@tiens.nguyen/gu-cli 1.0.716 → 1.0.718

package/embed-model-command.mjs

@@ -26,6 +26,11 @@ export const EMBED_CHOICES = [
     dims: 4096,
     note: "best recall, ~18× slower to index",
   },
+  {
+    model: "qwen3-embedding:4b",
+    dims: 2560,
+    note: "strong recall, ~3× faster to index than 8b",
+  },
   {
     model: "nomic-embed-text:latest",
     dims: 768,

package/gonext_agent_chat.py

@@ -5316,6 +5316,39 @@ def _rag_embed_failure_hint(err) -> str:
     return f"{name}: {_clip(text, 120)}"
 
 
+# The API key for the EMBEDDING endpoint, resolved once per job from the API
+# (backend id "embed-ollama" - where /embed-model stores it, same store as coding/agent
+# keys). A module global because _embed() is a tiny hot path reached through the rag_*
+# tools - passing a key down that chain just for a header would churn every signature
+# above it for no behaviour.
+_RAG_EMBED_API_KEY = ""
+
+
+def _rag_resolve_embed_api_key(api_base: str, worker_key: str) -> str:
+    """Fetch the embedding-server API key from the shared key store, or "" when none is set.
+
+    The key was typed at /embed-model and POSTed to /api/worker/coding-keys under
+    backendId="embed-ollama" - reusing the coding-keys store means it already lands in
+    every mode (local file in Client Expert, Mongo for cloud users) with no new persistence.
+    The API masks keys in settings reads but returns the real secret here precisely so the
+    daemon that holds the worker key can authenticate to the embedder. Never raises: an
+    unreachable store means "" and the embed call goes unsigned, right for a keyless local
+    Ollama.
+    """
+    base = (api_base or "").rstrip("/")
+    if not base or not worker_key:
+        return ""
+    try:
+        from urllib.parse import urlencode
+        req = urllib.request.Request(
+            f"{base}/api/worker/coding-key?{urlencode({'backendId': 'embed-ollama'})}",
+            headers={"X-Worker-Key": worker_key}, method="GET")
+        with urllib.request.urlopen(req, timeout=8, context=_ssl_context()) as resp:
+            data = json.loads(resp.read().decode("utf-8", "replace") or "{}")
+            return (data.get("apiKey") or "").strip()
+    except Exception:  # noqa: BLE001
+        return ""
+
 def _embed(base: str, model: str, texts: list) -> list:
     """Embed a batch of texts. Auto-detects the endpoint from `base` (a bare host:port,
     an .../v1, or an Ollama host): tries OpenAI-compatible /v1/embeddings first (MLX
@@ -5328,9 +5361,15 @@ def _embed(base: str, model: str, texts: list) -> list:
     last_err = None
 
     def _post(url, payload, timeout):
+        # The embedding endpoint may be a KEYED server (cloud Ollama, a gateway) - the user
+        # typed its key at /embed-model; it rides as a Bearer token. A keyless local Ollama
+        # simply has _RAG_EMBED_API_KEY empty and the header is absent as before.
+        headers = {"Content-Type": "application/json"}
+        if _RAG_EMBED_API_KEY:
+            headers["Authorization"] = f"Bearer {_RAG_EMBED_API_KEY}"
         req = urllib.request.Request(
             url, data=json.dumps(payload).encode("utf-8"),
-            headers={"Content-Type": "application/json"}, method="POST",
+            headers=headers, method="POST",
         )
         with _proxy_urlopen(req, timeout=timeout, context=ctx) as resp:
             return json.loads(resp.read().decode("utf-8", "replace"))
@@ -6948,6 +6987,12 @@ def run_agent_chat(cfg):
     # the user never chose into the logs and the status table.
     rag_embed_model = (cfg.get("ragEmbedModel") or "").strip()
     rag_embed_url = (cfg.get("ragEmbedUrl") or "").strip()
+    # The RAG embedder may be a KEYED server (task: embed api key in /embed-model). Resolve
+    # its key once, from the shared key store (backendId "embed-ollama"), so every _embed()
+    # call this job carries the Bearer header. Empty for a keyless local Ollama - _embed()
+    # then sends no Authorization, exactly the old behaviour.
+    global _RAG_EMBED_API_KEY
+    _RAG_EMBED_API_KEY = _rag_resolve_embed_api_key(worker_api_base, worker_api_key) if rag_embed_url else ""
     try:
         rag_top_k = int(cfg.get("ragTopK") or 6)
     except (TypeError, ValueError):

