@tiens.nguyen/gu-cli 1.0.719 → 1.0.722

package/add-server.mjs

@@ -0,0 +1,207 @@
+/**
+ * ADD A MODEL SERVER — ONE SCREEN FOR ALL THREE ROLES (task #245). The decisions, pure.
+ *
+ * There were three screens: /model's "add an OpenAI-compatible provider", /agent-model's "use an
+ * Ollama server", and /embed-model's Ollama and provider arms. Each asked for a URL, a key and a
+ * model its own way, and each had drifted: one refused a pasted "/v1" that another stripped, one
+ * named the key and one did not, one reused a saved server and one said "already configured".
+ * gu-repl's addServer() now asks the same questions in the same order for every role:
+ *
+ *     URL → the server's key (reused when it has one) → its models, listed WITH that key → pick
+ *     → save the server, its key, then the role's own setting.
+ *
+ * What genuinely differs per role lives in SERVER_ROLES below and nowhere else. What differs per
+ * server kind ("dialect": an Ollama's /api/tags vs an OpenAI-compatible /v1/models) lives in
+ * serverTarget() and listRequest().
+ */
+import { defaultProviderUrl, ensureV1Root, hostLocality, normalizeProviderUrl, parseProviderModels, MAX_MODELS_PER_SERVER } from "./coding-provider-setup.mjs";
+import { agentModelsFromProvider, isLikelyEmbedder, ollamaAgentDefault, ollamaAgentUrl, parseOllamaTags } from "./agent-model-command.mjs";
+
+/**
+ * The only per-role differences. Every one is a decision the user made:
+ *   · noun / question — what the model is FOR, and the word used afterwards.
+ *   · filterCoders    — coding hides non-coding ids (43 hidden on api.openai.com); the others
+ *                       show everything, labelled. Deliberately asymmetric — do not unify.
+ *   · embeddersFirst  — the embedder's list puts embedding models first; a box that also serves
+ *                       the agent legitimately lists both.
+ *   · extras          — only the coder offers more than one model per server in /model.
+ *   · rowModel        — what a NEW server row offers in /model: the coder's pick, the agent's
+ *                       pick (so the agent's server is also offered as a coder), or nothing for
+ *                       an embedder (an embedding model cannot write code).
+ */
+export const SERVER_ROLES = {
+  coding: {
+    noun: "coding model",
+    question: "Which model writes the code?",
+    filterCoders: true,
+    embeddersFirst: false,
+    extras: true,
+    rowModel: true,
+  },
+  agent: {
+    noun: "agent model",
+    question: "Which model talks?",
+    filterCoders: false,
+    embeddersFirst: false,
+    extras: false,
+    rowModel: true,
+  },
+  embed: {
+    noun: "embedding model",
+    question: "Which model embeds?",
+    filterCoders: false,
+    embeddersFirst: true,
+    extras: false,
+    rowModel: false,
+  },
+};
+
+export function serverRole(role) {
+  return SERVER_ROLES[role] ?? SERVER_ROLES.coding;
+}
+
+/**
+ * A typed server URL → everything the flow needs, for either dialect. Forgiving about what people
+ * paste ("127.0.0.1:11434", ".../v1", ".../api/tags", "ollama.com") and SAYS what it used; strict
+ * about credentials in the URL — keys go in the key prompt, never in an address that is printed.
+ *
+ * Returns { ok: true, dialect, url, root, listUrl, host, locality, cloud, roleUrl(role) } or
+ * { ok: false, why } — `why` finishes the sentence `"<typed>" is <why>`.
+ *   · url      — the provider ROW's url (always the /v1 root: what the API normalises to).
+ *   · listUrl  — where the models are listed (Ollama /api/tags, else /v1/models).
+ *   · roleUrl  — what each role's setting stores: the agent the /v1 root (every existing install
+ *                stores that shape), the embedder an Ollama's bare root (the worker appends
+ *                /v1/embeddings, /api/embed, /api/embeddings itself), the coder the row url.
+ */
+export function serverTarget(dialect, typed) {
+  const raw = String(typed ?? "").trim();
+  if (!raw) return { ok: false, why: "empty" };
+  if (/^[a-z][a-z0-9+.-]*:\/\/[^/]*@/i.test(raw)) {
+    return { ok: false, why: "carrying credentials — keys go in the key prompt" };
+  }
+  if (dialect === "ollama") {
+    const r = ollamaAgentUrl(raw);
+    if (!r.ok) return r;
+    const hostname = new URL(r.root).hostname;
+    return {
+      ok: true,
+      dialect,
+      url: r.agentUrl,
+      root: r.root,
+      listUrl: r.tagsUrl,
+      host: r.host,
+      locality: r.cloud ? "public" : hostLocality(hostname),
+      cloud: r.cloud,
+      roleUrl: (role) => (role === "embed" ? r.root : r.agentUrl),
+    };
+  }
+  const r = normalizeProviderUrl(raw);
+  if (!r.ok) return { ok: false, why: r.why };
+  return {
+    ok: true,
+    dialect: "openai",
+    url: r.url,
+    root: r.url,
+    listUrl: `${ensureV1Root(r.url)}/models`,
+    host: r.host,
+    locality: r.locality,
+    cloud: false,
