@tiens.nguyen/gu-cli 1.0.721 → 1.0.722

package/gu-repl.mjs

@@ -494,11 +494,11 @@ const fmtTokens = (n) => {
  */
 const PICK_HINT = "↑/↓ then Enter · Esc to cancel";
 const PICK_MANY_HINT = "↑/↓ · space toggles · ctrl+a all · Enter saves · Esc cancels";
-// How many EXTRA coders /model will offer alongside the default (user, 2026-09-04). A cap keeps
-// that picker readable: a box with sixteen models would otherwise make switching coder a
-// sixteen-row scroll every time. Three is a working set — the default plus three alternatives —
-// not a technical limit; nothing downstream cares how long the list is.
-const MAX_ALT_CODERS = 3;
+// How many EXTRA models one server offers alongside its default. Task #245 made it a rule, not a
+// readability cap: a server URL offers AT MOST 3 models, default included (MAX_MODELS_PER_SERVER
+// in coding-provider-setup.mjs and api/src/store/settingsTypes.ts — the API refuses a row that
+// grows past it). A server saved with more before the rule keeps them: see extraModelRoom.
+const MAX_ALT_CODERS = 2;
 const BULLET = "●"; // a neutral completed action (informational step)
 const CHECK = "✓"; // a step that succeeded
 const CROSS = "✗"; // a step that FAILED
@@ -4542,6 +4542,46 @@ async function saveSessionCodingKeyId(cwd) {
   await persistCodingChoiceToServer(cwd);
 }
 
+/** This folder's own key for a role (task #245), from the session-file cache. */
+async function loadSessionFolderKeyId(cwd, role) {
+  const { roleOf } = await import("./server-keys.mjs");
+  try {
+    const raw = JSON.parse(await readFile(sessionFilePath(cwd), "utf8"));
+    const v = raw?.[roleOf(role).field];
+    return typeof v === "string" ? v.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * THIS FOLDER'S OWN KEY FOR ONE ROLE (task #245) — the one place a folder's pick is written, for
+ * all three roles. The session file is the offline cache; the database is the record, and its
+ * write carries ONLY this role's field, which the API merges — so picking the agent's key can
+ * never wipe the coder's. "" = back to the server's default.
+ */
+async function saveFolderKeyPick(role, id) {
+  const { roleOf } = await import("./server-keys.mjs");
+  const field = roleOf(role).field;
+  if (role === "agent") sessionAgentKeyId = id;
+  else if (role === "embed") sessionEmbedKeyId = id;
+  else sessionCodingKeyId = id;
+  const cwd = resolve(process.cwd());
+  try {
+    await updateSessionFile(cwd, (raw) => {
+      raw[field] = id;
+      raw.updatedAt = new Date().toISOString();
+    });
+  } catch (err) {
+    console.error(dim(`(key choice save failed: ${err.message})`));
+  }
+  try {
+    await saveCodingChoice(folderHashFor(cwd), { [field]: id });
+  } catch (err) {
+    console.error(dim(`(key choice could not reach the database: ${err.message})`));
+  }
+}
+
 async function loadSessionCodingKeyId(cwd) {
   try {
     const raw = JSON.parse(await readFile(sessionFilePath(cwd), "utf8"));
@@ -5053,7 +5093,7 @@ async function reconfigureOllamaServer() {
       const ticks = await pickManyFromList(
         rest.map((m) => `${m.model}${am.formatSize(m.sizeBytes) ? dim(`  ${am.formatSize(m.sizeBytes)}`) : ""}`),
         rest.map((m, i) => (already.has(m.model) ? i : -1)).filter((i) => i >= 0),
-        { max: MAX_ALT_CODERS }
+        { max: Math.max(MAX_ALT_CODERS, rest.filter((m) => already.has(m.model)).length) }
       );
       // null is Escape and cancels the command; an EMPTY list is a legitimate "offer none".
       if (ticks === null) {
@@ -5119,12 +5159,14 @@ async function reconfigureOllamaServer() {
       const keys = await fetchCodingKeys();
       const ps = await import("./coding-provider-setup.mjs");
       for (const u of cloudUrls) {
-        const row = ps
-          .existingBackendRows(fresh ?? {})
-          .find((b) => ps.ensureV1Root(String(b.url ?? "")).toLowerCase() === ps.ensureV1Root(u).toLowerCase());
-        if (row && !am.boundKeyFor(keys, row.id)) {
+        const found = ps.providerRowForUrl(ps.existingBackendRows(fresh ?? {}), u);
+        if (found && !am.boundKeyFor(keys, found.id)) {
           console.log(yellow(`  ${hostOf(u)} is the Ollama cloud — it needs its own API key (the model list worked without one).`));
-          await askKeyForRow(row, hostOf(u));
+          // The shared key prompt (task #245); the server's first key becomes its default.
+          const { name, secret } = await askServerKey({ host: hostOf(u) });
+          if (secret && !(await withPendingStatus("saving the key", () => addCodingKey(name, secret, found.id)))) {
+            console.log(red("  couldn't save the key — add it with ctrl+k.\n"));
+          }
         }
       }
     }
@@ -5234,7 +5276,8 @@ async function pickExtraModels(rest, preChecked = []) {
   const ticks = await pickManyFromList(
     rest,
     rest.map((m, i) => (already.has(m) ? i : -1)).filter((i) => i >= 0),
-    { max: MAX_ALT_CODERS }
+    // A server saved with more than the cap before #245 keeps them; it just cannot grow.
+    { max: Math.max(MAX_ALT_CODERS, rest.filter((m) => already.has(m)).length) }
   );
   // null is Escape and cancels; an EMPTY list is a legitimate "offer none".
   if (ticks === null) return null;
@@ -5323,7 +5366,7 @@ async function manageCodingProviders() {
   const providers = ps.manageableProviders(rows);
   // NOTHING TO MANAGE IS NOT A MENU. Straight to the add flow, exactly as before.
   if (providers.length === 0) {
-    await addCodingProvider();
+    await addServer({ role: "coding", dialect: "openai" });
     return;
   }
 
@@ -5340,7 +5383,7 @@ async function manageCodingProviders() {
     return;
   }
   if (idx === ADD) {
-    await addCodingProvider();
+    await addServer({ role: "coding", dialect: "openai" });
     return;
   }
 
@@ -5539,324 +5582,292 @@ async function removeCodingProvider(ps, rows, p) {
 }
 
 /**
- * THE TWO ROLES A PROVIDER CAN BE ADDED FOR (task #225 phase 4).
- *
- * Adding a provider is the SAME job either way — validate the URL, take a key, ask the server
- * what it has, save the row, bind the key, check it came back. That flow is written, tested and
- * carries the eviction guards; duplicating it for the agent would mean two flows to fix every
- * time one of them is wrong, which is how /model and web Settings drifted apart in #223.
- *
- * So the flow is shared and only the four genuine differences live here. Every one of them is a
- * decision the user made, not an implementation detail:
- *
- *   · WHAT THE MODEL IS FOR, which is the question asked and the word used afterwards.
- *   · HOW THE LIST IS READ. The coding role drops models the provider says are retired —
- *     offering one is offering a 404 several steps into a task. The agent role shows everything,
- *     because that is what was asked for ("show everything the provider lists"), with each row
- *     labelled instead.
- *   · WHETHER THE LIST IS FILTERED. Coding hides non-coding ids (asked for directly, 43 hidden
- *     on api.openai.com). Agent hides nothing. This asymmetry is deliberate — do not unify it.
- *   · WHERE THE ANSWER IS SAVED. A coding pick is THIS FOLDER's (reversible, and nobody asked
- *     for it to be account-wide). The agent model is a MACHINE setting — it is what `gu`
- *     talks to in every folder — so it is written to settings, which is where /agent-model has
- *     always written it.
+ * ADD A MODEL SERVER — ONE SCREEN FOR THE CODER, THE AGENT AND THE EMBEDDER (task #245).
+ *
+ * Replaces three screens that asked the same things three ways (/model's add-provider,
+ * /agent-model's Ollama server, /embed-model's Ollama and provider arms). Same questions, same
+ * order, every role:
+ *
+ *   1. the server's URL — forgiving about what is pasted, and says what it used;
+ *   2. its key — REUSED when the server already has one (a key belongs to the server, not the
+ *      model), asked only when the server needs one (an Ollama on this machine or the LAN never
+ *      does; a local vLLM may skip it). The FIRST key entered is what lists the models;
+ *   3. its models, listed WITH that key — a real round trip, so a wrong URL or key fails HERE
+ *      rather than mid-turn. A refused key saves nothing;
+ *   4. the model — coders filtered, embedders first, the agent sees everything (add-server.mjs);
+ *   5. save the server row, then its key (the API makes a server's first key its default), then
+ *      the role's own setting.
+ *
+ * What differs per role or per server kind is decided in add-server.mjs, not here.
+ *
+ *   role      "coding" | "agent" | "embed"
+ *   dialect   "openai" (an OpenAI-compatible /v1 server) | "ollama" (an Ollama: /api/tags)
+ *   url       skip the URL question (a server picked from a list, or the embedder's current one)
+ *   model     skip listing and picking (/embed-model's curated list already chose; `plan` with it)
+ *   newKey    ask for a key even if the server has one (the stored one was refused)
  */
-const PROVIDER_ROLES = {
-  coding: {
-    noun: "coding model",
-    question: "Which model writes the code?",
-    /** Retired ids dropped; the caller also filters non-coding ones in the picker. */
-    parse: (ps, am, body) => ps.parseProviderModels(body),
-    /** Extra models populate the row so /model can offer several from one provider. */
-    extras: true,
-  },
-  agent: {
-    noun: "agent model",
-    question: "Which model talks?",
-    // Nothing hidden — retired and non-chat ids are SUNK and LABELLED by agentModelsFromProvider.
-    // Shaped like parseProviderModels' answer so the caller needs no branch.
-    parse: (ps, am, body) => {
-      const rows = am.agentModelsFromProvider(body);
-      return { models: rows.map((r) => r.model), why: rows.length ? "" : "empty", total: rows.length, retired: 0 };
-    },
-    // The agent uses ONE model per machine; /agent-model probes the provider live every time, so
-    // there is nothing an extras list would add.
-    extras: false,
-  },
-};
-
-async function addCodingProvider(roleName = "coding") {
-  const role = PROVIDER_ROLES[roleName] ?? PROVIDER_ROLES.coding;
+async function addServer({ role = "coding", dialect = "openai", url: presetUrl = "", model: presetModel = "", plan: presetPlan = null, newKey = false } = {}) {
+  const as = await import("./add-server.mjs");
   const ps = await import("./coding-provider-setup.mjs");
-  const am = await import("./agent-model-command.mjs");
+  const sk = await import("./server-keys.mjs");
   const md = await import("./model-doctor.mjs");
   const { proxyFetch } = await import("./proxy-dispatcher.mjs");
+  const R = as.serverRole(role);
 
