").
+ */
+async function askKeyName(prompt = "  key name: ") {
+  const am = await import("./agent-model-command.mjs");
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const name = (await ask(prompt)).trim();
+    if (!am.looksLikeSecret(name)) return name;
+    console.log(yellow("  that looks like the API key itself — the NAME is shown on screen, so it must not be the key."));
+    console.log(GUTTER + dim('type a short label like "work", or press Enter for none — the key comes next.'));
+  }
+  return "";
+}
+
 /** Ask for a key and store it BOUND to this provider row. Returns the secret, or "" if cancelled. */
 async function askKeyForRow(row, host) {
   console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
-  const name = (await ask("  key name: ")).trim();
+  const name = await askKeyName();
   console.log(GUTTER + dim(SECRET_KEY_HINT));
   const secret = (await askSecret(`  API key for ${host}${name ? ` (${name})` : ""}: `)).trim();
   if (!secret) {
@@ -6186,9 +6224,15 @@ async function addOllamaAgent() {
     : null;
   let key = "";
   let newRow = null;
+  let hasBoundKey = false;
   if (target.cloud) {
-    if (row) key = (await withPendingStatus(`reading the key for ${target.host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
-    if (!key) {
+    // A KEY SAVED FOR THIS PROVIDER — not any key the account holds. ollama.com's model list answers
+    // without a key, so listing cannot catch a borrowed one; only asking can.
+    if (row) {
+      const keys = await withPendingStatus(`reading the keys for ${target.host}`, fetchCodingKeys);
+      hasBoundKey = Boolean(am.boundKeyFor(keys, row.id));
+    }
+    if (!hasBoundKey) {
       if (!row) {
         if (existing.length >= ps.MAX_BACKENDS) {
           console.log(yellow(`  ${ps.MAX_BACKENDS} providers is the limit — remove one in web Settings → Agent first.\n`));
@@ -6251,7 +6295,7 @@ async function addOllamaAgent() {
     row = newRow;
     console.log(GUTTER + dim(`${target.host} is also offered in /model now.`));
   }
-  if (target.cloud && key && !(await fetchCodingKey(String(row?.id ?? ""))).key) {
+  if (target.cloud && key && !hasBoundKey) {
     const id = await withPendingStatus("saving the key", () => addCodingKey("Ollama cloud", key, String(row?.id ?? "")));
     if (!id) {
       console.log(red("  couldn't save the key — the agent was not changed.\n"));
@@ -7191,7 +7235,7 @@ async function deleteCodingKey(id) {
  */
 async function promptNewCodingKey(backendId = "", provider = "") {
   console.log("\n" + GUTTER + dim("A name just tells them apart — \"work\", \"personal\".\n"));
-  const name = (await ask("  Name for this key: ")).trim();
+  const name = await askKeyName("  Name for this key: ");
   console.log(GUTTER + dim(SECRET_KEY_HINT));
   const secret = (await askSecret(`  API key${name ? ` for ${name}` : ""}: `)).trim();
   if (!secret) {
@@ -8423,6 +8467,16 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
   // 400 chars — enough for a one-line label, not for the paragraphs we now print). Bounded so a
   // runaway generation cannot grow without limit; the prose we keep is far shorter anyway.
   let stepThought = "";
+  // #45: the prose of a step whose output had NO code, held back until the next line says what
+  // became of it. A no-code retry notice discards it (the model restates the plan on the retry);
+  // anything else prints it. Always null under --verbose, which shows everything as it comes.