package/gu-repl.mjs

@@ -132,7 +132,7 @@ import {
 import { createHoverController, applyToggleShift } from "./terminal-hover.mjs";
 // The required pair, imported rather than re-typed: the startup "no models" message names them,
 // and a second copy of these strings would drift from the check that enforces them.
-import { REQUIRED_AGENT_MODEL, REQUIRED_AGENT_PREFIX, REQUIRED_EMBED_MODEL } from "./ollama-setup.mjs";
+import { REQUIRED_AGENT_MODEL, REQUIRED_AGENT_PREFIX } from "./ollama-setup.mjs";
 // The brand accent — indigo, the same token the web app paints its wordmark with. It is NOT a
 // plain SGR code: terminals disagree about colour, so accent.mjs picks 24-bit, 256 or the
 // sixteen-colour magenta from what this one actually claims to support.
@@ -781,7 +781,7 @@ const COMMANDS = [
   // what made /rag confusing, and it did the same here: reported as "why do we need /provider
   // outside, it is confused". The command still works and still does the same thing.
   { name: "/agent-model", desc: "switch the AGENT model (the one that talks) — saved on this machine" },
-  { name: "/embed-model", desc: "switch the RAG EMBEDDING model — re-indexes what is already indexed" },
+  { name: "/embed-model", desc: "switch the RAG EMBEDDING model (nomic-embed-text / qwen3-embedding) and its server — re-indexes what is already indexed; supports a remote URL + API key" },
   { name: "/test-auto", desc: "toggle auto-test (verify & fix until it passes) for this folder" },
   // ONE command, three answers. /rag-local and /rag-cloud still work — they are in people's
   // fingers — but they are HIDDEN_COMMANDS now, because offering three doors into one setting
@@ -4473,6 +4473,26 @@ async function loadSessionMaxCodeTokens(cwd) {
  * and the URL is what the global output-token total is keyed to (task #125) — restoring a
  * subset would leave the footer describing one backend while the turns went to another.
  */
+/**
+ * Mirror this folder's coding choice to the SAME database that stores the key
+ * material (task #225) — cloud Mongo in hosted mode, localhost Mongo in Client
+ * Expert — so the choice and the credentials always live in one consistent store.
+ * The local session file stays as a fast offline cache. A failure is reported,
+ * never silent, so a lost connection is visible rather than a stale choice later.
+ */
+async function persistCodingChoiceToServer(cwd) {
+  try {
+    await saveCodingChoice(folderHashFor(cwd), {
+      codingKeyId: sessionCodingKeyId,
+      codingModel: sessionCodingModel,
+      codingLabel: sessionCodingLabel,
+      codingUrl: sessionCodingUrl,
+    });
+  } catch (err) {
+    console.error(dim(`(coding choice could not reach the database: ${err.message})`));
+  }
+}
+
 /**
  * Persist the /model pick THE MOMENT IT IS MADE.
  *
@@ -4497,6 +4517,8 @@ async function saveSessionCoding(cwd) {
     // carry on with the pick applied for this session.
     console.error(dim(`(coding model save failed: ${err.message})`));
   }
+  // ALSO mirrored to the database store (task #225), same place the credentials live.
+  await persistCodingChoiceToServer(cwd);
 }
 
