@tiens.nguyen/gu-cli 1.0.762 → 1.0.764

package/client-expert-setup.mjs

@@ -614,3 +614,197 @@ export function shouldAskMode({ chosenMode, isTty, expertAvailable }) {
   if (!isTty) return false; // a pipe or CI has nobody to answer
   return Boolean(expertAvailable);
 }
+
+/**
+ * `--license <pro token>` — the flag that unlocks the first-run MODE MENU.
+ *
+ * The menu ("how should this machine run?" — hosted client / MLX host / private) used to be
+ * shown to every first install. It is now a pro feature: a bare `gu` goes PRIVATE by default
+ * (Client Expert — the whole stack on this machine, nothing shared), and the only way to be
+ * offered the hosted modes is to start with a license token. The token itself is NOT validated
+ * here and NOT stored — it only gates which question gets asked, this run. Returns the trimmed
+ * token, or "" when absent.
+ */
+export function parseLicenseFlag(argv) {
+  const args = Array.isArray(argv) ? argv : [];
+  for (let i = 0; i < args.length; i += 1) {
+    const a = String(args[i] ?? "");
+    if (a === "--license") return String(args[i + 1] ?? "").trim();
+    if (a.startsWith("--license=")) return a.slice("--license=".length).trim();
+  }
+  return "";
+}
+
+/**
+ * What a first run DOES about the mode question.
+ *
+ *   · WITH a license token → ask: the three-mode menu, exactly as before.
+ *   · WITHOUT one          → a silent default: "client-expert" (private) when this machine can
+ *                            run it, otherwise "client" (cloud works everywhere).
+ *
+ * The default lands on the mode that KEEPS DATA ON THE MACHINE on purpose: choosing hosted
+ * storage for someone is a privacy decision they have to make themselves — which is exactly
+ * what the license-gated menu is for. Pure, so the rule is a test row rather than something to
+ * re-read in the REPL.
+ */
+export function resolveFirstRunMode({ licenseToken, expertAvailable } = {}) {
+  if (String(licenseToken ?? "").trim()) return { ask: true, mode: null };
+  if (expertAvailable) return { ask: false, mode: "client-expert" };
+  return { ask: false, mode: "client" };
+}
+
+/**
+ * DOES THIS EVEN LOOK LIKE A GU LICENSE TOKEN? — the cheap, first-step check (task #13).
+ *
+ * Runs BEFORE any key or network work: a token that fails this is not worth verifying, so the
+ * caller can warn and re-ask immediately. Pure, synchronous, never throws.
+ *
+ *   ok:true            — trimmed, three parts, `gu1` prefix, and the payload is base64url that
+ *                        parses as a JSON object. Says nothing about the signature or the account.
+ *   ok:false, why      — "empty" | "shape" (not three parts / wrong prefix) | "payload" (the
+ *                        middle part is not decodable JSON). Callers print `why` in the warning.
+ *
+ * This is deliberately NOT verifyCliToken: that needs the public key and proves the signature;
+ * this only answers "is it plausible enough to bother with". validateLicenseToken still runs the
+ * full check — this just lets the UI fail fast and re-prompt.
+ */
+export function licenseTokenFormat(token) {
+  const t = String(token ?? "").trim();
+  if (!t) return { ok: false, why: "empty" };
+  const parts = t.split(".");
+  if (parts.length !== 3 || parts[0] !== "gu1" || !parts[1] || !parts[2]) return { ok: false, why: "shape" };
+  try {
+    const json = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const payload = JSON.parse(json);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { ok: false, why: "payload" };
+  } catch {
+    return { ok: false, why: "payload" };
+  }
+  return { ok: true, why: "ok" };
+}
+
+// ---------------------------------------------------------------------------
+// IS THE PRO TOKEN REAL? — checked, not just present (task #12).
+//
+// `--license` used to gate the menu on PRESENCE alone: any non-empty string was "pro". Now a
+// token has to prove itself twice before the menu opens:
+//
+//   1. OFFLINE — the Ed25519 signature is verified against the same public key cli-token.mjs
+//      uses. Garbage (`--license foo`) never leaves the machine.
+//   2. LIVE    — the token is offered to the hosted API's /api/billing/cli-token/renew, the
+//      one call that re-reads the subscription on every request. A token the API will not
+//      renew (forged, or for an account that no longer exists) is refused.
+//
+// The token is still NOT stored here — proving it is all this run needs; if the user picks a
+// mode that needs the token again, that path asks/pastes it as before.
+// ---------------------------------------------------------------------------
+
+/**
+ * One validation attempt. Returns { ok, reason, detail? } — never throws.
+ *
+ *   ok:true           — signature verified offline AND the hosted API accepted the token.
+ *   ok:false, reason: "malformed" | "bad-signature" — failed the offline check (detail = why).
+ *   ok:false, reason: "rejected"  — the API refused it (detail = http-<status>).
+ *   ok:false, reason: "unverified"— offline check passed but the API could not be reached
+ *                                    (detail = timeout | network | no-api | http-5xx | bad-response).
+ *
+ * `hostedBase` falls back to device-login.mjs DEFAULT_API_BASE when not given; GU_TOKEN_API_BASE
+ * (the env the renew loop already honours) wins over both, so staging checks the staging API.