+    roleUrl: () => r.url,
+  };
+}
+
+/**
+ * Does this server need a key? "required" | "optional" | "none".
+ *   · An Ollama on this machine or the LAN answers anonymously — "none", not even asked.
+ *   · The Ollama cloud refuses anonymous calls — "required".
+ *   · An OpenAI-compatible server on this machine / the LAN (vLLM, LM Studio) usually answers
+ *     anonymously — "optional", Enter skips. A hosted one needs a key — "required".
+ */
+export function keyRequirement(target) {
+  if (!target?.ok) return "none";
+  if (target.dialect === "ollama") return target.cloud ? "required" : "none";
+  return target.locality === "loopback" || target.locality === "private" ? "optional" : "required";
+}
+
+/** The request that lists a server's models: its URL and headers (a Bearer only when keyed). */
+export function listRequest(target, key = "") {
+  const k = String(key ?? "").trim();
+  return { url: target.listUrl, headers: k && k !== "local" ? { Authorization: `Bearer ${k}` } : {} };
+}
+
+/**
+ * A list response → the model ids for this role, in the order to offer them. Shaped like
+ * parseProviderModels' answer ({ models, why, total, retired }) for both dialects, so the caller
+ * has one branch for "nothing listed".
+ *   · coding  — retired ids dropped (offering one is a 404 several steps into a task).
+ *   · agent   — everything, retired and non-chat ids sunk and labelled by the list itself.
+ *   · embed   — everything, embedding models first.
+ */
+export function modelsForRole(role, dialect, body) {
+  const r = serverRole(role);
+  let out;
+  if (dialect === "ollama") {
+    const rows = parseOllamaTags(body);
+    out = { models: rows.map((m) => m.model), why: rows.length ? "" : "empty", total: rows.length, retired: 0 };
+    if (r.embeddersFirst) {
+      const ordered = [...rows].sort(
+        (a, b) => Number(isLikelyEmbedder(b)) - Number(isLikelyEmbedder(a)) || a.model.localeCompare(b.model)
+      );
+      out.models = ordered.map((m) => m.model);
+    }
+    return out;
+  }
+  if (role === "coding") return parseProviderModels(body);
+  const rows = agentModelsFromProvider(body);
+  const models = rows.map((m) => m.model);
+  if (r.embeddersFirst) {
+    models.sort((a, b) => Number(isLikelyEmbedder({ model: b })) - Number(isLikelyEmbedder({ model: a })) || a.localeCompare(b));
+  }
+  return { models, why: rows.length ? "" : "empty", total: rows.length, retired: 0 };
+}
+
+/**
+ * The provider row to save for this role — `changed: false` when the existing row already has
+ * what it needs. At most MAX_MODELS_PER_SERVER models per server, the default counted (the API refuses
+ * more): a NEW row gets the role's model plus extras up to the cap; an EXISTING row gains the
+ * coder's model only if it is not there yet and there is room. `full: true` = no room.
+ */
+export function rowForSave(role, { existing = null, id = "", kind = "openai", url = "", model = "", extras = [] } = {}) {
+  const r = serverRole(role);
+  if (!existing) {
+    const dflt = r.rowModel ? model : "";
+    const more = r.extras ? extras.filter((m) => m && m !== dflt).slice(0, MAX_MODELS_PER_SERVER - 1) : [];
+    return { row: { id, kind, enabled: true, url, defaultModel: dflt, models: more }, changed: true, full: false };
+  }
+  if (role !== "coding" || !model) return { row: existing, changed: false, full: false };
+  const have = new Set([String(existing.defaultModel ?? "").trim(), ...(existing.models ?? [])].filter(Boolean));
+  if (have.has(model)) return { row: existing, changed: false, full: false };
+  if (!String(existing.defaultModel ?? "").trim()) {
+    return { row: { ...existing, defaultModel: model }, changed: true, full: false };
+  }
+  if (have.size >= MAX_MODELS_PER_SERVER) return { row: existing, changed: false, full: true };
+  return { row: { ...existing, models: [...(existing.models ?? []), model] }, changed: true, full: false };
+}
+
+/**
+ * What Enter takes at the URL prompt — the server this role already uses when it is of this
+ * kind, else the obvious one: this machine's Ollama, or https://api.openai.com/v1 (the address
+ * the whole OpenAI-compatible category is named after). "" when there is nothing sensible to
+ * offer (api.openai.com already configured), in which case Enter cancels.
+ */
+export function defaultServerUrl(role, dialect, settings, existingRows = []) {
+  const LOCAL_OLLAMA = "http://127.0.0.1:11434";
+  if (dialect === "ollama") {
+    if (role === "agent") return ollamaAgentDefault(settings);
+    if (role === "embed") {
+      const cur = String(settings?.ragEmbedUrl ?? "").trim();
+      return cur && !/\/v1\/?$/i.test(cur) ? cur : LOCAL_OLLAMA;
+    }
+    return LOCAL_OLLAMA;
+  }
+  if (role === "embed") {
+    const cur = String(settings?.ragEmbedUrl ?? "").trim();
+    if (/\/v1\/?$/i.test(cur)) return cur;
+  }
+  return defaultProviderUrl(existingRows);
+}