   const settings = await withPendingStatus("reading your model settings", fetchWorkerSettings);
   if (!settings) {
-    console.log(red("  couldn\'t reach the API to read your current settings.\n"));
+    console.log(red("  couldn't reach the API to read your current settings.\n"));
     return;
   }
   // EVERY ROW THAT IS ALREADY THERE, including the synthesized one a pre-#123 account keeps in
-  // its legacy fields — writing an array without it would make the coder they have been using
-  // vanish from /model while its legacy fields sat there unread.
+  // its legacy fields — writing an array without it would make that coder vanish from /model.
   const existing = ps.existingBackendRows(settings);
-  // WHAT IS BEING OFFERED RIGHT NOW, so we can tell afterwards whether saving cost anything.
-  //
-  // Read from the API's own answer rather than from `existing`, because `existing` is precisely
-  // what cannot be trusted: an API that omits agentCodingBackends from its settings view sends
-  // us one legacy row, and every provider added earlier is invisible here. codingChoices lists
-  // them on every API version, so a before/after comparison notices a loss that this client had
-  // no way to prevent. Failure is not fatal — it only means the check below stays quiet.
-  const beforeChoices = (
-    await fetchAgentPayload([{ role: "user", content: "ping" }]).catch(() => null)
-  )?.codingChoices ?? null;
-  if (existing.length >= ps.MAX_BACKENDS) {
-    console.log(yellow(`  ${ps.MAX_BACKENDS} coding backends is the limit — remove one first.`));
-    console.log(GUTTER + dim("web Settings → Agent lists them; unchecking one frees a slot.\n"));
-    return;
-  }
-
-  // OFFER THE OBVIOUS ANSWER. Reported after using this: "it says 'provider URL', please give
-  // default one, everyone know that right?" — https://api.openai.com/v1 is the address this whole
-  // category is named after. It is "" when that provider is already configured, because a default
-  // whose only possible outcome is "already configured here" invites a pointless Enter.
-  const dfltUrl = ps.defaultProviderUrl(existing);
-  console.log(dim("  Any OpenAI-compatible endpoint: OpenRouter, Together, vLLM, LM Studio, …"));
-  // THE ADDRESS GOES ABOVE, IN FULL, and the input row keeps a SHORT label. The frozen row is too
-  // narrow to hold a URL without truncating exactly the part worth reading — the same reason the
-  // Ollama server prompt puts its default on the line above (task #220 follow-up).
-  //
-  // …AND WHAT ENTER DOES IS SAID OUT LOUD. It used to cancel; it now accepts the default, and a
-  // prompt whose Enter key quietly changed meaning is the bug fixed in 46d1524e. Nothing is saved
-  // until the end of the flow either way, so an accidental Enter costs a question, not a provider.
-  // ESC IS THE CANCEL, and it is named here because a prompt that does not say so has no
-  // cancel as far as the reader is concerned — `type "no"` was a password you had to already
-  // know, and it was the only prompt in this flow that offered anything at all. Typing "no"
-  // still works (it is in fingers, and the tests pin it); it is simply no longer the only way
-  // out, and no longer the one advertised.
-  console.log(
-    dim(dfltUrl ? `  Enter uses ${dfltUrl}  ·  Esc cancels\n` : "  Esc cancels.\n")
-  );
+  // What /model offers BEFORE, so a save that silently evicts a provider can be noticed (an API
+  // older than row ids keys a backend by its KIND). Coding only — it is the list that can shrink.
+  const beforeChoices = role === "coding"
+    ? ((await fetchAgentPayload([{ role: "user", content: "ping" }]).catch(() => null))?.codingChoices ?? null)
+    : null;
 
-  // --- 1. the address -------------------------------------------------------------------
-  let url = "";
-  let host = "";
-  let locality = "";
-  for (let attempt = 0; attempt < 3; attempt++) {
-    const typed = (await ask("  provider URL: ")).trim();
-    if (/^(no|n|skip|-)$/i.test(typed)) {
-      console.log(dim("  (cancelled)\n"));
-      return;
-    }
-    // Enter with nothing typed takes the default — or cancels when there is none to take.
-    const raw = typed || dfltUrl;
-    if (!raw) {
-      console.log(dim("  (cancelled)\n"));
-      return;
-    }
-    const r = ps.normalizeProviderUrl(raw);
-    if (!r.ok) {
-      for (const l of ps.describeUrlProblem(r.why, raw)) console.log(GUTTER + dim(l));
-      continue;
-    }
-    // ALREADY CONFIGURED is its own answer. Saving a second row for the same URL would give the
-    // picker two rows that are identical in everything a person can see.
-    const clash = existing.find((b) => ps.ensureV1Root(String(b.url ?? "")) === r.url);
-    if (clash && roleName === "agent") {
-      // FOR THE AGENT, "already configured" IS THE ANSWER, NOT A REFUSAL (#40). The provider and
-      // its key may well be there already; what is missing is the agent pointing at it. Sending the
-      // user to /model — the CODING picker — left no way to finish from here.
-      console.log(GUTTER + dim(`${r.host} is already configured — using it for the agent.`));
-      await pointAgentAtProvider(clash, r.host);
+  // --- 1. the server --------------------------------------------------------------------
+  let target = null;
+  if (presetUrl) {
+    target = as.serverTarget(dialect, presetUrl);
+    if (!target.ok) {
+      console.log(red(`  "${presetUrl}" is ${target.why} — nothing changed.\n`));
       return;
     }
-    if (clash) {
-      console.log(GUTTER + dim(`${r.host} is already configured here — pick its model in /model.`));
-      continue;
+  } else {
+    const dflt = as.defaultServerUrl(role, dialect, settings, existing);
+    console.log(dim(dialect === "ollama"
+      ? "  An Ollama server: this machine, a box on your network, or https://ollama.com (needs a key)."
+      : "  Any OpenAI-compatible endpoint: OpenRouter, Together, vLLM, LM Studio, …"));
+    // The address goes ABOVE, in full, and Enter's meaning is said out loud (46d1524e).
+    console.log(dim(dflt ? `  Enter uses ${dflt}  ·  Esc cancels\n` : "  Esc cancels.\n"));
+    for (let attempt = 0; attempt < 3 && !target; attempt++) {
+      const typed = await ask("  server URL: ");
+      if (typed === null || /^(no|n|skip|-)$/i.test(typed.trim())) break;
+      const raw = typed.trim() || dflt;
+      if (!raw) break;
+      const t = as.serverTarget(dialect, raw);
+      if (!t.ok) {
+        if (dialect === "openai") for (const l of ps.describeUrlProblem(t.why, raw)) console.log(GUTTER + dim(l));
+        else console.log(GUTTER + dim(`"${raw}" is ${t.why} — try host:port, e.g. 127.0.0.1:11434`));
+        continue;
+      }
+      // SAY WHAT WE ASSUMED: a scheme we supplied or a path we stripped is a guess, and a wrong
+      // guess shows up later as a timeout that reads like a dead server.
+      if (t.root !== raw && t.url !== raw) console.log(GUTTER + dim(`using ${t.root}`));
+      target = t;
     }
-    url = r.url;
-    host = r.host;
-    locality = r.locality;
-    // SAY WHAT WE ASSUMED. A scheme we supplied is a guess, and a wrong guess shows up later as
-    // a timeout that reads like a dead server.
-    if (r.schemeAssumed || r.url !== raw) console.log(GUTTER + dim(`using ${r.url}`));
-    break;
   }
-  if (!url) {
+  if (!target) {
     console.log(dim("  (nothing saved)\n"));
     return;
   }
+  const host = target.host;
 
-  // --- 2. a name for the key, 3. the key ------------------------------------------------
-  // NOT DEFAULTED, by request. An empty name becomes "Unknown" at the API, which is the same
-  // thing every other add-a-key path produces — the URL default was asked for, this was not.
-  console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
-  const name = await askKeyName();
-  console.log(GUTTER + dim(SECRET_KEY_HINT));
-  const secret = (await askSecret(`  API key${name ? ` for ${name}` : ""}: `)).trim();
-  if (!secret) {
-    console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+  // --- 2. the server's key --------------------------------------------------------------
+  // AN EXISTING SERVER IS REUSED, never stored twice (two rows for one URL would be two picker
+  // entries identical in everything a person can see) — its keys come with it.
+  const found = ps.providerRowForUrl(existing, target.url);
+  // THE ROW CAP BEFORE ANY QUESTION about a new server: exceeding it is a silent 200 with no row,
+  // and asking for a key and a model first would be the worst order to discover that in.
+  if (!found && existing.length >= ps.MAX_BACKENDS) {
+    console.log(yellow(`  ${ps.MAX_BACKENDS} servers is the limit — remove one in /model → manage providers first.\n`));
     return;
   }
-  // DOES THAT LOOK LIKE A KEY? (asked for.) A shape check only — the provider decides validity —
-  // but "abc", "aaa" and a placeholder left in from a README are obvious on sight, and catching
-  // them here saves a turn that would otherwise die on a 401 several steps in. A local server is
-  // exempt: llama.cpp and friends accept any string, so "abc" is legitimate there.
-  const shape = ps.describeApiKeyShape(secret, { host, locality });
-  if (shape.level) {
-    console.log(GUTTER + (shape.level === "warn" ? yellow(shape.note) : dim(shape.note)));
-    // Only the clearly-wrong shapes are worth interrupting for, and only on a hosted provider
-    // where a bad key cannot possibly work.
-    if (shape.level === "warn" && !(await askYesNo("Use that key anyway?", false))) {
-      console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
-      return;
-    }
+  const need = as.keyRequirement(target);
+  let key = "";
+  let keyName = "";
+  let typedKey = false;
+  if (found && !newKey) {
+    // A KEY BELONGS TO THE SERVER: one already saved is used, whichever model it was saved for.
+    const keys = await withPendingStatus(`reading the keys for ${host}`, () => fetchServerKeys(found.id));
+    const folderKeyId = role === "agent" ? sessionAgentKeyId : role === "embed" ? sessionEmbedKeyId : sessionCodingKeyId;
+    const inUse = sk.keyInUse(keys ?? [], found.id, folderKeyId);
+    if (inUse && inUse.backendId === found.id) {
+      key = (await fetchCodingKey(found.id)).key;
+      if (key) console.log(GUTTER + dim(`using the key "${inUse.name}" already saved for ${host}.`));
+    }
+  }
+  const askKey = async () => {
+    const t = await askServerKey({ host, optional: need === "optional" });
+    key = t.secret;
+    keyName = t.name;
+    typedKey = Boolean(t.secret);
+    return t.secret || need !== "required";
+  };
+  if (!key && (need !== "none" || newKey)) {
+    if (need === "required") console.log(GUTTER + dim(`${host} needs an API key.`));
+    if (!(await askKey())) return;
   }
 