+ */
+export async function validateLicenseToken(token, {
+  hostedBase,
+  fetchImpl = fetch,
+  timeoutMs = 8000,
+  env = process.env,
+} = {}) {
+  const t = String(token ?? "").trim();
+  if (!t) return { ok: false, reason: "malformed", detail: "empty" };
+  // Format first (task #13): a token that isn't even shaped right never reaches the key check,
+  // let alone the network. licenseTokenFormat is the same rule, applied cheap.
+  if (!licenseTokenFormat(t).ok) return { ok: false, reason: "malformed", detail: "format" };
+  const { verifyCliToken, publicKey } = await import("./cli-token.mjs");
+  const offline = verifyCliToken(t, publicKey(env));
+  if (!offline.ok) return { ok: false, reason: offline.why === "malformed" ? "malformed" : "bad-signature", detail: offline.why };
+  let base = String(hostedBase ?? "").trim() || String(env.GU_TOKEN_API_BASE ?? "").trim();
+  if (!base) {
+    try {
+      ({ DEFAULT_API_BASE: base } = await import("./device-login.mjs"));
+    } catch {
+      return { ok: false, reason: "unverified", detail: "no-api" };
+    }
+  }
+  base = base.replace(/\/+$/, "");
+  try {
+    const res = await fetchImpl(`${base}/api/billing/cli-token/renew`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${t}` },
+      body: "{}",
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (res.status === 401 || res.status === 403) return { ok: false, reason: "rejected", detail: `http-${res.status}` };
+    if (!res.ok) return { ok: false, reason: "unverified", detail: `http-${res.status}` };
+    const data = await res.json().catch(() => null);
+    return typeof data?.token === "string" && data.token
+      ? { ok: true }
+      : { ok: false, reason: "unverified", detail: "bad-response" };
+  } catch (e) {
+    return { ok: false, reason: "unverified", detail: e?.name === "TimeoutError" ? "timeout" : "network" };
+  }
+}
+
+/**
+ * What a validation result DOES to the first-run plan — pure, so the policy is a test row:
+ *
+ *   · valid      → the menu, exactly as promised.
+ *   · rejected / bad token → the private default (or cloud): the token was ASKED for and
+ *                            refused, so the caller must SAY it was refused (rejected:true).
+ *   · unverified → the menu stands: the token proved its signature offline and the soft-licence
+ *                  rule (a network outage never blocks a paid user) applies to the menu too.
+ *                  Callers may show a one-line "couldn't confirm" note.
+ */
+export function validateLicenseVerdict({ licenseToken, expertAvailable }, result) {
+  const fallback = resolveFirstRunMode({ licenseToken: "", expertAvailable });
+  if (result?.ok) return { ask: true, mode: null, rejected: false, unverified: false };
+  if (result?.reason === "unverified") return { ask: true, mode: null, rejected: false, unverified: true };
+  return { ...fallback, rejected: Boolean(String(licenseToken ?? "").trim()), unverified: false };
+}
+
+/**
+ * ASK UNTIL THE TOKEN IS REAL, OR THE USER GIVES UP (task #13).
+ *
+ * The one-shot validate-and-fall-back made an invalid token silently pick private mode for the
+ * user. Instead: warn, and let them paste another token. The loop ends three ways:
+ *
+ *   · a token validates (or is unverifiable — soft licence) → { token, result } with ok/!rejected;
+ *   · empty Enter on the re-ask → the user declines: { token: "", result: null } → the caller
+ *     falls back to the private default, exactly as a bare `gu` would;
+ *   · the very first token is already good → returned immediately, no extra prompt.
+ *
+ * `ask` is the one-question readline helper (gu-repl's ask0/ask). `warn` prints the one-line
+ * "that token wasn't accepted" message; injectable so tests stay silent. `validate` is
+ * validateLicenseToken by default; injectable for tests. Never throws — a validation that errors
+ * is treated as unverifiable, not a crash.
+ */
+export async function promptForLicenseToken(ask, initialToken, {
+  validate = validateLicenseToken,
+  validateOpts = {},
+  warn = (msg) => console.log(msg),
+  maxTries = 5,
+} = {}) {
+  let token = String(initialToken ?? "").trim();
+  for (let attempt = 0; attempt < maxTries; attempt += 1) {
+    // Format gate first — a malformed token is warned about WITHOUT a network round-trip.