 /**
@@ -4516,6 +4538,8 @@ async function saveSessionCodingKeyId(cwd) {
   } catch (err) {
     console.error(dim(`(coding key choice save failed: ${err.message})`));
   }
+  // ALSO mirrored to the same database store that holds the credentials (task #225).
+  await persistCodingChoiceToServer(cwd);
 }
 
 async function loadSessionCodingKeyId(cwd) {
@@ -5051,7 +5075,7 @@ async function reconfigureOllamaServer() {
       agentModel: chat,
       ragEnabled: true,
       ragEmbedUrl: agent.normalized.url,
-      ragEmbedModel: os.REQUIRED_EMBED_MODEL,
+      ragEmbedModel: os.defaultEmbedModel?.(agent.models) ?? os.REQUIRED_EMBED_MODEL,
     });
   }
   if (coder) {
@@ -5137,7 +5161,7 @@ async function reconfigureOllamaServer() {
   console.log(accent("  ✓ models saved"));
   if (agent) {
     console.log(dim(`      chat   ${chat}  @ ${agent.normalized.host}`));
-    console.log(dim(`      RAG    ${os.REQUIRED_EMBED_MODEL}  @ ${agent.normalized.host}`));
+    console.log(dim(`      RAG    ${os.defaultEmbedModel?.(agent.models) ?? os.REQUIRED_EMBED_MODEL}  @ ${agent.normalized.host}`));
   } else {
     console.log(dim("      chat   — not set (agent server skipped)"));
   }
@@ -5147,7 +5171,11 @@ async function reconfigureOllamaServer() {
       : dim("      code   — not set (coding server skipped)")
   );
   if (extras.length) console.log(dim(`      also   ${extras.join(", ")}  — offered by /model`));
-  if (agent && String(settings.ragEmbedModel ?? "") !== os.REQUIRED_EMBED_MODEL) {
+  // Compare to the embedder this box was seeded with — an accepted OTHER embedder (a
+  // qwen3-embedding-only box) was written to settings above, so REQUIRED_EMBED_MODEL would
+  // falsely scream "changed" while the seeded value is exactly what settings now hold.
+  const seededEmbed = agent ? (os.defaultEmbedModel?.(agent.models) ?? os.REQUIRED_EMBED_MODEL) : "";
+  if (agent && String(settings.ragEmbedModel ?? "") !== seededEmbed) {
     console.log(dim("    the embedder changed — existing RAG indexes need rebuilding (/rag)."));
   }
   console.log(dim("    takes effect on your next question.\n"));
@@ -6301,7 +6329,35 @@ async function chooseEmbedModel() {
     return;
   }
 
-  const saved = await md.saveWorkerSettings(apiBase, workerKey, { ragEmbedModel: chosen });
+  // The model is decided. Now WHERE to embed: a local Ollama answers at 127.0.0.1:11434 with
+  // no credential; a remote Ollama needs its URL — and a cloud host (ollama.com) ALSO needs an
+  // API key. Same addition coding and agent models already have (#127): the key is named and
+  // stored in the shared account store (settings.agentCodingApiKeys) tagged "embed-ollama", and
+  // this command records its id in ragEmbedKeyId so the embedder can name what it sends. Enter
+  // keeps the current value; the prompts match /coding-key's flow (ask + keyName + askSecret).
+  const currentUrl = settings.ragEmbedUrl || "http://127.0.0.1:11434";
+  const urlIn = await ask(`  Ollama server URL for embedding  [${currentUrl}] — 'none' clears the key: `);
+  if (urlIn === null) { console.log(dim("  (cancelled)\n")); return; }
+  const embedUrl = urlIn.trim() === "" ? (settings.ragEmbedUrl ?? "") : urlIn.trim();
+  let embedKeyId = settings.ragEmbedKeyId ?? "";
+  if (/^none$/i.test(urlIn.trim())) {
+    embedKeyId = "";
+  } else if (embedUrl && isOllamaCloudUrl(embedUrl)) {
+    console.log(GUTTER + dim('A name just tells keys apart — "embed", "work" '));
+    const name = (await askKeyName()).trim();
+    console.log(GUTTER + dim(SECRET_KEY_HINT));
+    const key = (await askSecret(`  API key for ${embedUrl}${name ? ` (${name})` : ""}: `)).trim();
+    if (key) {
+      const id = await withPendingStatus("saving the key", () => addCodingKey(name, key, "embed-ollama"));
+      if (!id) console.log(red("  couldn't save the embed key — searching stays unauthenticated.\n"));
+      else { embedKeyId = id; console.log(GUTTER + dim(`embed key "${name}" saved.\n`)); }
+    }
+  }
+  const saved = await md.saveWorkerSettings(apiBase, workerKey, {
+    ragEmbedModel: chosen,
+    ragEmbedUrl: embedUrl,
+    ragEmbedKeyId: embedKeyId,
+  });
   if (!saved) {
     // A FAILED WRITE MUST NOT LOOK LIKE A SUCCESS. The next turn would keep using the old
     // embedder, and the user would be told their index was rebuilt for a change that never
@@ -7500,6 +7556,46 @@ async function deleteCodingKey(id) {
   }
 }
 