-  // --- 4. ASK THE SERVER WHAT IT HAS, with the key ---------------------------------------
-  // A REAL ROUND TRIP, not a ping (the /doctor lesson): a bad URL or key has to fail HERE, where
-  // it is one line of explanation, rather than mid-turn as a coder that silently dropped to the
-  // chat model. A 401 at this point is the single most useful answer this flow can give.
-  const probe = await withPendingStatus(`asking ${host} what it has`, async () => {
-    try {
-      const res = await proxyFetch(ps.modelsUrlFor(url), {
-        headers: { Authorization: `Bearer ${secret}` },
-        signal: AbortSignal.timeout(12_000),
-      });
-      if (!res.ok) return { status: res.status };
-      return { body: await res.json().catch(() => null) };
-    } catch (err) {
-      return { err };
-    }
-  });
+  // --- 3. its models, listed with that key ----------------------------------------------
   let models = [];
-  if (probe.status || probe.err) {
-    const d = ps.describeProbeFailure(probe);
-    for (const l of d.lines) console.log(GUTTER + (d.fatal ? red(l) : yellow(l)));
-    // FATAL MEANS THE KEY WAS REJECTED, and storing a credential the server has already refused
-    // would be storing a problem for later. Everything else is survivable: a server that will
-    // not list its models is not a server that cannot write code, and blocking here would make
-    // a perfectly good provider unenterable.
-    if (d.fatal) {
-      console.log(GUTTER + dim("nothing was saved — check the key and try again.\n"));
-      return;
-    }
-    console.log(GUTTER + dim("carrying on — you can type the model id yourself."));
-  } else {
-    const parsed = role.parse(ps, am, probe.body);
-    models = parsed.models;
-    for (const l of ps.describeModelProblem(parsed.why, { host, total: parsed.total })) {
-      console.log(GUTTER + dim(l));
+  if (!presetModel) {
+    const list = () =>
+      withPendingStatus(`asking ${host} what it has`, async () => {
+        const req = as.listRequest(target, key);
+        try {
+          const res = await proxyFetch(req.url, { headers: req.headers, signal: AbortSignal.timeout(12_000) });
+          return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
+        } catch (err) {
+          return { err };
+        }
+      });
+    let probe = await list();
+    // THE STORED KEY WAS REFUSED — ask for the right one once, rather than saving nothing.
+    if ((probe.status === 401 || probe.status === 403) && !typedKey && key) {
+      console.log(yellow(`  ${host} refused the stored key (HTTP ${probe.status}) — enter the right one.`));
+      if (!(await askKey()) || !key) return;
+      probe = await list();
+    }
+    if (probe.status || probe.err) {
+      const d = ps.describeProbeFailure(probe);
+      for (const l of d.lines) console.log(GUTTER + (d.fatal ? red(l) : yellow(l)));
+      // FATAL = THE KEY WAS REFUSED: storing a credential the server already rejected is storing
+      // a problem for later. Anything else is survivable — the model id can be typed.
+      if (d.fatal) {
+        console.log(GUTTER + dim("nothing was saved — check the key and try again.\n"));
+        return;
+      }
+      console.log(GUTTER + dim("carrying on — you can type the model id yourself."));
+    } else {
+      const parsed = as.modelsForRole(role, target.dialect, probe.body);
+      models = parsed.models;
+      for (const l of ps.describeModelProblem(parsed.why, { host, total: parsed.total })) console.log(GUTTER + dim(l));
+      const rn = ps.retiredNote(parsed.retired, host);
+      if (rn) console.log(GUTTER + dim(rn));
+      if (models.length) console.log(GUTTER + dim(`${host} offers ${models.length} model${models.length === 1 ? "" : "s"}`));
     }
-    // SAID, not silently dropped: a shorter list with no explanation reads as a provider with
-    // fewer models, which is the wrong story.
-    const rn = ps.retiredNote(parsed.retired, host);
-    if (rn) console.log(GUTTER + dim(rn));
+  }
+
+  // --- 4. the model ---------------------------------------------------------------------
+  let model = presetModel;
+  const ec = role === "embed" ? await import("./embed-model-command.mjs") : null;
+  if (!model) {
     if (models.length) {
-      console.log(GUTTER + dim(`${host} offers ${models.length} model${models.length === 1 ? "" : "s"}`));
+      const am = await import("./agent-model-command.mjs");
+      const current = role === "agent" ? am.currentAgentModel(settings) : role === "embed" ? ec.currentEmbedModel(settings) : sessionCodingLabel;
+      model = R.filterCoders
+        ? await chooseCodingModelFrom(ps, models, R.question, 0)
+        : await chooseFromModelList(models, R.question, Math.max(0, models.indexOf(current)));
+      if (model === null) {
+        console.log(dim("  (cancelled — nothing was saved)\n"));
+        return;
+      }
+    } else {
+      model = String((await ask("  model id: ")) ?? "").trim();
+    }
+    if (!model) {
+      console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+      return;
     }
   }
-
-  // --- 5. which model ---------------------------------------------------------------------
-  // THE LIST IS A SUGGESTION. Typing an id is always available, because a listed model may be
-  // unusable (a reasoning model that puts code in the wrong channel, or one that spells the
-  // <code> block differently and loses its reasoning silently) and an unlisted one may be fine.
-  let model = "";
-  if (models.length) {
-    model =
-      roleName === "agent"
-        // UNFILTERED, and it must stay that way. chooseCodingModelFrom applies the non-coding
-        // filter, which is right for a coder and the opposite of what was asked for here.
-        ? await chooseFromModelList(models, role.question, 0)
-        : await chooseCodingModelFrom(ps, models, role.question, 0);
-    if (model === null) {
-      console.log(dim("  (cancelled — nothing was saved)\n"));
+  // THE EMBEDDER'S RECOGNITION WALL: a different model invalidates every index, so the projects
+  // that stop working are named BEFORE anything is saved. The same model is a pure server move.
+  let plan = presetPlan;
+  if (role === "embed" && !presetModel) {
+    const current = ec.currentEmbedModel(settings);
+    if (!ec.sameEmbedModel(model, current)) {
+      const sw = await confirmEmbedSwitch(ec, current, model);
+      if (!sw.changed) return;
+      plan = sw.plan;
+    } else if (as.serverTarget(target.dialect, String(settings.ragEmbedUrl ?? "")).root === target.root && !typedKey) {
+      console.log(dim(`  already embedding with ${model} on ${host} — nothing changed.\n`));
       return;
     }
-  } else {
-    model = (await ask("  model id: ")).trim();
   }
-  if (!model) {
-    console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
-    return;
+  // MORE THAN ONE MODEL from a NEW server, for the coder: the default is what runs, these are the
+  // others /model may switch to. At most MAX_MODELS_PER_SERVER in all (the API refuses more).
+  let extras = [];
+  if (R.extras && !found && models.length > 1) {
+    extras = await pickExtraModels(models.filter((m) => m !== model));
+    if (extras === null) {
+      console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+      return;
+    }
   }
 
-  // --- 5b. MORE THAN ONE MODEL, up to the same cap the Ollama flow uses ------------------
-  // Asked for directly: a provider list is eighty ids long and one of them is not enough.
-  // The default above is what RUNS; these are the others /model may switch to without coming
-  // back through here. Skipped when the probe returned nothing to choose from.
-  const extras = role.extras ? await pickExtraModels(models.filter((m) => m !== model)) : [];
-  if (extras === null) {
-    console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
-    return;
+  // --- 5. save: the server, its key, then the role --------------------------------------
+  let rowId = found?.id ?? "";
+  let rows = existing;
+  // A NEW ROW ONLY WHEN SOMETHING NEEDS ONE: the coder is picked through its row, and a key is
+  // bound to one. A keyless Ollama on this machine or the LAN for the agent or the embedder needs
+  // neither — the role's own setting holds its URL — and a row would put it in /model as a coder.
+  const needRow = role === "coding" || typedKey;
+  if (!found && needRow) {
+    rowId = ps.mintProviderId(existing.map((b) => String(b.id ?? "")));
+    const { row } = as.rowForSave(role, { id: rowId, kind: target.dialect === "ollama" ? "ollama" : "openai", url: target.url, model, extras });
+    rows = [...existing, row];
+  } else {
+    const r = as.rowForSave(role, { existing: found.row, model });
+    if (r.full) {
+      console.log(yellow(`  ${host} already offers ${ps.MAX_MODELS_PER_SERVER} models — remove one in /model → manage providers first.\n`));
+      return;
+    }
+    if (r.changed) rows = existing.map((b) => (b === found.row ? r.row : b));
   }
-
-  // --- 6. save: the backend first, then the key that belongs to it -----------------------
-  const backendId = ps.mintProviderId(existing.map((b) => String(b.id ?? "")));
-  const rows = [...existing, { ...ps.newProviderRow({ id: backendId, url, model }), models: extras }];
-  const saved = await withPendingStatus("saving the provider", () =>
-    md.saveWorkerSettings(apiBase, workerKey, { agentCodingBackends: rows })
-  );
-  if (!saved) {
-    console.log(red("  couldn\'t save that to this machine — nothing changed."));
-    console.log(GUTTER + dim("if this machine\'s local API is old, restart it with `gu api restart`.\n"));
-    return;
+  if (rows !== existing) {
+    const ok = await withPendingStatus(`saving ${host}`, () => md.saveWorkerSettings(apiBase, workerKey, { agentCodingBackends: rows }));
+    if (!ok) {
+      console.log(red(`  couldn't save ${host} — nothing changed.`));
+      console.log(GUTTER + dim("if this machine's local API is old, restart it with `gu api restart`.\n"));
+      return;
+    }
+    if (!found && role !== "coding" && as.serverRole(role).rowModel) console.log(GUTTER + dim(`${host} is also offered in /model now.`));
   }
-  const keyId = await withPendingStatus("saving the key", () =>
-    addCodingKey(name, secret, backendId)
-  );
-  if (!keyId) {
-    // The provider IS saved, so say that rather than implying the whole thing failed — and say
-    // what is missing, because without a key this backend drops its coder on every turn.
-    console.log(yellow(`  ${host} was saved, but its key was not.`));
-    console.log(GUTTER + dim("pick its model in /model, then press ctrl+k to add the key.\n"));
-    return;
+  if (typedKey) {
+    const id = await withPendingStatus("saving the key", () => addCodingKey(keyName, key, rowId));
+    if (!id) {
+      console.log(yellow(`  ${host} was saved, but its key was not — nothing else changed.`));
+      console.log(GUTTER + dim("try again, or add the key with ctrl+k.\n"));
+      return;
+    }
+    // A key typed for a server that already had keys was typed because there was none usable or
+    // the stored one was refused: it is the server's key from now on, for every role and folder.
+    if (found) await setServerDefaultKey(rowId, id);
   }
+  const keyLine = key ? dim(`    API key ${keyName || "saved"} ····${key.slice(-4)}  ·  ${host}'s key`) : "";
 
-  // --- 7. use it in THIS folder ----------------------------------------------------------
-  // ASK THE API WHAT THE PICK IS CALLED. THE TERMINAL MUST NOT COMPUTE IT.
-  //
-  // Reported, and it made a freshly-added provider unusable on the first turn:
-  //     ✗ "prov_9ez1q69s::gpt-5.1-codex-mini" is not in your allowed coding models
-  // The wire id belongs to the API — codingModelChoiceList decides whether it is a bare model
-  // name or `${rowId}::${model}`, and an API that predates row ids answers `openai::${model}`
-  // for the very row this flow just saved. Guessing it here meant storing a pick that the next
-  // turn could only reject, seconds after configuring the thing.
-  //
-  // So: re-read the choices and take the id the server actually offers. Matched on the MODEL and
-  // the BACKEND — by id when the API is new enough to report one, else by URL, which is what
-  // identifies a row to an older API.
-  // --- 7a. THE AGENT ROLE SAVES A MACHINE SETTING AND IS DONE (task #225 phase 4) ----------
-  //
-  // The rest of this function is about the CODING pick: which wire id the API offers for it, and
-  // storing that id on the folder. None of it applies here. The agent model is not a folder
-  // choice — it is what `gu` talks to in every folder on this machine — so it goes to
-  // settings, which is where /agent-model has always written it.
-  //
-  // Written as URL + NAME rather than a row id because that is the pair app.ts reads
-  // (buildAgentChatJobPayload), and phase 1 resolves the key by matching that URL back to the
-  // provider row we just saved. One representation, already proven.
-  if (roleName === "agent") {
-    const ok = await withPendingStatus("pointing the agent model at it", () =>
-      md.saveWorkerSettings(apiBase, workerKey, { agentModelUrl: url, agentModelName: model })
-    );
-    if (!ok) {
-      // The PROVIDER is saved — say so, or this reads as the whole thing having failed and the
-      // user re-enters a key that is already stored.
+  if (role === "agent") {
+    // A MACHINE SETTING, not a folder pick: the agent is what gu talks to in every folder. Saved
+    // as URL + NAME, the pair app.ts matches back to the server row to find the key.
+    if (await saveAgentModel(target.roleUrl("agent"), model, host)) {
+      if (keyLine) console.log(keyLine + "\n");
+      console.log(GUTTER + dim("the banner shows the new model next time gu starts.\n"));
+    } else if (rows !== existing || typedKey) {
+      // The SERVER landed — say so, or the user re-enters a key that is already stored.
       console.log(yellow(`  ${host} was saved, but the agent model was not pointed at it.`));
       console.log(GUTTER + dim("run /agent-model to finish, or check the API is reachable.\n"));
-      return;
     }
-    console.log(accent(`  ✓ agent model → ${model}`) + dim(`  · ${host}`));
-    console.log(dim(`    API key ${name || "Unknown"} ····${secret.slice(-4)}  ·  this machine\n`));
-    // Restart advice, because the banner and the running daemon both read this at startup: a
-    // machine that keeps talking to the old model after a successful save looks like the save
-    // failed, and that is the one thing this line prevents.
-    console.log(GUTTER + dim("the banner shows the new model next time gu starts.\n"));
     return;
   }
+  if (role === "embed") {
+    // ragEmbedKeyId "" — the server's own keys decide now (its default, or this folder's pick).
+    const fields = { ragEmbedUrl: target.roleUrl("embed"), ragEmbedModel: model, ragEmbedKeyId: "" };
+    if (!(await saveEmbedSettings(fields))) return;
+    if (plan) announceEmbedSaved({ chosen: model, plan, url: target.roleUrl("embed") });
+    else {
+      console.log(accent(`  ✓ embedding server → ${host}`));
+      console.log(dim(`    ${model} did not change, so no knowledge base rebuilds — the same model just answers from ${host}.\n`));
+    }
+    return;
+  }
+  await useCoderInThisFolder({ ps, rows, beforeChoices, url: target.url, host, locality: target.locality, model, backendId: rowId, key, keyName });
+}
 