+    const fmt = licenseTokenFormat(token);
+    if (token && !fmt.ok) {
+      warn(`  That doesn't look like a gu license token (${fmt.why}). Check you pasted the whole thing.`);
+    } else if (token) {
+      const result = await validate(token, validateOpts).catch(() => ({ ok: false, reason: "unverified", detail: "error" }));
+      if (result.ok || result.reason === "unverified") return { token, result, declined: false };
+      warn(`  That license token was not accepted (${result.detail ?? result.reason}).`);
+    }
+    const again = String(await ask("  Paste a pro license token to choose a hosted mode, or press Enter to keep this machine private: ") ?? "").trim();
+    if (!again) return { token: "", result: null, declined: true };
+    token = again;
+  }
+  return { token: "", result: null, declined: true };
+}

package/gu-repl.mjs

@@ -569,13 +569,16 @@ if (cliVerdict.kind === "run") {
 } else if (argv.includes("--help") || argv.includes("-h")) {
   console.log(
     "gu — terminal agent REPL for the current folder\n\n" +
-      "Usage: gu [-v|--verbose]\n" +
+      "Usage: gu [-v|--verbose] [--license <pro token>]\n" +
       "       gu status                 # worker + a table of the running model servers\n" +
       "       gu start|stop|restart|logs # manage the background worker\n" +
       "       gu logs <port|pid> [-f]   # tail a running model server's log\n" +
       "       gu doctor|login|set        # models / account (same as `gu-cli …`)\n" +
       "       gu rag                    # is RAG working? tests the embedder end-to-end\n\n" +
       "  -v, --verbose   show RAG index-file activity in the bottom bar (each shard written)\n" +
+      "  --license <token>  pro license: a first install ASKS how this machine runs (hosted\n" +
+      "                     client / MLX host / private). Without it, a first install is\n" +
+      "                     private by default — the whole stack on this machine.\n" +
       "  -h, --help      this help\n\n" +
       "Auth comes from ~/.gonext/worker.env; models/budgets/RAG come from your web Settings.\n" +
       "Inside the REPL: /exit · /model · /new · /help — Ctrl-C stops following a turn.\n" +
@@ -664,13 +667,59 @@ if (!workerKey || !apiBase) {
         const {
           probeMachine, askMode, runClientExpertSetup, loadState, saveState,
         } = await import("./client-expert-run.mjs");
-        const { clientExpertAvailable } = await import("./client-expert-setup.mjs");
+        const { clientExpertAvailable, parseLicenseFlag, resolveFirstRunMode, promptForLicenseToken } =
+          await import("./client-expert-setup.mjs");
         const machine0 = await probeMachine();
         const gate0 = clientExpertAvailable({ workerEnvExists: false, ...machine0 });
-        const mode0 = await askMode(ask0, {
+        // THE MENU IS A PRO FEATURE. A bare first install no longer asks "how should this
+        // machine run?" — it goes PRIVATE (Client Expert: the whole stack on this machine,
+        // nothing shared) and walks the MongoDB/API/models setup straight away. The
+        // three-way menu (hosted client / MLX host / private) is shown only when the run
+        // carries a pro license token: `gu --license <token>`.
+        const licenseToken0 = parseLicenseFlag(argv);
+        let plan0 = resolveFirstRunMode({
+          licenseToken: licenseToken0,
           expertAvailable: gate0.available,
-          expertWhy: gate0.message,
         });
+        if (plan0.ask) {
+          // A bad token no longer picks private FOR the user: warn, and let them paste another
+          // (task #13). Format is checked first (no network), then offline signature, then the
+          // live API. Empty Enter declines → the private default. Unreachable API still opens
+          // the menu (soft licence: an outage never blocks a paid user).
+          const pick = await promptForLicenseToken(ask0, licenseToken0, {
+            validateOpts: {
+              hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
+            },
+            warn: (m) => console.log(dim(`\n${m}`)),
+          });
+          if (pick.declined || !pick.token) {
+            plan0 = resolveFirstRunMode({ licenseToken: "", expertAvailable: gate0.available });
+          } else if (pick.result && pick.result.reason === "unverified") {
+            console.log(dim("\n  Couldn't reach the license server to confirm the token — showing the menu anyway."));
+          }
+        }
+        let mode0;
+        if (plan0.ask) {
+          mode0 = await askMode(ask0, {
+            expertAvailable: gate0.available,
+            expertWhy: gate0.message,
+          });
+        } else {
+          mode0 = plan0.mode;
+          if (mode0 === "client-expert") {
+            console.log(
+              dim("\n  Private by default: the whole stack (API, database, models) is set up on") +
+              dim("\n  this machine; nothing it does is shared.")
+            );
+            console.log(
+              dim("  To pick a hosted mode instead, start with a pro license:  gu --license <token>\n")
+            );
+          } else {
+            // Private is the default, but this machine cannot run it — say why ONCE and land
+            // in cloud mode, which works everywhere, rather than installing a broken stack.
+            console.log(dim(`\n  Private mode is not available here — ${gate0.message}`));
+          }
+        }
         // RECORD IT HERE. This branch used to ask and not save, so the later mode question in
         // main() still saw no chosenMode and asked the SAME question a second time in one run —
         // and by then worker.env existed, so its answer list said Client Expert was unavailable.
@@ -813,6 +862,12 @@ const COMMANDS = [
   { name: "/context-window", usage: "/context-window [tokens|auto]", desc: "tell gu how big the coding model's context is — hosted models cannot be probed" },
   { name: "/save-settings", usage: "/save-settings [name|path]", desc: "write this account's providers, models and key NAMES to a file in your home folder (no secrets) — asks for a name, Enter keeps gu-settings.json" },
   { name: "/load-settings", usage: "/load-settings [name|path]", desc: "read that file back on another machine — picks from the settings files in your home folder, asks before it replaces anything" },
+  // PRESETS (#6) are the user's OWN JSON, not a snapshot: /save-preset takes a name AND the
+  // object {apiUrl, apiKey, agentModel, codingModel, embedModel} and validates every field
+  // before writing. A preset file HOLDS its API key (0600, home folder — the settings files'
+  // location), so it is marked "gu": "preset" and the two commands never offer each other's files.