+/**
+ * This folder's stored coding choice, from the SAME Mongo that holds the key secrets
+ * (task #225). Returns {codingKeyId, codingModel, codingLabel, codingUrl} or null when none
+ * is stored for this folder. THROWS on a network/HTTP failure so the caller can say WHY —
+ * the choice and the secret now live in one store, so "cannot reach it" is a real error,
+ * not a silent fall-back.
+ */
+async function fetchCodingChoice(folderHash) {
+  const r = await fetch(`${apiBase}/api/worker/coding-choice?folder=${encodeURIComponent(folderHash)}`, {
+    headers: { "X-Worker-Key": workerKey },
+    signal: AbortSignal.timeout(API_CALL_TIMEOUT_MS),
+  });
+  if (!r.ok) throw new Error(`coding-choice GET failed: HTTP ${r.status}`);
+  const j = await r.json().catch(() => ({}));
+  const c = j?.choice;
+  if (!c || typeof c !== "object") return null;
+  const str = (x) => (typeof x === "string" ? x : "");
+  return {
+    codingKeyId: str(c.codingKeyId),
+    codingModel: str(c.codingModel),
+    codingLabel: str(c.codingLabel),
+    codingUrl: str(c.codingUrl),
+  };
+}
+
+/** Persist this folder's coding choice to the SAME Mongo that holds the key secrets (task #225). */
+async function saveCodingChoice(folderHash, choice) {
+  const r = await fetch(`${apiBase}/api/worker/coding-choice`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+    body: JSON.stringify({ folder: folderHash, ...choice }),
+    signal: AbortSignal.timeout(API_CALL_TIMEOUT_MS),
+  });
+  if (!r.ok) throw new Error(`coding-choice POST failed: HTTP ${r.status}`);
+}
+
+/** The folder-hash key the choice is stored under — the SAME sha256-32 the session file uses. */
+function folderHashFor(cwd) {
+  return createHash("sha256").update(cwd).digest("hex").slice(0, 32);
+}
 /**
  * Ask for a name, then the secret, and store it. Returns the new id or "".
  *
@@ -10000,15 +10096,56 @@ async function main() {
   sessionMaxCodeTokens = await loadSessionMaxCodeTokens(resolve(process.cwd()));
   sessionRagStorage = await loadSessionRagStorage(resolve(process.cwd())); // task #133/#180
   // Restored here, VALIDATED below once the probe says what this account actually allows.
+  // The CHOICE lives in the SAME Mongo as the key secrets (task #225) — the local session file
+  // is only a cache. The database is read FIRST; a failure to reach it is a real error, said
+  // aloud, never a silent fall-back to a stale file.
   {
-    const c = await loadSessionCoding(resolve(process.cwd()));
-    if (c) {
-      sessionCodingModel = c.model;
-      sessionCodingLabel = c.label;
-      sessionCodingUrl = c.url;
+    const folderHash = folderHashFor(resolve(process.cwd()));
+    let dbChoice = null;
+    let dbUnreachable = false;
+    try {
+      dbChoice = await fetchCodingChoice(folderHash);
+    } catch (err) {
+      // Local mode has no "offline" — the database is on THIS machine, so a failure means the
