@tiens.nguyen/gu-cli 1.0.763 → 1.0.765

package/client-expert-run.mjs

@@ -46,6 +46,9 @@ import {
   clientExpertAvailable,
   mongoInstallPlan,
   mongoDockerPlan,
+  buildMongoUri,
+  mongoShellPingCommand,
+  mongoAuthVerdict,
   MONGO_DOCKER_NAME,
 } from "./client-expert-setup.mjs";
 
@@ -299,6 +302,79 @@ export async function startMongoInDocker(ask, { platform = process.platform } =
   return false;
 }
 
+/**
+ * Does MongoDB accept THIS uri — credentials included? (task #15)
+ *
+ * Asks a mongo shell, because the shell is all that exists at this point in setup: the API
+ * package (and the mongodb driver inside it) is downloaded LATER. `mongosh` first, the legacy
+ * `mongo` shell second. When neither exists the answer is { ok: null, unverifiable: true } —
+ * honestly "cannot check", which is a different thing from "check failed": the seed step still
+ * verifies the URI for real before anything is written.
+ */
+export async function checkMongoConnection(uri) {
+  for (const shell of ["mongosh", "mongo"]) {
+    const has = await tryRun("sh", ["-c", `command -v ${shell} || true`]);
+    if (!has || !has.trim()) continue;
+    const out = await tryRun(shell, mongoShellPingCommand(uri), 12000);
+    return mongoAuthVerdict({ output: out });
+  }
+  return {
+    ok: null,
+    unverifiable: true,
+    why: "no mongo shell on this machine to check with — it will be verified for real " +
+      "when the database is seeded",
+  };
+}
+
+/**
+ * Confirm WHO the MongoDB on this machine belongs to, and collect credentials when it is not
+ * the one setup would have created (task #15).
+ *
+ * THE CASE: something is already answering on 27017 — a MongoDB the OS had before gu — and it
+ * has its OWN username/password, which we do not have admin access to. Seeding into it with
+ * the default empty credentials then fails two steps later, after a 360-package install, with
+ * a message about "a permissions or connection-string problem". The question belongs at the
+ * mongo step, where the answer is still cheap to change.
+ *
+ * Returns { uri, custom } to continue with, or { exit: true } when the user declines — the
+ * caller ends setup with the `gu clear` → `gu` hint.
+ */
+export async function askMongoCredentials(ask) {
+  const { host, port } = mongoHostPort(LOCAL_MONGO_URI);
+  console.log(dim(`  MongoDB is answering at ${host}:${port}.`));
+  console.log(dim("  If that is a MongoDB this machine already had, it may have its OWN"));
+  console.log(dim("  username and password — which setup does not know, and cannot change."));
+  const yes = await ask("  Use the default (empty username and password)? [Y/n]: ");
+  if (!String(yes ?? "").trim().toLowerCase().startsWith("n")) {
+    return { uri: LOCAL_MONGO_URI, custom: false };
+  }
+  // NO → the instance has its own credentials. Ask for them, and CHECK before any installing
+  // continues: a typo found here costs ten seconds; found at the seed step it costs the run.
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const username = String(await ask("  MongoDB username: ") ?? "").trim();
+    const password = String(await ask("  MongoDB password: ") ?? "");
+    const uri = buildMongoUri({ username, password, host, port });
+    process.stdout.write(dim("  checking the connection…"));
+    const verdict = await checkMongoConnection(uri);
+    if (verdict.ok === true) {
+      console.log("\n  " + cyan("✓ Connection OK") + dim(" — those credentials work"));
+      return { uri, custom: true };
+    }
+    if (verdict.unverifiable) {
+      console.log("\n  " + yellow("⚠ could not verify: ") + dim(verdict.why));
+      const carryOn = await ask("  Continue with these credentials anyway? [Y/n]: ");
+      if (!String(carryOn ?? "").trim().toLowerCase().startsWith("n")) {
+        return { uri, custom: true, unverified: true };
+      }
+    } else {
+      console.log("\n  " + red("✗ Check Connection failed") + dim(` — ${verdict.why}`));
+    }
+    const again = await ask("  Re-enter the username and password? [y/N]: ");
+    if (!String(again ?? "").trim().toLowerCase().startsWith("y")) return { exit: true };
+  }
+  return { exit: true };
+}
+
 /**
  * Where the published API packages live. Overridable so a fork, a staging bucket or an
  * air-gapped mirror does not need a code change.
@@ -616,6 +692,36 @@ export async function runClientExpertSetup({ ask }) {
   }
 