+  { name: "/save-preset", usage: '/save-preset <name> {"apiUrl":"…","apiKey":"…","agentModel":"…","codingModel":"…","embedModel":"…"}', desc: "save a named preset: server, API key and the agent/coding/embedding models, all validated — same home folder as settings files" },
+  { name: "/load-presets", usage: "/load-presets [name]", desc: "pick a saved preset (arrow keys) and put it back — server, both models, embedder and its key; asks before it replaces anything" },
   { name: "/doctor", desc: "check every configured model ANSWERS — especially the embedder, which a turn only reaches after several steps" },
   { name: "/tokens", desc: "break down the last prompt sent to the coding model — how much of it was RAG" },
   // ONE name, /new (user, #278). /reset and /clear still work (HIDDEN_COMMANDS) for habit and
@@ -1444,6 +1499,24 @@ const imageStore = createImageStore();
 // Shown on the bottom row after a refused or failed image paste; clears itself.
 let imageNotice = "";
 let imageNoticeTimer = null;
+
+// Task #14: SETUP THE USER SKIPPED. In private / Client Expert mode the Agent + embedding
+// server prompts can now be declined ("No" / empty Enter). That is a real answer, not a
+// failure — but the machine then has no agent model and/or no embed model, and the agent
+// silently falls back (agent → coding model) or loses RAG. Say so at the BOTTOM of the screen,
+// every frame, until a model is chosen. The two warnings are INDEPENDENT: each shows only while
+// its own model is unset, and choosing that model (/agent-model, /embed-model, /setup, or the
+// API seeding one) clears only that one.
+let agentMissing = false; // no agent model chosen → agent falls back to the coding model
+let embedMissing = false; // no embed model chosen → RAG is off until /embed-model picks one
+// One footer row; the two halves are independent so a model that IS set is never named.
+const missingNoticeText = () => {
+  const parts = [];
+  if (agentMissing) parts.push("agent model is not set — using the coding model (/agent-model to choose one)");
+  if (embedMissing) parts.push("no embed model — RAG is off; choose one with /embed-model");
+  return parts.length ? "⚠ " + parts.join("  ·  ") : "";
+};
+
 function showImageNotice(text) {
   imageNotice = text;
   if (imageNoticeTimer) clearTimeout(imageNoticeTimer);
@@ -2303,6 +2376,8 @@ const footerRows = () =>
     notice: imageNotice
       ? orange("⚠ " + fitImageNotice(imageNotice, (process.stdout.columns || 80) - visibleLen(GUTTER) - 1))
       : "",
+    // Task #14: the skipped-setup warning — persistent (not a timed notice), red, its own row.
+    missing: missingNoticeText() ? red(missingNoticeText()) : "",
   });
 // True only while the MAIN loop's ">> " prompt is waiting for input. The bar belongs to that
 // prompt, so it must never appear under an ask()/askSecret() question or during a turn.
@@ -5264,6 +5339,13 @@ async function reconfigureOllamaServer() {
     role: "coder",
   });
 
+  // Task #14: skipping is a real answer, not a failure — but the bottom bar must keep saying
+  // what it cost. Declining the AGENT + embed server leaves both roles unset → both warnings.
+  if (!agent && !agentOnProvider) {
+    agentMissing = true; // no agent model chosen → the agent falls back to the coding model
+    embedMissing = true; // the embedder lives on the agent server → RAG is off until /embed-model
+  }
+
   if (!agent && !coder) {
     console.log(dim("  nothing set — models stay as they are.\n"));
     return;
@@ -6429,6 +6511,142 @@ function settingsArg(line, word) {
   return line.slice(word.length).trim();
 }
 
+/**
+ * /save-preset <name> <json> — the user TYPES the preset (#6): a name and a JSON object with
+ * apiUrl, apiKey, agentModel, codingModel and embedModel, all validated before anything is
+ * written. Unlike /save-settings (which snapshots the account and refuses secrets), a preset
+ * SAVES the API key by design — it is the "this exact setup, one command" file, stored 0600 in
+ * the same home-folder location as settings files, marked "gu": "preset" so the two commands
+ * never offer each other's files.
+ */
+async function runSavePresetCommand(line) {
+  const pr = await import("./presets-transfer.mjs");
+  const home = homedir();
+  console.log("");
+  const usage =
+    'usage: /save-preset <name> {"apiUrl":"https://…","apiKey":"…","agentModel":"…","codingModel":"…","embedModel":"…"}  (embedUrl optional)';
+  const rest = line.trim().slice("/save-preset".length).trim();
+  if (!rest) {
+    console.log(GUTTER + usage);
+    console.log("");
+    return;
+  }
+  const space = rest.search(/\s/);
+  const name = space === -1 ? rest : rest.slice(0, space);
+  const json = space === -1 ? "" : rest.slice(space + 1).trim();
+  if (!pr.isPresetName(name)) {
+    console.log(GUTTER + `"${name}" is not a preset name — one word, no slashes. ` + usage);
+    console.log("");
+    return;
+  }
+  if (!json) {
+    console.log(GUTTER + "the JSON is missing — " + usage);
+    console.log("");
+    return;
+  }
+  const checked = pr.validatePreset(json);
+  if (!checked.ok) {
+    console.log(GUTTER + `Preset not saved — ${checked.problem}`);
+    console.log("");
+    return;
+  }
+  const file = pr.presetFilePath(name, home);
+  writeFileSync(file, JSON.stringify(pr.buildPreset({ name, preset: checked.preset, host: hostname() }), null, 2) + "\n", { mode: 0o600 });
+  console.log(GUTTER + `Preset "${name}" saved to ${file}`);
+  console.log(GUTTER + dim("server + api key + agent, coding and embedding models — the key is IN this file, keep it private."));
+  console.log("");
+}
+
+/**
+ * /load-presets — list the preset files /save-preset wrote (newest first, the arrow-key picker)
+ * and apply the chosen one: the server + both models land as one coding-backend row, the preset's
+ * key is saved under the preset's name and made that row's default, and the embedder is set. The
+ * user reconfirms before anything changes, like /load-settings.