+/**
+ * The coder just added becomes THIS FOLDER's pick (not the account default — per-folder is
+ * reversible and nobody asked for account-wide). Split out of addServer because only the coder
+ * has it, and it carries the two checks that were learned the hard way:
+ *
+ *   · ASK THE API WHAT THE PICK IS CALLED. The wire id belongs to the API (a bare model or
+ *     `${rowId}::${model}`); guessing it here once stored a pick the next turn rejected.
+ *   · DID SAVING EVICT ANOTHER PROVIDER? An API older than row ids keys a backend by its KIND,
+ *     so a second openai row replaced the first with a 200. Said BEFORE the success line.
+ */
+async function useCoderInThisFolder({ ps, rows, beforeChoices, url, host, locality, model, backendId, key, keyName }) {
   const cwd = resolve(process.cwd());
   const after = await withPendingStatus("checking it is offered", () =>
     fetchAgentPayload([{ role: "user", content: "ping" }]).catch(() => null)
@@ -5866,28 +5877,13 @@ async function addCodingProvider(roleName = "coding") {
     (c) => c.model === model && (c.backendId ? c.backendId === backendId : sameHost(c.url, url))
   );
   if (!offered) {
-    // SAVED BUT NOT OFFERED. Pinning the folder to a guess here is what produced the reported
-    // failure; say what happened instead, and leave the folder on a coder that works.
     console.log(yellow(`  ${host} was saved, but this API is not offering ${model} yet.`));
     console.log(GUTTER + dim("run /model — if it is missing there too, the API may be older than"));
     console.log(GUTTER + dim("this feature; restart it with `gu api restart`.\n"));
     return;
   }
-  // DID SAVING THIS ONE EVICT ANOTHER? (reported live)
-  //
-  // The check above asks only whether the model just added is offered — and it is, which is
-  // exactly why the loss was silent: "whenever i add or change an openai-compatible provider, it
-  // replace the old one in this list". An API older than row ids keys a backend by its KIND, so a
-  // second openai row collides with the first and the first disappears. The write answers 200,
-  // the new provider works, and nothing says the old one is gone.
-  //
-  // Printed BEFORE the success line, because it is the more important half of what just
-  // happened — and the folder's pick still goes through, since the provider that was added is
-  // genuinely usable and refusing to select it would help nobody.
-  // Two questions, and they catch different failures. providerUrlsLost asks whether a row WE
-  // SENT failed to land (an old API colliding two rows on their kind). providersNoLongerOffered
-  // asks whether anything that used to be offered has gone — including a provider this client
-  // never saw, which is the shape the reported bug actually took.
+  // Two questions, and they catch different failures: a row WE SENT failed to land, or something
+  // that used to be offered has gone (including a provider this client never saw).
   const lost = Array.from(
     new Set([
       ...ps.providerUrlsLost(rows, after?.codingChoices),
@@ -5898,32 +5894,27 @@ async function addCodingProvider(roleName = "coding") {
     console.log(yellow(`  ⚠ this API dropped ${lost.length === 1 ? "a provider" : `${lost.length} providers`} when saving:`));
     for (const u of lost) console.log(GUTTER + dim(`    ${u}`));
     if (ps.apiKeysBackendsByKind(after?.codingChoices)) {
-      // SAY WHY, not just what. "Restart your API" on its own is an instruction without a
-      // reason, and this one has now been given three times without being acted on.
       console.log(GUTTER + dim("this API identifies a backend by its KIND, so it holds ONE"));
       console.log(GUTTER + dim("OpenAI-compatible provider at a time. A newer one keeps several."));
     }
     console.log(GUTTER + dim("restart it with `gu api restart`, then add that provider again.\n"));
   }
-  // THE FOLDER\'S CHOICE, NOT THE ACCOUNT DEFAULT. Adding a provider must not re-point every
-  // other folder at it — per-folder is reversible and account-wide is not, and nobody asked for
-  // the second thing. agentCodingDefaultBackendId is deliberately untouched.
   sessionCodingModel = offered.id;
   sessionCodingLabel = model;
   sessionCodingUrl = url;
-  sessionCodingKeyId = keyId;
-  sessionApiKeyTail = secret.slice(-4); // store the tail for the bottom bar
-  keyChoicePending = false; // the provider's own key was just bound to this folder
+  // The folder follows the SERVER's key (task #245) — its default, which a first key already is.
+  sessionCodingKeyId = "";
+  sessionApiKeyTail = key ? key.slice(-4) : "";
+  keyChoicePending = false;
   await saveSessionCoding(cwd);
   await saveSessionCodingKeyId(cwd);
-  // The key question for this coder is now answered — leaving the flag set would warn about a
-  // key that was just entered, which reads as the save having failed.
+  // The key question for this coder is answered — leaving the flag set would warn about a key
+  // that was just entered, which reads as the save having failed.
   codingKeyMissingKnown = false;
   console.log(accent(`  ✓ coding model → ${model}`) + dim(`  · ${host}`));
-  console.log(dim(`    API key ${name || "Unknown"} ····${secret.slice(-4)}  ·  this folder only\n`));
-  // A HOSTED PROVIDER NEEDS ITS WINDOW SET (requirement 11). With nothing set gu assumes
-  // 24,000 prompt tokens and compacts there — on a large hosted model that throws history away
-  // every turn and produces a bill with no explanation.
+  if (key) console.log(dim(`    API key ${keyName || "saved"} ····${key.slice(-4)}  ·  ${host}'s key\n`));
+  // A HOSTED SERVER NEEDS ITS WINDOW SET: with nothing set gu assumes 24,000 prompt tokens and
+  // compacts there — on a large hosted model that throws history away every turn.
   if (ps.shouldMentionContextWindow(locality)) {
     console.log(GUTTER + dim("tip: /context-window — hosted servers do not report their size,"));
     console.log(GUTTER + dim("     so gu assumes 24,000 prompt tokens and compacts there.\n"));
@@ -6288,7 +6279,7 @@ async function fetchWorkerSettings() {
  * Only a model change rebuilds indexes — moving the SAME embedder to another server, or changing
  * only its key, leaves every vector valid, so those paths save without the plan wall. The worker
  * already speaks both dialects: gonext_agent_chat._embed() POSTs {base}/v1/embeddings first, then
- * Ollama /api/embed and /api/embeddings, and sends the "embed-ollama" store key as a Bearer when
+ * Ollama /api/embed and /api/embeddings, and sends the embed server's stored key (role=embed) as a Bearer when
  * one exists — so pointing at an OpenAI-compatible provider here needs no worker-side change.
  *
  * The decisions live in embed-model-command.mjs; this is the terminal half only.
@@ -6307,50 +6298,6 @@ async function saveEmbedSettings(fields) {
   return saved;
 }
 
-// WHERE TO EMBED, ASKED ONCE, SHARED. The model sub-flow and the ollama-server action both need
-// "which Ollama serves the embeddings"; it used to live inline, which meant a second copy could
-// never exist. Enter keeps the current URL; Ctrl+C/Escape returns null and the caller just stops.
-// Anything that is not an Ollama-shaped host is rejected with the reason, then asked AGAIN —
-// ollama-host-snippets' why line IS the retry message.
-async function pickEmbedServerUrl({ currentUrl }) {
-  const ohs = await import("./ollama-host-snippets.mjs");
-  for (;;) {
-    const urlIn = await ask(`  Ollama server URL for embedding  [${currentUrl}]: `);
-    if (urlIn === null) return null;
-    const typed = urlIn.trim();
-    if (!typed) return currentUrl;
-    const embedUrl = /^https?:\/\//i.test(typed) ? typed : `http://${typed}`;
-    const r = ohs.checkOllamaHostInput(embedUrl);
-    if (r.ok) return embedUrl;
-    console.log(GUTTER + dim(`  "${typed}" is ${r.why} — try host:port, e.g. 127.0.0.1:11434`));
-  }
-}
-
-// THE KEY, ASKED ONCE, SHARED. ollama.com cannot proceed without one; the OpenAI-compatible
-// provider row asks the same way (Enter skips it — a local vLLM answers anonymously). All embed
-// keys land under the fixed backendId "embed-ollama" because that is the id
-// gonext_agent_chat._rag_resolve_embed_api_key() fetches, whatever the server is; ragEmbedKeyId
-// is just the human label the settings panel shows. Returns { cancelled, keyId } — a cancelled
-// prompt writes NOTHING, and a failed store keeps the key out of the settings so the user is not
-// told they authenticated when they did not.
-async function askEmbedKey(url, { optional = false } = {}) {
-  console.log(GUTTER + dim('A name just tells keys apart — "embed", "work".'));
-  const name = (await askKeyName()).trim();
-  console.log(GUTTER + dim(SECRET_KEY_HINT));
-  const key = (await askSecret(`  API key for ${url}${name ? ` (${name})` : ""}: `)).trim();
-  if (!key) {
-    if (optional) console.log(GUTTER + dim("(no key — the provider will be called anonymously)"));
-    return { cancelled: !optional, keyId: "", key: "" };
-  }
-  const id = await withPendingStatus("saving the key", () => addCodingKey(name || "embed", key, "embed-ollama"));
-  if (!id) {
-    console.log(red("  couldn't save the embed key — searching stays unauthenticated.\n"));
-    return { cancelled: true, keyId: "", key: "" };
-  }
-  console.log(GUTTER + dim(`embed key "${name || id}" saved.\n`));
-  return { cancelled: false, keyId: id, key };
-}
-
 // THE RECOGNITION STEP, ONE WAY. Switching embedders invalidates the indexes; naming the projects
 // that stop working is the decision the user is actually making, so the plan is read BEFORE the
 // "switch / keep" picker — never after, never implied. Returns { changed:false } when the user
@@ -6438,147 +6385,33 @@ async function chooseEmbedModel() {
     return;
   }
 