   console.log("\n  " + cyan("✓ MongoDB is running") + dim(` (${mongo.how})`));
+
+  // --- whose MongoDB is it? (task #15) ---------------------------------------------------
+  // Something answering on 27017 is not necessarily a database setup can USE: an instance the
+  // OS already had may carry its own admin credentials, and seeding into it with the default
+  // empty pair fails two steps later, after the 360-package install, with a message pointing
+  // at the wrong thing. Confirm the credentials HERE, where changing the answer is cheap.
+  // A uri already in state — a resumed run — is reused silently, like every other answered
+  // question, and a URI forced via GONEXT_LOCAL_MONGO_URI is taken as deliberate.
+  let mongoUri = LOCAL_MONGO_URI;
+  if (typeof state.localMongoUri === "string" && state.localMongoUri) {
+    mongoUri = state.localMongoUri;
+    if (mongoUri !== LOCAL_MONGO_URI) {
+      console.log(dim("  using the MongoDB credentials from the previous run"));
+    }
+  } else if (!process.env.GONEXT_LOCAL_MONGO_URI) {
+    const credsChoice = await askMongoCredentials(ask);
+    if (credsChoice.exit) {
+      console.log("\n  " + dim("No working MongoDB credentials — setup stops here."));
+      console.log(dim("  To start over: `gu clear`, then `gu` again.\n"));
+      state = recordStep(state, "mongo", "interrupted", {
+        reason: "declined at the MongoDB credentials check",
+      });
+      await saveState(state);
+      return { complete: false, stoppedAt: "mongo" };
+    }
+    mongoUri = credsChoice.uri;
+    if (credsChoice.custom) {
+      state = { ...state, localMongoUri: mongoUri };
+    }
+  }
   state = recordStep(state, "mongo", "done");
   await saveState(state);
 
@@ -687,6 +793,7 @@ export async function runClientExpertSetup({ ask }) {
   try {
     creds = await seedDatabase({
       apiDir,
+      mongoUri,
       userId: state.localUserId,
       workerKey: state.localWorkerKey,
     });
@@ -713,7 +820,7 @@ export async function runClientExpertSetup({ ask }) {
   let health = await probeLocalApi(LOCAL_API_PORT);
   if (!health.ok) {
     console.log("\n  " + bold(`Starting the local API on port ${LOCAL_API_PORT}`));
-    await startLocalApi({ apiDir });
+    await startLocalApi({ apiDir, mongoUri });
     health = await waitForApi({ port: LOCAL_API_PORT });
   }
   if (!health.ok) {