+ */
+async function runLoadPresetsCommand(line) {
+  const pr = await import("./presets-transfer.mjs");
+  const home = homedir();
+  console.log("");
+  let file = "";
+  const typed = line.trim().slice("/load-presets".length).trim();
+  if (typed) {
+    file = pr.presetFilePath(typed, home);
+    if (!file) return; // a cancel word
+    if (!existsSync(file)) {
+      console.log(GUTTER + `no preset file at ${file}`);
+      console.log("");
+      return;
+    }
+  } else {
+    const found = pr.presetFilesIn(listJsonFiles(home));
+    if (found.length === 0) {
+      console.log(GUTTER + `no presets in ${home} — save one with /save-preset <name> {…}`);
+      console.log("");
+      return;
+    }
+    let pick;
+    if (found.length === 1) {
+      pick = 0;
+      console.log(GUTTER + `one preset here: ${found[0]}`);
+    } else {
+      console.log(dim(`  Presets in ${home}  (${PICK_HINT}):`));
+      pick = await pickFromList(found.map((n) => ({ label: n })));
+    }
+    if (pick < 0) {
+      console.log(GUTTER + "load cancelled.");
+      console.log("");
+      return;
+    }
+    file = pr.presetFilePath(found[pick], home);
+  }
+  const checked = pr.validatePresetFile(readFileSync(file, "utf8"));
+  if (!checked.ok) {
+    console.log(GUTTER + `Not loaded — ${checked.problem}`);
+    console.log("");
+    return;
+  }
+  const name = checked.name || basename(file).replace(/\.json$/i, "");
+  const preset = checked.preset;
+  const settings = await fetchWorkerSettings();
+  for (const l of pr.presetPlanLines(name, preset, settings ?? {})) console.log(GUTTER + l);
+  if ((await ask("Apply this preset? [y/N] ")) !== "y") {
+    console.log(GUTTER + "load cancelled — nothing changed.");
+    console.log("");
+    return;
+  }
+  const { patch, existingRowId } = pr.presetToSettingsPatch(preset, settings ?? {});
+  const md = await import("./model-doctor.mjs");
+  const saved = await md.saveWorkerSettings(apiBase, workerKey, patch);
+  if (!saved) {
+    console.log(GUTTER + "the worker could not apply it — is the local API running? (`gu api status`)");
+    console.log("");
+    return;
+  }
+  let defaultNote = "";
+  const keyId = await addCodingKey(name, preset.apiKey, existingRowId);
+  if (keyId) {
+    // A new row's id arrives on the key's backendId once the settings write re-read; re-fetch
+    // the settings to find the row for this server when it was not one the account already had.
+    let rowId = existingRowId;
+    if (!rowId) {
+      const after = await fetchWorkerSettings();
+      const rows = Array.isArray(after?.agentCodingBackends) ? after.agentCodingBackends : [];
+      rowId = rows.find((r) => r?.id && typeof r.url === "string" && r.url.replace(/\/+$/, "").toLowerCase() === preset.apiUrl.replace(/\/+$/, "").toLowerCase())?.id ?? "";
+    }
+    if (rowId) {
+      const set = await setServerDefaultKey(rowId, keyId);
+      defaultNote = set.ok ? " — the preset's key is saved and made the server's default." : ` — the key saved but making it the default failed: ${set.error ?? "unknown"}`;
+    } else {
+      defaultNote = " — the key saved (the row's id was not readable to make it the default; set it in /agent-coding if needed).";
+    }
+  } else {
+    defaultNote = " — but the API key could not be saved (the add-key call failed; add it in /agent-coding).";
+  }
+  console.log(GUTTER + `preset "${name}" applied from ${file}${defaultNote}`);
+  console.log(GUTTER + "the new setup answers from the next prompt on.");
+  console.log("");
+}
+
 async function runSaveSettingsCommand(line) {
   const st = await import("./settings-transfer.mjs");
   const home = homedir();
@@ -10576,7 +10794,7 @@ async function main() {
   // machine that had been working for months.
   try {
     const { loadState, saveState, askMode } = await import("./client-expert-run.mjs");
-    const { clientExpertAvailable, expertPlanPending, shouldAskMode } =
+    const { clientExpertAvailable, expertPlanPending, shouldAskMode, parseLicenseFlag, resolveFirstRunMode, promptForLicenseToken } =
       await import("./client-expert-setup.mjs");
     const st = await loadState();
     const { probeMachine } = await import("./client-expert-run.mjs");
@@ -10590,10 +10808,34 @@ async function main() {
       ...machine,
     });
     if (shouldAskMode({ chosenMode: st.chosenMode, isTty: IS_TTY, expertAvailable: gate.available })) {
-      const chosen = await askMode(ask, {
+      // Same rule as the first run: the mode menu is a pro-license feature — without
+      // `--license <token>` this machine defaults to private (Client Expert) when it can
+      // run it, instead of being asked.