+  // EVERY ARM IS THE ONE ADD-SERVER SCREEN (task #245) — the same URL → key → models → save as
+  // /model and /agent-model. The curated arm has already chosen the model (and passed the
+  // recognition wall), so it only asks WHERE; the other two list what the server has.
   if (action === "model") {
-    // WHICH + WHERE, one pass: the recognition wall first (it is the expensive decision), then
-    // the server prompt, then — only on ollama.com — the key. Same addition coding and agent
-    // models already have (#127): the key is named, stored in the shared account store
-    // (settings.agentCodingApiKeys) tagged "embed-ollama", and its id recorded in ragEmbedKeyId so
-    // the embedder can name what it sends. Cancelled url/key prompts abort cleanly: the key, if
-    // typed, is already in the store and the settings write is simply skipped.
     const { changed, chosen, plan } = await pickEmbedModel(ec, current);
     if (!changed) return;
-    const embedUrl = await pickEmbedServerUrl({ currentUrl });
-    if (embedUrl === null) {
-      console.log(dim("  (cancelled)\n"));
-      return;
-    }
-    let embedKeyId = settings.ragEmbedKeyId ?? "";
-    if (isOllamaCloudUrl(embedUrl)) {
-      const k = await askEmbedKey(embedUrl);
-      if (k.cancelled) return;
-      embedKeyId = k.keyId;
-    }
-    // A FAILED WRITE MUST NOT LOOK LIKE A SUCCESS (#169): the next turn would keep using the old
-    // embedder while the user is told the index was rebuilt for a change that never happened.
-    if (!(await saveEmbedSettings({ ragEmbedModel: chosen, ragEmbedUrl: embedUrl, ragEmbedKeyId: embedKeyId }))) return;
-    announceEmbedSaved({ chosen, plan, url: embedUrl });
+    await addServer({ role: "embed", dialect: "ollama", model: chosen, plan });
     return;
   }
+  if (action === "ollama") return addServer({ role: "embed", dialect: "ollama" });
+  if (action === "provider") return addServer({ role: "embed", dialect: "openai" });
 
-  if (action === "ollama") {
-    // SAME MODEL, NEW OLLAMA. Vectors come from the model, not the box — moving nomic-embed-text
-    // from 127.0.0.1 to another Ollama changes no numbers, so no wall and no rebuild. The
-    // ollama.com arm still collects the key; a keyless host clears the stale ragEmbedKeyId label.
-    const embedUrl = await pickEmbedServerUrl({ currentUrl });
-    if (embedUrl === null) {
-      console.log(dim("  (cancelled)\n"));
-      return;
-    }
-    let embedKeyId = "";
-    if (isOllamaCloudUrl(embedUrl)) {
-      const k = await askEmbedKey(embedUrl);
-      if (k.cancelled) return;
-      embedKeyId = k.keyId;
-    }
-    // Same box, no new key: keep the no-op honest instead of writing noise over the settings.
-    if (embedUrl === currentUrl && !embedKeyId) {
-      console.log(dim(`  already embedding on ${host || currentUrl} — nothing changed.\n`));
-      return;
-    }
-    if (!(await saveEmbedSettings({ ragEmbedUrl: embedUrl, ragEmbedKeyId: embedKeyId }))) return;
-    console.log(accent(`  ✓ embedding server → ${hostOf(embedUrl)}`));
-    console.log(dim(`    ${current} did not change, so no knowledge base rebuilds — the same model just answers from another box.\n`));
-    return;
-  }
-
-  if (action === "provider") {
-    // ANOTHER OPENAI-COMPATIBLE PROVIDER. _embed() tries {base}/v1/embeddings first, so any
-    // /v1-shaped server works — vLLM, OpenRouter, LM Studio, a hosted gateway. The key comes
-    // BEFORE the list: most providers 401 an anonymous /v1/models, and a keyless local server
-    // just answers, so Enter skips the key. The model id then comes from the provider's own
-    // /v1/models when it answers, typed EXACTLY as the provider calls it when it does not — the
-    // worker POSTs the string verbatim, so both are supported.
+  if (action === "key") {
+    // THE SAME KEY MANAGER as /model's ctrl+k and /agent-model (task #245): this server's keys
+    // only — switch (this folder's embedder, or the server's default), add, delete. A server
+    // with no row yet gets one here, with its first key, exactly as the model arms add it.
     const ps = await import("./coding-provider-setup.mjs");
-    let base = "";
-    for (;;) {
-      const raw = await ask(`  provider base URL (e.g. https://openrouter.ai/api/v1): `);
-      if (raw === null || !raw.trim()) {
-        console.log(dim("  (cancelled)\n"));
-        return;
-      }
-      const typed = raw.trim();
-      base = /^https?:\/\//i.test(typed) ? typed : `https://${typed}`;
-      try {
-        new URL(base);
-        break;
-      } catch {
-        console.log(yellow("  that is not a URL — try https://host or https://host/v1"));
-      }
-    }
-    base = ps.ensureV1Root(base);
-    const providerHost = hostOf(base);
-    const k = await askEmbedKey(base, { optional: true });
-    const embedKeyId = k.keyId;
-    const { proxyFetch } = await import("./proxy-dispatcher.mjs");
-    let chosen = "";
-    let listed = [];
-    try {
-      const am = await import("./agent-model-command.mjs");
-      const r = await withPendingStatus(`asking ${providerHost} for its models`, () =>
-        proxyFetch(`${base}/models`, { headers: am.agentListHeaders(k.key || ""), signal: AbortSignal.timeout(12000) })
-      );
-      if (r.ok) listed = am.agentModelsFromBody("openai", await r.json().catch(() => null));
-    } catch { /* an unreachable list is not a dead end — typing is fully supported, below */ }
-    if (listed.length) {
-      // Embedders first, the rest after, each once: the provider's catalog is mostly chat models,
-      // and burying "text-embedding-3-large" under 200 of them is a menu nobody can use.
-      const am = await import("./agent-model-command.mjs");
-      const ordered = [...listed].sort((a, b) =>
-        Number(am.isLikelyEmbedder(b)) - Number(am.isLikelyEmbedder(a)) || a.model.localeCompare(b.model));
-      const labels = ordered.map((r) =>
-        `${r.model}${r.note ? dim(` · ${r.note}`) : ""}` + (ec.sameEmbedModel(r.model, current) ? accent(" (current)") : ""));
-      const li = await pickFromList(labels, Math.max(0, ordered.findIndex((r) => ec.sameEmbedModel(r.model, current))));
-      if (li < 0) {
-        console.log(dim("  (cancelled)\n"));
-        return;
-      }
-      chosen = ordered[li].model;
+    const found = ps.providerRowForUrl(ps.existingBackendRows(settings), currentUrl);
+    if (!found) {
+      // No server row yet: the add-server screen, URL and model already known, a key asked for.
+      await addServer({ role: "embed", dialect: /\/v1\/?$/i.test(currentUrl) ? "openai" : "ollama", url: currentUrl, model: current, newKey: true });
+      return;
     } else {
-      console.log(dim(`  ${providerHost} did not list its models — type the embedding model id exactly as ${providerHost} calls it.`));
-      const raw = await ask(`  embedding model id [${current}]: `);
-      if (raw === null) {
-        console.log(dim("  (cancelled)\n"));
-        return;
-      }
-      chosen = raw.trim() || current;
-    }
-    // A MODEL CHANGE THROUGH THE PROVIDER ROW IS STILL A REINDEX — same wall, same wording. Same
-    // model = a pure server/key move, and no knowledge base needs a rebuild.
-    let plan = null;
-    if (!ec.sameEmbedModel(chosen, current)) {
-      const sw = await confirmEmbedSwitch(ec, current, chosen);
-      if (!sw.changed) return;
-      plan = sw.plan;
+      await manageServerKeys({ role: "embed", backendId: found.id, host: host || currentUrl, model: current });
     }
-    const fields = { ragEmbedUrl: base, ragEmbedKeyId: embedKeyId };
-    if (chosen) fields.ragEmbedModel = chosen;
-    if (!(await saveEmbedSettings(fields))) return;
-    if (plan) announceEmbedSaved({ chosen, plan, url: base });
-    else {
-      console.log(accent(`  ✓ embedding provider → ${providerHost}`));
-      console.log(dim(`    ${chosen} did not change, so no knowledge base rebuilds — the same model just answers from ${providerHost}.\n`));
-    }
-    return;
-  }
-
-  if (action === "key") {
-    // A NEW KEY FOR THE SERVER ALREADY CHOSEN. The model and the URL stay; only the credential
-    // rotates — same three steps as everywhere else (name → secret → store under "embed-ollama").
-    const k = await askEmbedKey(host || currentUrl);
-    if (k.cancelled) return;
-    if (!(await saveEmbedSettings({ ragEmbedKeyId: k.keyId }))) return;
-    console.log(accent(`  ✓ embedding key → "${k.keyId}"`));
-    console.log(dim(`    ${current} still embeds on ${host || currentUrl} — the new key signs the next request.\n`));
+    // The pre-#245 account-wide pick would shadow what was just chosen; the server decides now.
+    if (String(settings.ragEmbedKeyId ?? "").trim()) await saveEmbedSettings({ ragEmbedKeyId: "" });
   }
 }
 
@@ -6613,83 +6446,47 @@ async function askKeyName(prompt = "  key name: ") {
   return "";
 }
 
-/** Ask for a key and store it BOUND to this provider row. Returns the secret, or "" if cancelled. */
-async function askKeyForRow(row, host) {
-  console.log("\n" + GUTTER + dim('A name just tells keys apart — "work", "personal".'));
-  const name = await askKeyName();
+/**
+ * ASK FOR A SERVER'S KEY — name, then the secret, then the shape check — ONE PROMPT for every
+ * flow that adds a key (task #245): /model's add-provider and ctrl+k, /agent-model's Ollama cloud
+ * and provider rows, /embed-model's three arms. It only ASKS; the caller saves (a new server's
+ * row must exist before its key can be bound to it).
+ *
+ * Returns { name, secret }; secret "" = nothing typed — a cancel, or with `optional` a deliberate
+ * "no key" (a local vLLM answers anonymously). `host` names the server in the prompt and decides
+ * the shape check's locality: a local server accepts any string, so "abc" is not questioned there.
+ */
+async function askServerKey({ host = "", nameHint = '"work", "personal"', optional = false } = {}) {
+  const ps = await import("./coding-provider-setup.mjs");
+  console.log("\n" + GUTTER + dim(`A name just tells keys apart — ${nameHint}.`));
+  const name = (await askKeyName()).trim();
   console.log(GUTTER + dim(SECRET_KEY_HINT));
-  const secret = (await askSecret(`  API key for ${host}${name ? ` (${name})` : ""}: `)).trim();
+  const secret = (await askSecret(`  API key${host ? ` for ${host}` : ""}${name ? ` (${name})` : ""}: `)).trim();
   if (!secret) {
-    console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
-    return "";
+    console.log(GUTTER + dim(optional ? "(no key — the server will be called anonymously)" : "(cancelled — nothing was saved)\n"));
+    return { name, secret: "" };
   }
-  const id = await withPendingStatus("saving the key", () => addCodingKey(name, secret, String(row?.id ?? "")));
-  if (!id) {
-    console.log(red("  couldn't save the key — nothing changed.\n"));
-    return "";
+  // DOES THAT LOOK LIKE A KEY? A shape check only — the server decides validity — but "abc" and a
+  // README placeholder are obvious on sight and would otherwise die as a 401 several steps in.
+  const shape = ps.describeApiKeyShape(secret, { host, locality: host ? ps.hostLocality(host) : "" });
+  if (shape.level) {
+    console.log(GUTTER + (shape.level === "warn" ? yellow(shape.note) : dim(shape.note)));
+    if (shape.level === "warn" && !(await askYesNo("Use that key anyway?", false))) {
+      console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
+      return { name, secret: "" };
+    }
   }
-  // The key just entered for THIS provider is the one to use (follow-up: the new ollama
-  // cloud key should become the chosen one) — pin it to this folder now so the next coder
-  // pick doesn't fall back to an older key, and the bar tail matches what will be sent.
-  sessionCodingKeyId = id;
-  await saveSessionCodingKeyId(resolve(process.cwd()));
-  sessionApiKeyTail = secret.slice(-4);
-  keyChoicePending = false;
-  codingKeyMissingKnown = false;
-  return secret;
-}
-
-/** #40: the key was the problem — enter it, then list again. */
-async function enterAgentProviderKey(row, host) {
-  if (!row) return;
-  if (!(await askKeyForRow(row, host))) return;
-  await chooseAgentModel();
+  return { name, secret };
 }
 