+      // local mongodb is unreachable. Cloud mode failing to reach the hosted API means the
+      // computer has lost its internet connection. Two different messages, one per mode.
+      dbUnreachable = true;
+      if (isLocalApiBase(apiBase)) {
+        console.error(dim("(cannot access local mongodb — your saved model/key choice is unavailable)"));
+      } else {
+        console.error(dim("(your computer has lost its internet connection — your saved model/key choice is unavailable)"));
+      }
+    }
+    if (dbChoice) {
+      if (dbChoice.codingModel) {
+        sessionCodingModel = dbChoice.codingModel;
+        sessionCodingLabel = dbChoice.codingLabel;
+        sessionCodingUrl = dbChoice.codingUrl;
+      }
+      if (dbChoice.codingKeyId) sessionCodingKeyId = dbChoice.codingKeyId;
+      // Refresh the local cache so the file matches the database.
+      try {
+        await updateSessionFile(resolve(process.cwd()), (raw) => {
+          raw.codingKeyId = dbChoice.codingKeyId;
+          raw.codingModel = dbChoice.codingModel;
+          raw.codingLabel = dbChoice.codingLabel;
+          raw.codingUrl = dbChoice.codingUrl;
+          raw.updatedAt = new Date().toISOString();
+        });
+      } catch { /* cache write is best-effort */ }
+    } else if (!dbUnreachable) {
+      // The database WAS reached but has no choice for this folder — fall back to the local file
+      // (a folder chosen before task #225 existed has its choice ONLY in the file). When the
+      // database could NOT be reached, the error above already said so and there is no fallback.
+      const c = await loadSessionCoding(resolve(process.cwd()));
+      if (c) {
+        sessionCodingModel = c.model;
+        sessionCodingLabel = c.label;
+        sessionCodingUrl = c.url;
+      }
+      sessionCodingKeyId = await loadSessionCodingKeyId(resolve(process.cwd())); // task #222
     }
   }
-  sessionCodingKeyId = await loadSessionCodingKeyId(resolve(process.cwd())); // task #222
   // Fetch the API key tail after loading the session, if a key is configured
   if (sessionCodingKeyId) {
     try {
@@ -10367,7 +10504,8 @@ async function main() {
               "\n  Nothing can run until it knows which Ollama server to use." +
                 "\n  Start `gu`, then `/model` → change the Ollama server this machine uses." +
                 `\n  The agent server needs a ${REQUIRED_AGENT_PREFIX} model (e.g. ${REQUIRED_AGENT_MODEL})` +
-                `\n  and ${REQUIRED_EMBED_MODEL}; the agent and coding models are then yours to pick.`
+                `\n  and any ONE of these embedders: ${os.ACCEPTED_EMBED_MODELS.map((m) => m.replace(/:latest$/, "")).join(", ")};` +
+                "\n  the agent and coding models are then yours to pick."
             )
         );
       } else {