+      const licenseToken1 = parseLicenseFlag(argv);
+      let plan = resolveFirstRunMode({
+        licenseToken: licenseToken1,
         expertAvailable: gate.available,
-        expertWhy: gate.message,
       });
+      if (plan.ask) {
+        // Same as the first run: warn and re-ask on a bad token instead of silently picking
+        // private (task #13); empty Enter declines to the private default.
+        const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+        const pick1 = await promptForLicenseToken(ask, licenseToken1, {
+          validateOpts: {
+            hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
+          },
+          warn: (m) => console.log(dim(`\n${m}`)),
+        });
+        if (pick1.declined || !pick1.token) {
+          plan = resolveFirstRunMode({ licenseToken: "", expertAvailable: gate.available });
+        }
+      }
+      const chosen = plan.ask
+        ? await askMode(ask, {
+            expertAvailable: gate.available,
+            expertWhy: gate.message,
+          })
+        : plan.mode;
       await saveState({ ...st, chosenMode: chosen ?? "client" });
       if (chosen === "client-expert") {
         const { runClientExpertSetup } = await import("./client-expert-run.mjs");
@@ -10787,6 +11029,13 @@ async function main() {
     // #125) when no /model override is active.
     if (p.codingModelId) defaultCodingModel = p.codingModelId;
     if (p.codingBaseURL) defaultCodingUrl = p.codingBaseURL;
+    // Task #14: seed the bottom warnings from the AUTHORITATIVE payload. `agentMissing` is set
+    // by the API when no agent model is configured (and it fell back to the coding model);
+    // `ragEnabled` false means no embed model was chosen. Boot may have already set these from
+    // the local setup answers — OR them in, never clear a local "missing" on a maybe, because
+    // private mode's local API can itself be unconfigured.
+    if (p.agentMissing === true) agentMissing = true;
+    if (p.ragEnabled !== true) embedMissing = true;
     // A RESTORED PICK MUST STILL EXIST. The stored id names a model on the box this folder was
     // last pointed at — and the box can change (`/model` → change the Ollama server), a model
     // can be removed, or the folder can be opened on another machine entirely. Sending a name
@@ -11494,10 +11743,12 @@ async function main() {
     }
     if (line === "/agent-model") {
       await chooseAgentModel();
+      agentMissing = false; // Task #14: an agent model was just chosen → clear its warning
       continue;
     }
     if (line === "/embed-model") {
       await chooseEmbedModel();
+      embedMissing = false; // Task #14: an embed model was just chosen → clear its warning
       continue;
     }
     if (line === "/server") {
@@ -11535,6 +11786,14 @@ async function main() {
       await runS3Command(line);
       continue;
     }
+    if (line === "/save-preset" || line.startsWith("/save-preset ")) {
+      await runSavePresetCommand(line);
+      continue;
+    }
+    if (line === "/load-presets" || line.startsWith("/load-presets ")) {
+      await runLoadPresetsCommand(line);
+      continue;
+    }
     if (line === "/save-settings" || line.startsWith("/save-settings ")) {
       await runSaveSettingsCommand(line);
       continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.762",
+  "version": "1.0.764",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -58,6 +58,7 @@
     "cli-token.mjs",
     "credential-recovery.mjs",
     "settings-transfer.mjs",
+    "presets-transfer.mjs",
     "device-login.mjs",
     "daemon-control.mjs",
     "log-policy.mjs",

package/presets-transfer.mjs

@@ -0,0 +1,215 @@
+/**
+ * MODEL PRESETS — the files /save-preset writes and /load-presets reads (#6).
+ *
+ * HOW A PRESET DIFFERS FROM A SETTINGS FILE. /save-settings asks nothing: it writes the whole
+ * account, names the keys, and refuses to carry a single secret. /save-preset is the opposite
+ * posture: the user TYPES the preset — a name and the JSON themselves — so whatever they put is
+ * by definition something they chose to store, including a live API key. The validator therefore
+ * REQUIRES what /save-settings forbids: apiUrl, apiKey, agentModel, codingModel and embedModel
+ * are all mandatory, and the file lands 0600 in the same home-folder location.
+ *
+ * WHAT A PRESET APPLIES. Everything but the embedder maps to a coding backend row: one row holds
+ * the URL, the coding model (as defaultModel) and — if the agent model is a different model on
+ * the same server — the agent model as an extra model of that row. The embedder is the global
+ * ragEmbedUrl/ragEmbedModel pair, exactly like a settings file. The apiKey is stored under the
+ * preset's name, bound to that row, and made the row's DEFAULT key so the resolver finds it.
+ *
+ * THE MARKER. A preset file carries "gu": "preset" (not "settings") so /load-settings never
+ * offers it and /load-presets never offers a settings file — two commands, two folders' worth of
+ * files, no cross-picking.