 /**
- * #40: point the agent at a provider that is ALREADY configured — its key if it has none (or a
- * rejected one), its model list, and the agent settings.
+ * #40: the key was the problem — enter it and list again. The same screen as adding a server
+ * (addServer), with the server already known and a fresh key asked for.
  */
-async function pointAgentAtProvider(row, host) {
-  const ps = await import("./coding-provider-setup.mjs");
-  const am = await import("./agent-model-command.mjs");
-  const { proxyFetch } = await import("./proxy-dispatcher.mjs");
-  const url = ps.ensureV1Root(String(row.url ?? ""));
-  let key = (await withPendingStatus(`reading the key for ${host}`, () => fetchCodingKey(String(row.id ?? "")))).key;
-  if (!key) {
-    console.log(GUTTER + dim(`no API key is stored for ${host} yet.`));
-    key = await askKeyForRow(row, host);
-    if (!key) return;
-  }
-  const list = async (k) =>
-    withPendingStatus(`asking ${host} for its models`, async () => {
-      try {
-        const res = await proxyFetch(ps.modelsUrlFor(url), { headers: am.agentListHeaders(k), signal: AbortSignal.timeout(12_000) });
-        return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
-      } catch (err) {
-        return { err };
-      }
-    });
-  let probe = await list(key);
-  if (probe.status === 401 || probe.status === 403) {
-    console.log(yellow(`  ${host} rejected the stored key (HTTP ${probe.status}) — enter the right one.`));
-    key = await askKeyForRow(row, host);
-    if (!key) return;
-    probe = await list(key);
-  }
-  let models = [];
-  if (probe.body) {
-    models = am.agentModelsFromProvider(probe.body).map((m) => m.model);
-  } else {
-    for (const l of ps.describeProbeFailure(probe).lines) console.log(GUTTER + yellow(l));
-    console.log(GUTTER + dim("carrying on — you can type the model id yourself."));
-  }
-  const model = models.length ? await chooseFromModelList(models, "Which model talks?", 0) : (await ask("  model id: ")).trim();
-  if (!model) {
-    console.log(dim("  (cancelled — nothing was saved)\n"));
-    return;
-  }
-  await saveAgentModel(url, model, host);
+async function enterAgentProviderKey(row, host) {
+  if (!row) return;
+  const dialect = String(row.kind ?? "") === "ollama" ? "ollama" : "openai";
+  await addServer({ role: "agent", dialect, url: String(row.url ?? host), newKey: true });
 }
 
 /**
@@ -6703,7 +6500,7 @@ async function chooseAgentProvider() {
     return;
   }
   const choices = am.agentProviderChoices(settings);
-  if (choices.length === 1) return addCodingProvider("agent");
+  if (choices.length === 1) return addServer({ role: "agent", dialect: "openai" });
   console.log(dim(`  Which OpenAI-compatible provider should the agent use?  (${PICK_HINT})`));
   const idx = await pickFromList(choices.map((c) => c.label), 0);
   if (idx < 0) {
@@ -6711,133 +6508,9 @@ async function chooseAgentProvider() {
     return;
   }
   const pick = choices[idx];
-  if (pick.action === "add") return addCodingProvider("agent");
-  await pointAgentAtProvider(pick.row, hostOf(String(pick.row.url ?? "")));
-}
-
-/**
- * #41: the agent model on an OLLAMA server — this machine's, a LAN box, or the Ollama cloud.
- *
- * Local and LAN Ollama take no key: the agent URL and model are saved, and the API sends its
- * placeholder, which Ollama ignores. The CLOUD (https://ollama.com) needs one, and the API finds an
- * agent's key through the provider row whose URL matches — so a cloud server reuses the row that is
- * already there (a kimi-k3 coder on ollama.com has one), or gets one, with the key bound to it.
- */
-async function addOllamaAgent() {
-  const am = await import("./agent-model-command.mjs");
-  const ps = await import("./coding-provider-setup.mjs");
-  const md = await import("./model-doctor.mjs");
-  const { proxyFetch } = await import("./proxy-dispatcher.mjs");
-  const settings = await withPendingStatus("reading your model settings", fetchWorkerSettings);
-  if (!settings) {
-    console.log(red("  couldn't reach the API to read your current settings.\n"));
-    return;
-  }
-  const dflt = am.ollamaAgentDefault(settings);
-  console.log(dim("  An Ollama server: this machine, a box on your network, or https://ollama.com (needs a key)."));
-  console.log(dim(`  Enter uses ${dflt}  ·  Esc cancels\n`));
-
-  let target = null;
-  for (let attempt = 0; attempt < 3 && !target; attempt++) {
-    const typed = (await ask("  Ollama server: ")).trim();
-    const r = am.ollamaAgentUrl(typed || dflt);
-    if (!r.ok) {
-      console.log(GUTTER + dim(`"${typed}" is ${r.why} — try host:port, e.g. 127.0.0.1:11434`));
-      continue;
-    }
-    target = r;
-  }
-  if (!target) {
-    console.log(dim("  (nothing saved)\n"));
-    return;
-  }
-
-  // THE CLOUD NEEDS A KEY, and the key has to belong to a provider row with this URL.
-  const existing = ps.existingBackendRows(settings);
-  let row = target.cloud
-    ? existing.find((b) => ps.ensureV1Root(String(b.url ?? "")).toLowerCase() === target.agentUrl.toLowerCase()) ?? null
-    : null;
-  let key = "";
-  let newRow = null;
-  let hasBoundKey = false;
-  if (target.cloud) {
-    // A KEY SAVED FOR THIS PROVIDER — not any key the account holds. ollama.com's model list answers
-    // without a key, so listing cannot catch a borrowed one; only asking can.
-    if (row) {
-      const keys = await withPendingStatus(`reading the keys for ${target.host}`, fetchCodingKeys);
-      hasBoundKey = Boolean(am.boundKeyFor(keys, row.id));
-    }
-    if (!hasBoundKey) {
-      if (!row) {
-        if (existing.length >= ps.MAX_BACKENDS) {
-          console.log(yellow(`  ${ps.MAX_BACKENDS} providers is the limit — remove one in web Settings → Agent first.\n`));
-          return;
-        }
-        newRow = { id: ps.mintProviderId(existing.map((b) => String(b.id ?? ""))), kind: "ollama", enabled: true, url: target.agentUrl, defaultModel: "", models: [] };
-      }
-      console.log(GUTTER + dim(`${target.host} is the Ollama cloud — it needs an API key.`));
-      console.log(GUTTER + dim(SECRET_KEY_HINT));
-      key = (await askSecret(`  API key for ${target.host}: `)).trim();
-      if (!key) {
-        console.log(GUTTER + dim("(cancelled — nothing was saved)\n"));
-        return;
-      }
-    }
-  }
-
-  // ITS MODELS, LIVE — with the key when it is the cloud.
-  const probe = await withPendingStatus(`asking ${target.host} for its models`, async () => {
-    try {
-      const res = await proxyFetch(target.tagsUrl, { headers: am.agentListHeaders(key), signal: AbortSignal.timeout(12_000) });
-      return res.ok ? { body: await res.json().catch(() => null) } : { status: res.status };
-    } catch (err) {
-      return { err: err?.name === "TimeoutError" ? "no response in 12s" : (err?.message ?? String(err)) };
-    }
-  });
-  if (!probe.body) {
-    const why = probe.status ? `HTTP ${probe.status}` : probe.err;
-    console.log(red(`  couldn't list the models on ${target.host} — ${why}.`));
-    if (probe.status === 401 || probe.status === 403) console.log(GUTTER + dim("the key was rejected — nothing was saved.\n"));
-    else console.log(GUTTER + dim("check the server is running and reachable (and /proxy if this machine needs one) — nothing was saved.\n"));
-    return;
-  }
-  const models = am.parseOllamaTags(probe.body);
-  if (!models.length) {
-    console.log(yellow(`  ${target.host} answered but lists no models — pull one there first (ollama pull …).\n`));
-    return;
-  }
-  const rows = am.agentModelRows(models, am.currentAgentModel(settings));
-  console.log(dim(`  ${models.length} on ${target.root}  (${PICK_HINT}):`));
-  const idx = await pickFromList(
-    rows.map((r) => r.model + (r.embedder ? dim("  · embedding model, not for chat") : "") + (r.current ? accent("  (current)") : "")),
-    Math.max(0, rows.findIndex((r) => r.current))
-  );
-  if (idx < 0) {
-    console.log(dim("  (cancelled — nothing was saved)\n"));
-    return;
-  }
-  const model = rows[idx].model;
-
-  // SAVE: the cloud's row and key first (the agent's key is found through them), then the agent.
-  if (newRow) {
-    const ok = await withPendingStatus("saving the Ollama cloud provider", () =>
-      md.saveWorkerSettings(apiBase, workerKey, { agentCodingBackends: [...existing, { ...newRow, defaultModel: model }] })
-    );
-    if (!ok) {
-      console.log(red("  couldn't save the provider — nothing changed.\n"));
-      return;
-    }
-    row = newRow;
-    console.log(GUTTER + dim(`${target.host} is also offered in /model now.`));
-  }
-  if (target.cloud && key && !hasBoundKey) {
-    const id = await withPendingStatus("saving the key", () => addCodingKey("Ollama cloud", key, String(row?.id ?? "")));
-    if (!id) {
-      console.log(red("  couldn't save the key — the agent was not changed.\n"));
-      return;
-    }
-  }
-  await saveAgentModel(target.agentUrl, model, target.host);
+  if (pick.action === "add") return addServer({ role: "agent", dialect: "openai" });
+  // A server already set up: the same screen, URL known — its key is reused, its models listed.
+  await addServer({ role: "agent", dialect: String(pick.row.kind ?? "") === "ollama" ? "ollama" : "openai", url: String(pick.row.url ?? "") });
 }
 
 /**
@@ -6930,8 +6603,8 @@ async function chooseAgentModel() {
     );
     const action = go >= 0 ? options[go].action : "leave";
     if (action === "key") await enterAgentProviderKey(source.row, listHost);
-    else if (action === "ollama") await addOllamaAgent();
-    else if (action === "provider") await addCodingProvider("agent");
+    else if (action === "ollama") await addServer({ role: "agent", dialect: "ollama" });
+    else if (action === "provider") await addServer({ role: "agent", dialect: "openai" });
     else console.log("");
     return;
   }
@@ -6947,9 +6620,15 @@ async function chooseAgentModel() {
     console.log(dim("  (cancelled)\n"));
     return;
   }
-  if (firstAction === "ollama") return addOllamaAgent();
+  if (firstAction === "ollama") return addServer({ role: "agent", dialect: "ollama" });
   if (firstAction === "provider") return chooseAgentProvider();
-  if (firstAction === "key") return enterAgentProviderKey(source.row, listHost);
+  if (firstAction === "key") {
+    // Task #245: one key manager for every role — this server's keys, this folder's AGENT pick.
+    const rowId = String(source.row?.id ?? "").trim() || String(source.row?.kind ?? "").trim();
+    if (!rowId) return enterAgentProviderKey(source.row, listHost);
+    await manageServerKeys({ role: "agent", backendId: rowId, host: listHost, model: am.currentAgentModel(settings) });
+    return;
+  }
 
   const rows = am.agentModelRows(models, current);
   console.log(dim(`  Agent model — the one that TALKS  (currently ${current || "unset"})`));
@@ -7721,6 +7400,55 @@ async function fetchCodingKeys() {
   }
 }
 