+  let heldThought = null;
+  const releaseHeldThought = () => {
+    if (heldThought === null) return;
+    const raw = heldThought;
+    heldThought = null;
+    if (printThoughtBlock(raw, onContent)) lastWasBlank = false;
+  };
   let hoverRow = -1; // last mouse viewport row (from motion events) → highlight when it's on the thought line
   let thoughtRow = -1; // absolute viewport row of the thought line (line 1), learned via \x1b[6n
   let lastDsrAt = 0; // throttle the cursor-position probe
@@ -8851,7 +8905,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
     carry += stripThinkTags(chunk);
     let nl;
     while ((nl = carry.indexOf("\n")) >= 0) {
-      const line = carry.slice(0, nl);
+      let line = carry.slice(0, nl);
       carry = carry.slice(nl + 1);
       const alreadyFlushed = carryFlushedLen;
       carryFlushedLen = 0; // reset — `carry` now starts a fresh pending line
@@ -8864,6 +8918,21 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
         almostDone = /almost/i.test(line);
         continue;
       }
+      // #45: retry notices and context-window bookkeeping are the agent's own machinery. Shown
+      // under --verbose only; otherwise swallowed, together with the no-code false start the
+      // retry notice is about.
+      {
+        const v = splitVerboseLine(line);
+        if (v.verboseOnly) {
+          if (!REPL_VERBOSE) {
+            if (isNoCodeRetry(v.text)) heldThought = null;
+            lastContentAt = Date.now();
+            continue;
+          }
+          line = v.text;
+        }
+      }
+      if (heldThought !== null && line.trim() !== "") releaseHeldThought();
       // Task #136: a RAG index file was written. Swallow the line — it belongs in the
       // BOTTOM BAR, not in the action list — and remember the newest one. Kept out of the
       // bullet stream deliberately: indexing writes a shard per batch, so printing them
@@ -8896,7 +8965,11 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
           // The step's model output is complete. Print its reasoning HERE, before the tools
           // report what they did, so the transcript reads in the order it happened: the model
           // says what it intends, then the actions it took appear under it.
-          if (printThoughtBlock(stepThought, onContent)) lastWasBlank = false;
+          if (!REPL_VERBOSE && stepThought.trim() && !stepHasCode(stepThought)) {
+            heldThought = stepThought; // #45: decided by the next line — see releaseHeldThought
+          } else if (printThoughtBlock(stepThought, onContent)) {
+            lastWasBlank = false;
+          }
           stepThought = "";
         }
         continue;
@@ -9285,6 +9358,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
             lastWasBlank = false;
           }
         }
+        releaseHeldThought(); // #45: nothing followed it, so it was not a false start
         clearStatus();
         // Task #104: expose this turn's code-model INPUT + the CUMULATIVE output-token
         // total (all turns for this user + coding server) so the caller can print a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.703",
+  "version": "1.0.705",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -60,6 +60,7 @@
     "job-pools.mjs",
     "rag-job-config.mjs",
     "completed-flush.mjs",
+    "verbose-lines.mjs",
     "agent-model-label.mjs",
     "coding-choice-tags.mjs",
     "coding-provider-setup.mjs",

package/verbose-lines.mjs

@@ -0,0 +1,33 @@
+/**
+ * Step lines only `gu --verbose` shows (#45).
+ *
+ * The agent keeps itself going with retries ("the model wrote no code this step — asking
+ * again") and context bookkeeping ("context window 128k … published default", "Context reached
+ * ~40k tokens — trimming older steps"). The user can do nothing with either, so the agent tags
+ * them with this prefix and the terminal drops them unless it runs with --verbose.
+ */
+export const VERBOSE_PREFIX = "__VERBOSE__::";
+
+/** Untag a line: `{ verboseOnly, text }`. Lines without the prefix come back unchanged. */
+export function splitVerboseLine(line) {
+  const s = String(line ?? "");
+  return s.startsWith(VERBOSE_PREFIX)
+    ? { verboseOnly: true, text: s.slice(VERBOSE_PREFIX.length) }
+    : { verboseOnly: false, text: s };
+}
+
+/**
+ * The notice that the model's LAST reply carried no code at all. That reply's prose is then a
+ * false start: the model is asked again and restates it, so printing both shows the same plan
+ * twice around a notice the user does not need.
+ */
+export function isNoCodeRetry(text) {
+  return /wrote no code this step|thought but didn't act|take the action it described/i.test(
+    String(text ?? "")
+  );
+}
+
+/** Did a step's raw model output contain a code block? */
+export function stepHasCode(raw) {
+  return /<code[\s>]/i.test(String(raw ?? ""));
+}