+ */
+
+import { basename, extname, isAbsolute, join, resolve } from "node:path";
+import { ensureV1Root, isCancelWord, MAX_MODELS_PER_SERVER } from "./coding-provider-setup.mjs";
+
+/** The file name used when none is given — in the default folder (the home directory). */
+export const DEFAULT_PRESET_NAME = "gu-preset.json";
+
+/** Bumped only when an older gu could not read a newer preset correctly. */
+export const PRESET_FILE_VERSION = 1;
+
+const clean = (v) => (typeof v === "string" ? v.trim() : "");
+const isHttpUrl = (v) => typeof v === "string" && /^https?:\/\/\S+$/i.test(v.trim());
+
+/** A preset name is a file name: no path separators, no dots that hide it, one word of space. */
+export function isPresetName(name) {
+  const n = clean(name);
+  return Boolean(n) && n.length <= 60 && !/[\/]/.test(n) && !/^\.+$/.test(n) && !isCancelWord(n);
+}
+
+/**
+ * What was typed → the file to use. Same rules as settingsFilePath: the DEFAULT FOLDER is the
+ * home directory, so a bare NAME is all anyone has to type ("work" → ~/work.json); a real path
+ * still works as one. Returns "" for a cancel word, which the caller treats as a cancel.
+ */
+export function presetFilePath(typed, home) {
+  const t = clean(typed).replace(/^['"]|['"]$/g, "").trim();
+  if (!t) return join(home, DEFAULT_PRESET_NAME);
+  if (isCancelWord(t)) return "";
+  if (t === "~") return join(home, DEFAULT_PRESET_NAME);
+  if (t.startsWith("~/")) return withJson(join(home, t.slice(2)));
+  if (isAbsolute(t) || t.startsWith("./") || t.startsWith("../") || /[\/]/.test(t)) return resolve(t);
+  return withJson(join(home, t));
+}
+
+const withJson = (p) => (extname(basename(p)) ? p : `${p}.json`);
+
+/**
+ * The preset files in the default folder, newest first — what /load-presets offers. Only files
+ * that ARE preset files (the "gu": "preset" marker). `entries` = [{ name, text, mtimeMs }], and
+ * each name is returned as just the preset name (the .json comes off — it is the name the user
+ * typed when saving).
+ */
+export function presetFilesIn(entries) {
+  return (Array.isArray(entries) ? entries : [])
+    .filter((e) => e && /\.json$/i.test(e.name) && /"gu"\s*:\s*"preset"/.test(String(e.text ?? "")))
+    .sort((a, b) => (b.mtimeMs ?? 0) - (a.mtimeMs ?? 0))
+    .map((e) => e.name.replace(/\.json$/i, ""));
+}
+
+/**
+ * Parse + validate the JSON the user typed after /save-preset <name>. EVERY field is required —
+ * a preset that holds only some of the setup is a trap: loading it half-configures a machine and
+ * the half that is missing is the half nobody notices until a turn fails.
+ *
+ *   { "apiUrl": "https://api.openai.com/v1",
+ *     "apiKey": "sk-…",
+ *     "agentModel": "gpt-5",
+ *     "codingModel": "gpt-5",
+ *     "embedModel": "nomic-embed-text",
+ *     "embedUrl": "https://ollama.com" }        ← embedUrl optional; defaults to apiUrl
+ *
+ * ONE PROBLEM, NAMED — the first real problem refuses the whole preset, before anything is
+ * written. Returns { ok: true, preset } or { ok: false, problem }.
+ */
+export function validatePreset(text) {
+  let doc;
+  try {
+    doc = JSON.parse(String(text));
+  } catch {
+    return { ok: false, problem: "that is not JSON — paste one object: { apiUrl, apiKey, agentModel, codingModel, embedModel }." };
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    return { ok: false, problem: "a preset is one JSON object: { apiUrl, apiKey, agentModel, codingModel, embedModel }." };
+  }
+  if (!isHttpUrl(doc.apiUrl)) {
+    return { ok: false, problem: `apiUrl must be an http(s) URL — got ${JSON.stringify(doc.apiUrl)}.` };
+  }
+  if (!clean(doc.apiKey)) {
+    return { ok: false, problem: "apiKey is required — a preset saves the key so loading needs nothing else." };
+  }
+  for (const f of ["agentModel", "codingModel", "embedModel"]) {
+    if (!clean(doc[f])) return { ok: false, problem: `${f} is required and must be a model name — got ${JSON.stringify(doc[f])}.` };
+  }
+  if (doc.embedUrl !== undefined && doc.embedUrl !== "" && !isHttpUrl(doc.embedUrl)) {
+    return { ok: false, problem: `embedUrl must be an http(s) URL — got ${JSON.stringify(doc.embedUrl)}.` };
+  }
+  const apiUrl = ensureV1Root(clean(doc.apiUrl));
+  return {
+    ok: true,
+    preset: {
+      apiUrl,
+      apiKey: clean(doc.apiKey),
+      agentModel: clean(doc.agentModel),
+      codingModel: clean(doc.codingModel),
+      embedModel: clean(doc.embedModel),
+      embedUrl: doc.embedUrl ? ensureV1Root(clean(doc.embedUrl)) : apiUrl,
+    },
+  };
+}
+
+/** The object /save-preset writes. The name travels INSIDE the file so a renamed file still says what it was. */
+export function buildPreset({ name, preset, now = new Date(), host = "" } = {}) {
+  return {
+    gu: "preset",
+    version: PRESET_FILE_VERSION,
+    note: "A named model preset: server, key and the agent / coding / embedding models. This file CONTAINS a live API key.",
+    name: clean(name),
+    savedAt: new Date(now).toISOString(),
+    ...(host ? { savedOn: host } : {}),
+    apiUrl: preset.apiUrl,
+    apiKey: preset.apiKey,
+    agentModel: preset.agentModel,
+    codingModel: preset.codingModel,
+    embedModel: preset.embedModel,
+    embedUrl: preset.embedUrl,
+  };
+}
+
+/**
+ * Read a preset FILE back. Strict like validatePreset, plus the markers so a settings file or a
+ * random JSON is refused with a sentence instead of applied as a preset.