package/agent-model-command.mjs

@@ -439,7 +439,9 @@ export function agentMenuOptions({ host = "", modelCount = 0, needsKey = false }
     { action: "models", label: `pick another model on ${where}${modelCount ? `  (${modelCount})` : ""}` },
     { action: "ollama", label: "use an Ollama server for the agent…" },
     { action: "provider", label: "use another OpenAI-compatible provider…" },
-    ...(needsKey ? [{ action: "key", label: `enter a new API key for ${where}…` }] : []),
+    // Task #245: the SAME key manager /model's ctrl+k and /embed-model open — switch, add, make
+    // default, delete — for this server's keys only.
+    ...(needsKey ? [{ action: "key", label: `API keys for ${where} — switch, add or remove…` }] : []),
   ];
 }
 

package/coding-provider-setup.mjs

@@ -361,6 +361,10 @@ export function shouldMentionContextWindow(locality) {
  */
 export const MAX_BACKENDS = 8;
 
+/** How many models ONE server URL may offer, its default included (task #245). Mirrors
+ *  MAX_MODELS_PER_SERVER in api/src/store/settingsTypes.ts, which refuses a row that grows past it. */
+export const MAX_MODELS_PER_SERVER = 3;
+
 /**
  * The backend rows an account ALREADY has, in the shape a save must preserve.
  *
@@ -574,6 +578,25 @@ export function removeProvider(rows, id) {
   return (Array.isArray(rows) ? rows : []).filter((b) => !rowMatches(b, id));
 }
 
+/**
+ * THE PROVIDER ROW THAT SERVES A URL — how every role finds its server's keys (task #245).
+ *
+ * A key is bound to a row, and a role (agent, embedder) finds its row by URL; the API does the
+ * same in serverKeyForUrl (api/src/app.ts). Compared after ensureV1Root and case-folded, as the
+ * API compares against its normalised row url, so "https://ollama.com" and "HTTPS://ollama.com/v1"
+ * are one server. Returns { row, id } — id is what a key binds to: the row's own id, or its kind
+ * for a pre-#223 row that carries none ("auto" for the legacy kind "") — or null when no row
+ * serves that URL.
+ */
+export function providerRowForUrl(rows, url) {
+  const want = ensureV1Root(String(url ?? "").trim()).toLowerCase();
+  if (!String(url ?? "").trim() || !Array.isArray(rows)) return null;
+  const row = rows.find((b) => b && typeof b === "object" && ensureV1Root(String(b.url ?? "").trim()).toLowerCase() === want);
+  if (!row) return null;
+  const id = String(row.id ?? "").trim() || String(row.kind ?? "").trim() || "auto";
+  return { row, id };
+}
+
 /** A row is the one named when its id matches — or, for a row that carries none, when the id IS
  *  its kind, which is exactly how the API identifies a pre-#223 row. */
 function rowMatches(b, id) {

package/gonext_agent_chat.py

@@ -5317,23 +5317,25 @@ def _rag_embed_failure_hint(err) -> str:
 