package/client-expert-setup.mjs

@@ -652,3 +652,207 @@ export function resolveFirstRunMode({ licenseToken, expertAvailable } = {}) {
   if (expertAvailable) return { ask: false, mode: "client-expert" };
   return { ask: false, mode: "client" };
 }
+
+/**
+ * DOES THIS EVEN LOOK LIKE A GU LICENSE TOKEN? — the cheap, first-step check (task #13).
+ *
+ * Runs BEFORE any key or network work: a token that fails this is not worth verifying, so the
+ * caller can warn and re-ask immediately. Pure, synchronous, never throws.
+ *
+ *   ok:true            — trimmed, three parts, `gu1` prefix, and the payload is base64url that
+ *                        parses as a JSON object. Says nothing about the signature or the account.
+ *   ok:false, why      — "empty" | "shape" (not three parts / wrong prefix) | "payload" (the
+ *                        middle part is not decodable JSON). Callers print `why` in the warning.
+ *
+ * This is deliberately NOT verifyCliToken: that needs the public key and proves the signature;
+ * this only answers "is it plausible enough to bother with". validateLicenseToken still runs the
+ * full check — this just lets the UI fail fast and re-prompt.
+ */
+export function licenseTokenFormat(token) {
+  const t = String(token ?? "").trim();
+  if (!t) return { ok: false, why: "empty" };
+  const parts = t.split(".");
+  if (parts.length !== 3 || parts[0] !== "gu1" || !parts[1] || !parts[2]) return { ok: false, why: "shape" };
+  try {
+    const json = Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const payload = JSON.parse(json);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { ok: false, why: "payload" };
+  } catch {
+    return { ok: false, why: "payload" };
+  }
+  return { ok: true, why: "ok" };
+}
+
+// ---------------------------------------------------------------------------
+// IS THE PRO TOKEN REAL? — checked, not just present (task #12).
+//
+// `--license` used to gate the menu on PRESENCE alone: any non-empty string was "pro". Now a
+// token has to prove itself twice before the menu opens:
+//
+//   1. OFFLINE — the Ed25519 signature is verified against the same public key cli-token.mjs
+//      uses. Garbage (`--license foo`) never leaves the machine.
+//   2. LIVE    — the token is offered to the hosted API's /api/billing/cli-token/renew, the
+//      one call that re-reads the subscription on every request. A token the API will not
+//      renew (forged, or for an account that no longer exists) is refused.
+//
+// The token is still NOT stored here — proving it is all this run needs; if the user picks a
+// mode that needs the token again, that path asks/pastes it as before.
+// ---------------------------------------------------------------------------
+
+/**
+ * One validation attempt. Returns { ok, reason, detail? } — never throws.
+ *
+ *   ok:true           — signature verified offline AND the hosted API accepted the token.
+ *   ok:false, reason: "malformed" | "bad-signature" — failed the offline check (detail = why).
+ *   ok:false, reason: "rejected"  — the API refused it (detail = http-<status>).
+ *   ok:false, reason: "unverified"— offline check passed but the API could not be reached
+ *                                    (detail = timeout | network | no-api | http-5xx | bad-response).
+ *
+ * `hostedBase` falls back to device-login.mjs DEFAULT_API_BASE when not given; GU_TOKEN_API_BASE
+ * (the env the renew loop already honours) wins over both, so staging checks the staging API.
+ */
+export async function validateLicenseToken(token, {
+  hostedBase,
+  fetchImpl = fetch,
+  timeoutMs = 8000,
+  env = process.env,
+} = {}) {
+  const t = String(token ?? "").trim();
+  if (!t) return { ok: false, reason: "malformed", detail: "empty" };
+  // Format first (task #13): a token that isn't even shaped right never reaches the key check,
+  // let alone the network. licenseTokenFormat is the same rule, applied cheap.
+  if (!licenseTokenFormat(t).ok) return { ok: false, reason: "malformed", detail: "format" };
+  const { verifyCliToken, publicKey } = await import("./cli-token.mjs");
+  const offline = verifyCliToken(t, publicKey(env));
+  if (!offline.ok) return { ok: false, reason: offline.why === "malformed" ? "malformed" : "bad-signature", detail: offline.why };
+  let base = String(hostedBase ?? "").trim() || String(env.GU_TOKEN_API_BASE ?? "").trim();
+  if (!base) {
+    try {
+      ({ DEFAULT_API_BASE: base } = await import("./device-login.mjs"));
+    } catch {
+      return { ok: false, reason: "unverified", detail: "no-api" };
+    }
+  }
+  base = base.replace(/\/+$/, "");
+  try {
+    const res = await fetchImpl(`${base}/api/billing/cli-token/renew`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${t}` },
+      body: "{}",
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (res.status === 401 || res.status === 403) return { ok: false, reason: "rejected", detail: `http-${res.status}` };
+    if (!res.ok) return { ok: false, reason: "unverified", detail: `http-${res.status}` };
+    const data = await res.json().catch(() => null);
+    return typeof data?.token === "string" && data.token
+      ? { ok: true }
+      : { ok: false, reason: "unverified", detail: "bad-response" };
+  } catch (e) {
+    return { ok: false, reason: "unverified", detail: e?.name === "TimeoutError" ? "timeout" : "network" };
+  }
+}
+
+/**