+/**
+ * ONE SERVER'S KEYS, masked (task #245) — then the keys tied to no server, which carry no
+ * backendId. Each says whether it is the server's `first` key and its `default`. null = an API
+ * that predates the filter; the caller falls back to fetchCodingKeys.
+ */
+async function fetchServerKeys(backendId) {
+  try {
+    const r = await fetch(`${apiBase}/api/worker/coding-keys?backendId=${encodeURIComponent(backendId)}`, {
+      headers: { "X-Worker-Key": workerKey },
+      signal: AbortSignal.timeout(API_CALL_TIMEOUT_MS),
+    });
+    if (!r.ok) return null;
+    const j = await r.json().catch(() => ({}));
+    return Array.isArray(j?.keys) ? j.keys : null;
+  } catch {
+    return null;
+  }
+}
+
+/** "Make this the server's default key" (task #245). Returns true when the API took it. */
+async function setServerDefaultKey(backendId, keyId) {
+  try {
+    const r = await fetch(`${apiBase}/api/worker/server-default-key`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+      body: JSON.stringify({ backendId, keyId }),
+      signal: AbortSignal.timeout(API_CALL_TIMEOUT_MS),
+    });
+    return r.ok;
+  } catch {
+    return false;
+  }
+}
+
+/** What deleting a key would change — wasFirst / wasDefault / folders — WITHOUT deleting it. */
+async function previewDeleteKey(id) {
+  try {
+    const r = await fetch(`${apiBase}/api/worker/coding-keys/${encodeURIComponent(id)}?dryRun=1`, {
+      method: "DELETE",
+      headers: { "X-Worker-Key": workerKey },
+      signal: AbortSignal.timeout(API_CALL_TIMEOUT_MS),
+    });
+    if (!r.ok) return null;
+    return await r.json().catch(() => null);
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Add a named key. Returns its id, or "" on failure.
  *
@@ -7783,6 +7511,9 @@ async function fetchCodingChoice(folderHash) {
     codingModel: str(c.codingModel),
     codingLabel: str(c.codingLabel),
     codingUrl: str(c.codingUrl),
+    // Task #245: this folder's own agent / embed keys ("" from an API that predates them).
+    agentKeyId: str(c.agentKeyId),
+    embedKeyId: str(c.embedKeyId),
   };
 }
 
@@ -7809,32 +7540,8 @@ function folderHashFor(cwd) {
  * larger promise than the question implied.
  */
 async function promptNewCodingKey(backendId = "", provider = "") {
-  console.log("\n" + GUTTER + dim("A name just tells them apart — \"work\", \"personal\".\n"));
-  const name = await askKeyName("  Name for this key: ");
-  console.log(GUTTER + dim(SECRET_KEY_HINT));
-  const secret = (await askSecret(`  API key${name ? ` for ${name}` : ""}: `)).trim();
-  if (!secret) {
-    console.log(GUTTER + dim("(cancelled — nothing was added)\n"));
-    return "";
-  }
-  // The same shape check as the add-provider flow. The provider LABEL is its host, so the
-  // locality can be derived from it — which matters: a local server accepts any string, and
-  // warning a vLLM user that "abc" is not a key would be telling them their working setup is
-  // wrong. An unknown label falls through as hosted, where the checks belong.
-  {
-    const ps = await import("./coding-provider-setup.mjs");
-    const shape = ps.describeApiKeyShape(secret, {
-      host: provider,
-      locality: provider ? ps.hostLocality(provider) : "",
-    });
-    if (shape.level) {
-      console.log(GUTTER + (shape.level === "warn" ? yellow(shape.note) : dim(shape.note)));
-      if (shape.level === "warn" && !(await askYesNo("Use that key anyway?", false))) {
-        console.log(GUTTER + dim("(cancelled — nothing was added)\n"));
-        return "";
-      }
-    }
-  }
+  const { name, secret } = await askServerKey({ host: provider });
+  if (!secret) return "";
   const id = await addCodingKey(name, secret, backendId);
   console.log(
     id
@@ -7879,7 +7586,8 @@ async function replaceCodingKey() {
   const ps = await import("./coding-provider-setup.mjs");
   const keys = allKeys ? ps.keysForBackend(allKeys, ks.backendId) : null;
   if (keys && keys.length >= 1) {
-    await manageCodingKeys(ks, keys);
+    // ONE SERVER'S KEYS (task #245): the same picker /agent-model and /embed-model open.
+    await manageServerKeys({ role: "coding", backendId: ks.backendId, host: ks.provider || ks.backendId || "this server", model: ks.model });
     return;
   }
 
@@ -7900,13 +7608,10 @@ async function replaceCodingKey() {
     // the strength of a question that was asked about one provider.
     const id = await promptNewCodingKey(ks.backendId, ks.provider);
     if (id) {
-      // A key you just added for THIS coder is the one you mean to use (follow-up: "when i
-      // added a new ollama cloud api key, make it the chosen one"). Pinning used to be skipped
-      // here on the reasoning that one key is the account default anyway — but a SECOND key
-      // later leaves this folder un-pinned, and the bar then reads the old coder's key until
-      // ctrl+k is opened by hand. Pin now so the new key is chosen from the start.
-      sessionCodingKeyId = id;
-      await saveSessionCodingKeyId(resolve(process.cwd()));
+      // THE SERVER'S FIRST KEY IS ITS DEFAULT (task #245) — the API stamped it — so this folder
+      // FOLLOWS it rather than pinning a copy: a later "make X the default" then reaches this
+      // folder too, which is what "the first choice is the default for every later project" means.
+      await saveFolderKeyPick("coding", "");
       codingKeyMissingKnown = false;
       keyChoicePending = false;
       const kd = await fetchCodingKey(ks.backendId || "");
@@ -7943,127 +7648,196 @@ async function replaceCodingKey() {
 }
 
 /**
- * Choose which stored key THIS FOLDER uses, or add another (task #222).
- *
- * The choice is per folder and is stored as an ID — two projects can run the same coder on
- * different keys, which is the point. The secret never reaches this machine: the id travels
- * with the turn, the API records it on the job, and the worker resolves it from there.
+ * THE KEYS OF ONE SERVER — switch, add, make default, delete — ONE FLOW FOR ALL THREE ROLES
+ * (task #245). /model's ctrl+k, /agent-model and /embed-model all land here, so a key behaves the
+ * same whichever model you reached it from.
+ *
+ *  · LISTS THIS SERVER'S KEYS ONLY ("keys of current url only"), then any key tied to no server
+ *    yet — picking one of those ties it to this server, since a key belongs to one URL.
+ *  · A PICK asks where it applies: just this folder's <role>, or the server's default for every
+ *    folder without its own pick. The first key chosen for a server is already its default.
+ *  · DELETE previews first (the API's dry run) and says what goes with it — above all when it is
+ *    the FIRST key entered for the server, the one its model list was loaded with.
+ *
+ * `role` is "coding" | "agent" | "embed"; `backendId` the server's row id; `host` its name.
+ * Returns the id now in use for this folder's role, or "" when nothing changed.
  */
-async function manageCodingKeys(ks, keys) {
-  const current = sessionCodingKeyId;
-  const rows = keys.map(
-    (k) =>
-      `${k.name}${dim(`  ····${k.tail}`)}${k.id === current ? accent("  (this folder)") : ""}`
+async function manageServerKeys({ role = "coding", backendId, host, model = "" }) {
+  const sk = await import("./server-keys.mjs");
+  const { label: roleLabel } = sk.roleOf(role);
+  const folderKeyId = role === "agent" ? sessionAgentKeyId : role === "embed" ? sessionEmbedKeyId : sessionCodingKeyId;
+  // No server id = an API older than provider rows (#223): it cannot scope or default a key, so
+  // the account's keys are listed and a pick is this folder's own.
+  const keys = await withPendingStatus(`reading the keys for ${host}`, () =>
+    backendId ? fetchServerKeys(backendId) : fetchCodingKeys()
   );
+  if (!keys) {
+    console.log(red(`  couldn't read the keys for ${host} — is this machine's API up to date? (\`gu api restart\`)\n`));
+    paintBar();
+    return "";
+  }
+  const inUse = sk.keyInUse(keys, backendId, folderKeyId);
+  const rows = keys.map((k) => {
+    const tags = sk.keyTags(k, { folderKeyId, inUseId: inUse?.id ?? "" });
+    return `${k.name}${dim(`  ····${k.tail}`)}${tags.length ? accent(`  (${tags.join(" · ")})`) : ""}`;
+  });
   const ADD = rows.length;
   rows.push(dim("add a new key…"));
-  console.log(
-    "\n" + GUTTER +
-      (keys.length > 1
-        ? dim(`Which key should ${folderLabel()} use for `) + accent(ks.model) + dim("?\n")
-        : dim(`${folderLabel()} uses this key for `) + accent(ks.model) + dim(" — or add another.\n"))
-  );
+  console.log("\n" + GUTTER + dim(`Keys for ${host} — ${folderLabel()}'s ${roleLabel}${model ? ` (${model})` : ""}\n`));
   console.log(GUTTER + dim("Enter chooses · ctrl+d deletes the highlighted key\n"));
-  const at = Math.max(0, keys.findIndex((k) => k.id === current));
-  const picked = await pickFromList(rows, at, { allowDelete: true });
+  const picked = await pickFromList(rows, Math.max(0, keys.findIndex((k) => k.id === inUse?.id)), { allowDelete: true });
   const idx = picked?.index ?? -1;
   if (idx < 0) {
-    console.log(GUTTER + dim("(cancelled — this folder's key is unchanged)\n"));
+    console.log(GUTTER + dim("(cancelled — nothing changed)\n"));
     paintBar();
-    return;
+    return "";
   }
 
   if (picked.action === "delete") {
-    // The "add a new key…" row is not a key. Deleting it is meaningless, and treating the index
-    // as one would delete whichever key happens to sit last.
     if (idx === ADD) {
       console.log(GUTTER + dim("(that row is not a key — nothing deleted)\n"));
       paintBar();
-      return;
+      return "";
     }
-    await deleteCodingKeyFlow(ks, keys, idx);
-    return;
+    await deleteServerKeyFlow({
+      role, key: keys[idx], host, folderKeyId,
+      lastOfServer: keys.filter((k) => k.backendId === backendId).length === 1 && keys[idx].backendId === backendId,
+    });
+    return "";
   }
 