package/ollama-setup.mjs

@@ -19,6 +19,7 @@
  * returns null rather than a plausible-looking value it cannot stand behind.
  */
 import { isLikelyEmbedder } from "./agent-model-command.mjs";
+import { EMBED_CHOICES } from "./embed-model-command.mjs";
 
 /** Ollama's native port, used when someone types a bare host or an IP with no port. */
 export const OLLAMA_DEFAULT_PORT = 11434;
@@ -89,6 +90,30 @@ const sameModel = (a, b) => {
   return bare(a) === bare(b);
 };
 
+/**
+ * WHICH EMBEDDERS SATISFY THE REQUIREMENT — any ONE of them, not all, and no longer one exact
+ * name (user, 2026-09-23). nomic-embed-text stays the shipped default and the suggested pull;
+ * qwen3-embedding:4b (and the rest of /embed-model's known-good list) are equally valid: what
+ * must hold is that the embedder is one of ours, because anything else does not error, it
+ * returns numbers, and corrupts every vector on disk invisibly. The list comes from
+ * embed-model-command.mjs so first-run validation and the /embed-model picker can never
+ * disagree about what "supported" means. The default is named first so seeding prefers it.
+ */
+export const ACCEPTED_EMBED_MODELS = [
+  REQUIRED_EMBED_MODEL,
+  ...EMBED_CHOICES.map((c) => c.model).filter((m) => !sameModel(m, REQUIRED_EMBED_MODEL)),
+];
+
+/**
+ * Which accepted embedder to seed this box with: the shipped default when present, else the
+ * first known-good one the box actually has. Returns "" when the box has none — impossible
+ * after checkRequired has passed, but callers fall back on REQUIRED_EMBED_MODEL regardless.
+ */
+export function defaultEmbedModel(models) {
+  const list = Array.isArray(models) ? models : [];
+  return ACCEPTED_EMBED_MODELS.find((e) => list.some((m) => sameModel(m.model, e))) ?? "";
+}
+
 /**
  * Does this server have what the agent and RAG actually need?
  *
@@ -106,9 +131,12 @@ export function checkRequired(
   // `missing` is still a concrete, pullable name — `ollama pull gemma4` is not a command, so
   // reporting the prefix would produce a line that cannot be run.
   if (!agentCandidates(list, { prefix: agentPrefix }).length) missing.push(agentExample);
-  // The EMBEDDER is still exact, and deliberately: a different one does not error, it returns
-  // numbers, which corrupts every vector on disk invisibly and permanently.
-  if (!list.some((m) => sameModel(m.model, embed))) missing.push(embed);
+  // The EMBEDDER is still a closed list, and deliberately: a different one does not error, it
+  // returns numbers, which corrupts every vector on disk invisibly and permanently. But ONE
+  // accepted embedder is ENOUGH (user, 2026-09-23) — a box holding qwen3-embedding:4b and no
+  // nomic-embed-text is ready; it just embeds with qwen. Only a box with NONE of ours is told
+  // to pull, and the name pushed is the shipped default — the line that can actually be run.
+  if (!list.some((m) => ACCEPTED_EMBED_MODELS.some((e) => sameModel(m.model, e)))) missing.push(embed);
   return { ok: missing.length === 0, missing };
 }
 
@@ -123,6 +151,14 @@ export function describeNotReady(host, missing) {
   for (const m of missing ?? []) lines.push(`  ${m}`);
   lines.push("Pull them there, then load again:");
   for (const m of missing ?? []) lines.push(`  ollama pull ${String(m).replace(/:latest$/, "")}`);
+  // ONE embedder suffices, so when the embedder is the missing piece say what the OTHER
+  // acceptable ones are — telling someone who already has qwen3-embedding:4b to also pull
+  // nomic-embed-text would be asking for a model they do not need.
+  if ((missing ?? []).some((m) => sameModel(m, REQUIRED_EMBED_MODEL))) {
+    lines.push(
+      `  (any ONE embedder is enough — ${ACCEPTED_EMBED_MODELS.map((m) => m.replace(/:latest$/, "")).join(" / ")})`
+    );
+  }
   return lines;
 }
 
@@ -687,7 +723,10 @@ export async function askOllamaSetup(
   // and gemma4:12b for quality, and only the person running the machine knows which they want.
   // Not asked when there is exactly one candidate: a menu with a single row is a question with
   // one answer, and answering it is pure ceremony.
-  const embed = agent ? REQUIRED_EMBED_MODEL : null;
+  // Seed the embedder the box ACTUALLY has: the shipped default when present, else whichever
+  // accepted embedder passed the gate — a qwen3-embedding-only box must not be told it now
+  // embeds with a model it never had.
+  const embed = agent ? defaultEmbedModel(agent.models) || REQUIRED_EMBED_MODEL : null;
   let chat = "";
   if (agent) {
     const cands = agentCandidates(agent.models);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.716",
+  "version": "1.0.718",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",