+ */
+export function validatePresetFile(text) {
+  let doc;
+  try {
+    doc = JSON.parse(String(text));
+  } catch {
+    return { ok: false, problem: "that file is not JSON — is it a file /save-preset wrote?" };
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc) || doc.gu !== "preset") {
+    return { ok: false, problem: 'that file is not a gu preset file (no "gu": "preset" marker).' };
+  }
+  if (doc.version !== PRESET_FILE_VERSION) {
+    return {
+      ok: false,
+      problem: `that preset is version ${JSON.stringify(doc.version)}; this gu writes and reads version ${PRESET_FILE_VERSION}. Update gu, or save it again.`,
+    };
+  }
+  const back = validatePreset(JSON.stringify(doc));
+  if (!back.ok) return back;
+  return { ok: true, name: clean(doc.name), preset: back.preset, savedAt: clean(doc.savedAt), savedOn: clean(doc.savedOn) };
+}
+
+/**
+ * The POST body for /api/worker/settings that applies a preset. One coding backend row carries
+ * the server and BOTH models: the coding model as the default, the agent model as a second
+ * model of the same row when they differ — one server is one row, the rule every picker and the
+ * API itself already enforce. A row this account already has for that server KEEPS ITS ROW ID
+ * (the settings-transfer reason: a key whose row is re-minted is stranded forever). The embedder
+ * is the global pair, cleared of any account-wide key pick so the row's keys resolve it.
+ */
+export function presetToSettingsPatch(preset, current = {}) {
+  const existing = Array.isArray(current.agentCodingBackends) ? current.agentCodingBackends : [];
+  const sameServer = (a, b) =>
+    Boolean(clean(a) && clean(b)) && ensureV1Root(clean(a)).toLowerCase() === ensureV1Root(clean(b)).toLowerCase();
+  const mine = existing.find((r) => r?.id && sameServer(r.url, preset.apiUrl));
+  const models = [...new Set([preset.agentModel, preset.codingModel])].filter((m) => m !== preset.codingModel);
+  const row = {
+    ...(mine?.id ? { id: mine.id } : {}),
+    kind: mine?.kind ?? "openai",
+    url: preset.apiUrl,
+    defaultModel: preset.codingModel,
+    models: models.slice(0, MAX_MODELS_PER_SERVER),
+    enabled: true,
+  };
+  return {
+    patch: {
+      agentCodingBackends: [row],
+      agentModelUrl: preset.apiUrl,
+      agentModelName: preset.agentModel,
+      ragEmbedUrl: preset.embedUrl,
+      ragEmbedModel: preset.embedModel,
+      ragEmbedKeyId: "",
+    },
+    existingRowId: mine?.id ?? "",
+  };
+}
+
+/** The lines /load-presets prints before it asks — what applying the preset will do. */
+export function presetPlanLines(name, preset, current = {}) {
+  const same = (a, b) => clean(a).toLowerCase() === clean(b).toLowerCase();
+  const lines = [];
+  lines.push(`preset "${name}":`);
+  lines.push(`  server:        ${preset.apiUrl}`);
+  lines.push(`  coding model:  ${preset.codingModel}`);
+  lines.push(`  agent model:   ${preset.agentModel}`);
+  const embedSame = same(preset.embedUrl, current.ragEmbedUrl) && same(preset.embedModel, current.ragEmbedModel);
+  lines.push(`  embedding:     ${preset.embedModel} at ${preset.embedUrl}${embedSame ? "  (already set)" : ""}`);
+  if (!embedSame && preset.embedModel !== clean(current.ragEmbedModel) && clean(current.ragEmbedModel)) {
+    lines.push("  a different embedder: every knowledge base rebuilds on its next search.");
+  }
+  lines.push(`  api key:       saved as "${clean(name)}", made the server's default`);
+  lines.push("  replaces the coding provider list with this one server.");
+  return lines;
+}

package/terminal-layout.mjs

@@ -476,6 +476,7 @@ export function buildFooterRows({
   token = "",
   mode = "",
   notice = "",
+  missing = "",
 }) {
   const w = Math.max(20, width || 80);
   return [
@@ -488,6 +489,10 @@ export function buildFooterRows({
     // used to be appended to that row and was clipped at the right edge ("…pick one with /mo").
     // Present only while it shows; paintBar re-cuts the frozen zone when the count changes.
     ...(notice ? [clipVisible(gutter + notice, w - 1)] : []),
+    // Task #14: a skipped model setup stays VISIBLE. When private/client-expert setup was
+    // declined the agent model and/or the embed model is unset — say so at the bottom, every
+    // frame, until one is chosen. Its own row, under the passing notice, so it persists.
+    ...(missing ? [clipVisible(gutter + missing, w - 1)] : []),
   ];
 }