   if (idx === ADD) {
-    // BOUND TO THE PROVIDER WHOSE PICKER THIS IS (task #223), for the same reason the empty-list
-    // prompt binds: the question was asked about one provider, so the answer belongs to it.
-    const id = await promptNewCodingKey(ks.backendId, ks.provider);
-    // A key added here is the one you wanted to use — selecting it too saves a second trip
-    // through the picker, which is the whole reason someone opened it.
-    if (id) {
-      sessionCodingKeyId = id;
-      await saveSessionCodingKeyId(resolve(process.cwd()));
-      codingKeyMissingKnown = false;
-      keyChoicePending = false;
+    const id = await promptNewCodingKey(backendId, host);
+    if (!id) {
+      paintBar();
+      return "";
     }
-    paintBar();
-    return;
+    // A key added here is one you mean to use. The API made it the server's default when it was
+    // the server's first; otherwise the question is the same as for a picked key.
+    const fresh = await fetchServerKeys(backendId);
+    const added = fresh?.find((k) => k.id === id);
+    if (added?.default) {
+      console.log(accent(`  ✓ ${added.name} is ${host}'s default key\n`));
+      paintBar();
+      return id;
+    }
+    return await applyKeyPick({ role, backendId, host, key: added ?? { id, name: "the new key", tail: "" } });
+  }
+
+  const key = keys[idx];
+  // A KEY TIED TO NO SERVER is tied to this one before it is used: it belongs to one URL now.
+  if (!key.backendId && backendId) {
+    const ok = await withPendingStatus(`tying ${key.name} to ${host}`, () => bindKeyToServer(key.id, backendId));
+    if (!ok) {
+      console.log(red(`  couldn't tie ${key.name} to ${host} — nothing changed.\n`));
+      paintBar();
+      return "";
+    }
+  }
+  return await applyKeyPick({ role, backendId, host, key });
+}
+
+/**
+ * Where a picked key applies (task #245): just this folder's role, or the server's default.
+ * Picking the server's default itself in a folder that had its own pick CLEARS the pick — the
+ * folder goes back to following the default, which is what choosing the default means.
+ */
+async function applyKeyPick({ role, backendId, host, key }) {
+  const sk = await import("./server-keys.mjs");
+  const { label: roleLabel } = sk.roleOf(role);
+  let scope = "folder";
+  if (!backendId) {
+    await saveFolderKeyPick(role, key.id);
+    console.log(accent(`  ✓ ${folderLabel()}'s ${roleLabel} → ${key.name}`) + dim(`  ····${key.tail}\n`));
+  } else if (key.default) {
+    await saveFolderKeyPick(role, "");
+    console.log(accent(`  ✓ ${folderLabel()}'s ${roleLabel} → ${key.name}`) + dim(`  ····${key.tail}  ·  ${host}'s default\n`));
+  } else {
+    const choices = sk.scopeChoices({ host, role });
+    console.log("\n" + GUTTER + dim(`Use ${key.name} for…`));
+    const at = await pickFromList(choices.map((c) => c.label), 0);
+    if (at < 0) {
+      console.log(GUTTER + dim("(cancelled — nothing changed)\n"));
+      paintBar();
+      return "";
+    }
+    scope = choices[at].scope;
+    if (scope === "default") {
+      const ok = await withPendingStatus(`making ${key.name} the default for ${host}`, () => setServerDefaultKey(backendId, key.id));
+      if (!ok) {
+        console.log(red("  couldn't change the default — nothing changed.\n"));
+        paintBar();
+        return "";
+      }
+      // This folder follows the default now, rather than pinning a copy of it.
+      await saveFolderKeyPick(role, "");
+      console.log(accent(`  ✓ ${key.name} is now ${host}'s default`) + dim(`  ····${key.tail}  ·  every folder without its own pick\n`));
+    } else {
+      await saveFolderKeyPick(role, key.id);
+      console.log(accent(`  ✓ ${folderLabel()}'s ${roleLabel} → ${key.name}`) + dim(`  ····${key.tail}  ·  this folder only\n`));
+    }
+  }
+  if (role === "coding") {
+    keyChoicePending = false;
+    codingKeyMissingKnown = false;
+    sessionApiKeyTail = key.tail || "";
   }
-  sessionCodingKeyId = keys[idx].id;
-  await saveSessionCodingKeyId(resolve(process.cwd()));
-  keyChoicePending = false; // chosen — the bar's mark comes off
-  codingKeyMissingKnown = false;
-  // The picked row already carries the correct masked tail. Do NOT refetch via
-  // fetchCodingKey(backendId): that returns the key the provider would DEFAULT to, not the key
-  // just chosen by id — and for an UNBOUND key backendId is "", so it answers the account
-  // default. Either way the bar kept showing the old/default key's tail no matter what you
-  // picked (reported: "choosing between multiple keys doesn't change the tail").
-  sessionApiKeyTail = keys[idx].tail || "";
-  console.log(
-    accent(`  ✓ ${folderLabel()} → ${keys[idx].name}`) + dim(`  ····${keys[idx].tail}\n`)
-  );
   paintBar();
+  return key.id;
+}
+
+/** Tie a key that belongs to no server to this one (PATCH, the binding only — never the secret). */
+async function bindKeyToServer(id, backendId) {
+  try {
+    const r = await fetch(`${apiBase}/api/worker/coding-keys/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+      body: JSON.stringify({ backendId }),
+      signal: AbortSignal.timeout(API_CALL_TIMEOUT_MS),
+    });
+    return r.ok;
+  } catch {
+    return false;
+  }
 }
 
 /**
- * Confirm and delete one key (task #222).
- *
- * ASKED, NOT ASSUMED. The secret is not recoverable from anything the API keeps — there is no
- * undo and no copy — so this is one of the few actions in the terminal that earns a yes/no. The
- * question names the key AND its tail, because "delete accounting?" is not enough when two keys
- * can share a name and only the last four characters tell them apart.
+ * Confirm and delete one key (task #222; the warnings are #245's).
  *
- * The two consequences worth stating up front are stated up front: deleting the key this folder
- * uses, and deleting the last key of all. Neither is refused — both are legitimate — but neither
- * should be discovered afterwards.
+ * ASKED, NOT ASSUMED — the secret is not recoverable. What goes with it is read from the API's
+ * dry run and said BEFORE the question: the FIRST key entered for the server (its model list was
+ * loaded with it), the server's default, this folder's pick, other folders' picks.
  */
-async function deleteCodingKeyFlow(ks, keys, idx) {
-  const victim = keys[idx];
-  const isCurrent = victim.id === sessionCodingKeyId;
-  const isLast = keys.length === 1;
+async function deleteServerKeyFlow({ role, key, host, folderKeyId, lastOfServer = false }) {
+  const sk = await import("./server-keys.mjs");
+  const preview = await withPendingStatus("checking what uses this key", () => previewDeleteKey(key.id));
   console.log("");
-  if (isCurrent) {
-    console.log(GUTTER + orange(`  ${folderLabel()} is using this key`) +
-      dim(" — it will fall back to the account default.\n"));
-  }
-  if (isLast) {
-    console.log(GUTTER + orange("  This is the only key stored") +
-      dim(` — ${ks.model} will have none, and coding falls back to your chat model.\n`));
-  }
-  const yes = await askYesNo(
-    `Delete the API key "${victim.name}" (····${victim.tail})? This cannot be undone.`,
-    false
-  );
+  for (const line of sk.deleteWarnings(preview, {
+    host,
+    isFolderPick: key.id === folderKeyId,
+    roleLabel: sk.roleOf(role).label,
+    lastOfServer,
+  })) {
+    console.log(GUTTER + orange(`  ${line}`));
+  }
+  const yes = await askYesNo(`Delete the API key "${key.name}" (····${key.tail})? This cannot be undone.`, false);
   if (!yes) {
     console.log(GUTTER + dim("(cancelled — nothing was deleted)\n"));
     paintBar();
     return;
   }
-  const out = await deleteCodingKey(victim.id);
+  const out = await deleteCodingKey(key.id);
   if (!out.ok) {
     console.log(red("  couldn't delete the key — try again, or remove it in web Settings → Agent\n"));
     paintBar();
     return;
   }
-  // A folder pointing at a key that no longer exists would keep sending a dead id, and every
-  // turn would silently fall back. Clear the selection so the folder is honestly on the default.
-  if (isCurrent) {
-    sessionCodingKeyId = "";
-    await saveSessionCodingKeyId(resolve(process.cwd()));
+  // A folder pointing at a deleted key would keep sending a dead id; put it back on the default.
+  for (const r of ["coding", "agent", "embed"]) {
+    const mine = r === "agent" ? sessionAgentKeyId : r === "embed" ? sessionEmbedKeyId : sessionCodingKeyId;
+    if (mine === key.id) await saveFolderKeyPick(r, "");
   }
-  console.log(accent(`  ✓ deleted ${out.name || victim.name}`) +
-    dim(`  ····${victim.tail}  ·  ${out.remaining} key(s) left\n`));
+  console.log(accent(`  ✓ deleted ${out.name || key.name}`) + dim(`  ····${key.tail}  ·  ${out.remaining} key(s) left\n`));
   paintBar();
 }
 
@@ -8641,6 +8415,10 @@ let sessionCodingModel = "";
  * a folder keeps meaning until someone picks.
  */
 let sessionCodingKeyId = "";
+// THIS FOLDER'S OWN KEY for the agent / the embedder (task #245) — per role, like the coder's.
+// "" = the server's default key, which is what a folder means until someone picks otherwise.
+let sessionAgentKeyId = "";
+let sessionEmbedKeyId = "";
 // Last 4 characters of the current API key, for display in the bottom bar
 let sessionApiKeyTail = "";
 // The friendly model name behind sessionCodingModel, for display only: the token footer
@@ -8936,24 +8714,17 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
       // Deploy target chosen via /server — host/user only (no secret), for key-auth deploys.
       ...(selectedServer ? { deployServer: selectedServer } : {}),
       ...(sessionCodingModel ? { codingModelOverride: sessionCodingModel } : {}),
-      // THE FOLDER NAMES NO KEY. A key belongs to the PROVIDER it authenticates, not to a
-      // directory — "the keys are account scope, not folder scope … folder scope is only what
-      // model i choose to use … key belongs to model".
-      //
-      // Task #222 put a chosen key on each folder, and that is what produced the reported
-      // failure: switching between two OpenAI-compatible providers inside one folder changed the
-      // model and KEPT the key, because an unbound key is eligible everywhere. Each provider was
-      // then handed the other's credential and answered 401 —
-      //     api.openai.com   Incorrect API key provided: sk-0Ug2d***Vgic
-      //     api.moonshot.ai  Invalid Authentication
+      // THIS FOLDER'S OWN KEY PICKS, PER ROLE (task #245) — ids, never secrets, recorded on the
+      // job so two folders' concurrent turns each resolve their own.
       //
-      // Nothing is lost by dropping it. #222's real requirement was that two turns running at
-      // once must not read a shared mutable selection. That still holds without a key on the
-      // folder: `codingModelOverride` below names the (provider, model) pair for THIS turn, and
-      // the API records the provider on the job as `codingBackendId` (app.ts, from the resolved
-      // pick). codingKeyForJob then reads it back and prefers a key BOUND to that provider — so
-      // each concurrent turn resolves its own credential from its own provider, which is the
-      // rule above and needs nothing new.
+      // They were dropped once (#222 → the "folder names no key" rule) because an UNBOUND key
+      // picked in a folder followed the folder from provider to provider, and each provider was
+      // handed the other's credential (api.openai.com and api.moonshot.ai both 401'd). That is
+      // now impossible at the API: a pick counts only when it is one of the turn's SERVER'S OWN
+      // keys (resolveCodingApiKey), and anything else falls back to that server's default key.
+      ...(sessionCodingKeyId ? { codingKeyId: sessionCodingKeyId } : {}),
+      ...(sessionAgentKeyId ? { agentKeyId: sessionAgentKeyId } : {}),
+      ...(sessionEmbedKeyId ? { embedKeyId: sessionEmbedKeyId } : {}),
     }),
   });
   const data = res ? await res.json().catch(() => ({})) : {};
@@ -10328,10 +10099,14 @@ async function main() {
         sessionCodingUrl = dbChoice.codingUrl;
       }
       if (dbChoice.codingKeyId) sessionCodingKeyId = dbChoice.codingKeyId;
+      sessionAgentKeyId = dbChoice.agentKeyId;
+      sessionEmbedKeyId = dbChoice.embedKeyId;
       // Refresh the local cache so the file matches the database.
       try {
         await updateSessionFile(resolve(process.cwd()), (raw) => {
           raw.codingKeyId = dbChoice.codingKeyId;
+          raw.agentKeyId = dbChoice.agentKeyId;
+          raw.embedKeyId = dbChoice.embedKeyId;
           raw.codingModel = dbChoice.codingModel;
           raw.codingLabel = dbChoice.codingLabel;
           raw.codingUrl = dbChoice.codingUrl;
@@ -10349,6 +10124,8 @@ async function main() {
         sessionCodingUrl = c.url;
       }
       sessionCodingKeyId = await loadSessionCodingKeyId(resolve(process.cwd())); // task #222
+      sessionAgentKeyId = await loadSessionFolderKeyId(resolve(process.cwd()), "agent"); // task #245
+      sessionEmbedKeyId = await loadSessionFolderKeyId(resolve(process.cwd()), "embed");
     }
   }
   // Fetch the API key tail after loading the session, if a key is configured