+ * What a validation result DOES to the first-run plan — pure, so the policy is a test row:
+ *
+ *   · valid      → the menu, exactly as promised.
+ *   · rejected / bad token → the private default (or cloud): the token was ASKED for and
+ *                            refused, so the caller must SAY it was refused (rejected:true).
+ *   · unverified → the menu stands: the token proved its signature offline and the soft-licence
+ *                  rule (a network outage never blocks a paid user) applies to the menu too.
+ *                  Callers may show a one-line "couldn't confirm" note.
+ */
+export function validateLicenseVerdict({ licenseToken, expertAvailable }, result) {
+  const fallback = resolveFirstRunMode({ licenseToken: "", expertAvailable });
+  if (result?.ok) return { ask: true, mode: null, rejected: false, unverified: false };
+  if (result?.reason === "unverified") return { ask: true, mode: null, rejected: false, unverified: true };
+  return { ...fallback, rejected: Boolean(String(licenseToken ?? "").trim()), unverified: false };
+}
+
+/**
+ * ASK UNTIL THE TOKEN IS REAL, OR THE USER GIVES UP (task #13).
+ *
+ * The one-shot validate-and-fall-back made an invalid token silently pick private mode for the
+ * user. Instead: warn, and let them paste another token. The loop ends three ways:
+ *
+ *   · a token validates (or is unverifiable — soft licence) → { token, result } with ok/!rejected;
+ *   · empty Enter on the re-ask → the user declines: { token: "", result: null } → the caller
+ *     falls back to the private default, exactly as a bare `gu` would;
+ *   · the very first token is already good → returned immediately, no extra prompt.
+ *
+ * `ask` is the one-question readline helper (gu-repl's ask0/ask). `warn` prints the one-line
+ * "that token wasn't accepted" message; injectable so tests stay silent. `validate` is
+ * validateLicenseToken by default; injectable for tests. Never throws — a validation that errors
+ * is treated as unverifiable, not a crash.
+ */
+export async function promptForLicenseToken(ask, initialToken, {
+  validate = validateLicenseToken,
+  validateOpts = {},
+  warn = (msg) => console.log(msg),
+  maxTries = 5,
+} = {}) {
+  let token = String(initialToken ?? "").trim();
+  for (let attempt = 0; attempt < maxTries; attempt += 1) {
+    // Format gate first — a malformed token is warned about WITHOUT a network round-trip.
+    const fmt = licenseTokenFormat(token);
+    if (token && !fmt.ok) {
+      warn(`  That doesn't look like a gu license token (${fmt.why}). Check you pasted the whole thing.`);
+    } else if (token) {
+      const result = await validate(token, validateOpts).catch(() => ({ ok: false, reason: "unverified", detail: "error" }));
+      if (result.ok || result.reason === "unverified") return { token, result, declined: false };
+      warn(`  That license token was not accepted (${result.detail ?? result.reason}).`);
+    }
+    const again = String(await ask("  Paste a pro license token to choose a hosted mode, or press Enter to keep this machine private: ") ?? "").trim();
+    if (!again) return { token: "", result: null, declined: true };
+    token = again;
+  }
+  return { token: "", result: null, declined: true };
+}
+
+/* ------------------------- MongoDB credentials (task #15) ------------------------------ */
+
+/**
+ * Build a mongodb:// URI from parts, with the credentials URL-encoded.
+ *
+ * Encoding is not decoration: a password of `p@ss/word#1` pasted verbatim into a URI breaks
+ * the parse in three different ways, and the failure surfaces two steps later as "MongoDB
+ * answered a moment ago, so this is usually a permissions problem" — a message that sends the
+ * user debugging the wrong thing entirely.
+ */
+export function buildMongoUri({ username = "", password = "", host = "127.0.0.1", port = 27017 } = {}) {
+  const user = String(username ?? "").trim();
+  if (!user) return `mongodb://${host}:${port}`;
+  const pass = String(password ?? "");
+  return `mongodb://${encodeURIComponent(user)}:${encodeURIComponent(pass)}@${host}:${port}`;
+}
+
+/** The one-liner any mongo shell answers, credentialed or not. */
+export function mongoShellPingCommand(uri) {
+  return ["--quiet", String(uri), "--eval", "db.runCommand({ping:1}).ok"];
+}
+
+/**
+ * What a mongo shell's ping output means for CREDENTIALS (task #15).
+ *
+ * → { ok } true when the ping answered, false when it definitely did not,
+ *   { ok: null, unverifiable: true } when no shell exists on this machine to ask.
+ *
+ * A socket can prove a port answers; only something that speaks the wire protocol can prove a
+ * username/password pair is ACCEPTED — which is the whole question when the MongoDB on 27017
+ * is not one we installed. The shells are what is available before the API package (and its
+ * mongodb driver) is downloaded, so their absence means "cannot check", not "check failed" —
+ * and those two get different messages because they need different fixes.
+ */
+export function mongoAuthVerdict({ output } = {}) {
+  const out = String(output ?? "");
+  if (out.trim().endsWith("1")) return { ok: true, why: "" };
+  const looksLikeAuth =
+    /auth|AuthenticationFailed|SCRAM|not authorized|requires authentication/i.test(out);
+  return {
+    ok: false,
+    why: looksLikeAuth
+      ? "the database rejected those credentials"
+      : "it answered, but the ping did not succeed",
+  };
+}
+