 
 # The API key for the EMBEDDING endpoint, resolved once per job from the API
-# (backend id "embed-ollama" - where /embed-model stores it, same store as coding/agent
-# keys). A module global because _embed() is a tiny hot path reached through the rag_*
+# (role=embed - the key bound to the provider row for the embed server's URL, same store and
+# same rule as the agent's key). A module global because _embed() is a tiny hot path reached through the rag_*
 # tools - passing a key down that chain just for a header would churn every signature
 # above it for no behaviour.
 _RAG_EMBED_API_KEY = ""
 
 
-def _rag_resolve_embed_api_key(api_base: str, worker_key: str) -> str:
+def _rag_resolve_embed_api_key(api_base: str, worker_key: str, job_id: str = "") -> str:
     """Fetch the embedding-server API key from the shared key store, or "" when none is set.
 
-    The key was typed at /embed-model and POSTed to /api/worker/coding-keys under
-    backendId="embed-ollama" - reusing the coding-keys store means it already lands in
-    every mode (local file in Client Expert, Mongo for cloud users) with no new persistence.
-    The API masks keys in settings reads but returns the real secret here precisely so the
-    daemon that holds the worker key can authenticate to the embedder. Never raises: an
-    unreachable store means "" and the embed call goes unsigned, right for a keyless local
-    Ollama.
+    role=embed: the API resolves it the way it resolves the agent's key - through the provider
+    row for ragEmbedUrl, with ragEmbedKeyId as the pick (embedApiKeyFor in api/src/app.ts) - so
+    the embedder never borrows a key stored for another server. backendId=embed-ollama rides
+    along for an API that predates role=embed and answers the old way. The store is the user's
+    settings row in MongoDB in every mode (hosted Mongo, or the local Mongo in Client Expert).
+    job_id: the turn's job, which records THIS folder's own embed-key pick (task #245) - two
+    folders' turns can run at once, so the pick travels on the job, as the coder's does.
+    Never raises: an unreachable store means "" and the embed call goes unsigned, right for a
+    keyless local Ollama.
     """
     base = (api_base or "").rstrip("/")
     if not base or not worker_key:
@@ -5341,7 +5343,7 @@ def _rag_resolve_embed_api_key(api_base: str, worker_key: str) -> str:
     try:
         from urllib.parse import urlencode
         req = urllib.request.Request(
-            f"{base}/api/worker/coding-key?{urlencode({'backendId': 'embed-ollama'})}",
+            f"{base}/api/worker/coding-key?{urlencode({'role': 'embed', 'backendId': 'embed-ollama', **({'jobId': job_id} if job_id else {})})}",
             headers={"X-Worker-Key": worker_key}, method="GET")
         with urllib.request.urlopen(req, timeout=8, context=_ssl_context()) as resp:
             data = json.loads(resp.read().decode("utf-8", "replace") or "{}")
@@ -6988,11 +6990,11 @@ def run_agent_chat(cfg):
     rag_embed_model = (cfg.get("ragEmbedModel") or "").strip()
     rag_embed_url = (cfg.get("ragEmbedUrl") or "").strip()
     # The RAG embedder may be a KEYED server (task: embed api key in /embed-model). Resolve
-    # its key once, from the shared key store (backendId "embed-ollama"), so every _embed()
+    # its key once, from the shared key store (role=embed), so every _embed()
     # call this job carries the Bearer header. Empty for a keyless local Ollama - _embed()
     # then sends no Authorization, exactly the old behaviour.
     global _RAG_EMBED_API_KEY
-    _RAG_EMBED_API_KEY = _rag_resolve_embed_api_key(worker_api_base, worker_api_key) if rag_embed_url else ""
+    _RAG_EMBED_API_KEY = _rag_resolve_embed_api_key(worker_api_base, worker_api_key, _job_id) if rag_embed_url else ""
     try:
         rag_top_k = int(cfg.get("ragTopK") or 6)
     except (TypeError, ValueError):