package/gu-repl.mjs

@@ -667,7 +667,7 @@ if (!workerKey || !apiBase) {
         const {
           probeMachine, askMode, runClientExpertSetup, loadState, saveState,
         } = await import("./client-expert-run.mjs");
-        const { clientExpertAvailable, parseLicenseFlag, resolveFirstRunMode } =
+        const { clientExpertAvailable, parseLicenseFlag, resolveFirstRunMode, promptForLicenseToken } =
           await import("./client-expert-setup.mjs");
         const machine0 = await probeMachine();
         const gate0 = clientExpertAvailable({ workerEnvExists: false, ...machine0 });
@@ -676,10 +676,28 @@ if (!workerKey || !apiBase) {
         // nothing shared) and walks the MongoDB/API/models setup straight away. The
         // three-way menu (hosted client / MLX host / private) is shown only when the run
         // carries a pro license token: `gu --license <token>`.
-        const plan0 = resolveFirstRunMode({
-          licenseToken: parseLicenseFlag(argv),
+        const licenseToken0 = parseLicenseFlag(argv);
+        let plan0 = resolveFirstRunMode({
+          licenseToken: licenseToken0,
           expertAvailable: gate0.available,
         });
+        if (plan0.ask) {
+          // A bad token no longer picks private FOR the user: warn, and let them paste another
+          // (task #13). Format is checked first (no network), then offline signature, then the
+          // live API. Empty Enter declines → the private default. Unreachable API still opens
+          // the menu (soft licence: an outage never blocks a paid user).
+          const pick = await promptForLicenseToken(ask0, licenseToken0, {
+            validateOpts: {
+              hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
+            },
+            warn: (m) => console.log(dim(`\n${m}`)),
+          });
+          if (pick.declined || !pick.token) {
+            plan0 = resolveFirstRunMode({ licenseToken: "", expertAvailable: gate0.available });
+          } else if (pick.result && pick.result.reason === "unverified") {
+            console.log(dim("\n  Couldn't reach the license server to confirm the token — showing the menu anyway."));
+          }
+        }
         let mode0;
         if (plan0.ask) {
           mode0 = await askMode(ask0, {
@@ -1481,6 +1499,24 @@ const imageStore = createImageStore();
 // Shown on the bottom row after a refused or failed image paste; clears itself.
 let imageNotice = "";
 let imageNoticeTimer = null;
+
+// Task #14: SETUP THE USER SKIPPED. In private / Client Expert mode the Agent + embedding
+// server prompts can now be declined ("No" / empty Enter). That is a real answer, not a
+// failure — but the machine then has no agent model and/or no embed model, and the agent
+// silently falls back (agent → coding model) or loses RAG. Say so at the BOTTOM of the screen,
+// every frame, until a model is chosen. The two warnings are INDEPENDENT: each shows only while
+// its own model is unset, and choosing that model (/agent-model, /embed-model, /setup, or the
+// API seeding one) clears only that one.
+let agentMissing = false; // no agent model chosen → agent falls back to the coding model
+let embedMissing = false; // no embed model chosen → RAG is off until /embed-model picks one
+// One footer row; the two halves are independent so a model that IS set is never named.
+const missingNoticeText = () => {
+  const parts = [];
+  if (agentMissing) parts.push("agent model is not set — using the coding model (/agent-model to choose one)");
+  if (embedMissing) parts.push("no embed model — RAG is off; choose one with /embed-model");
+  return parts.length ? "⚠ " + parts.join("  ·  ") : "";
+};
+
 function showImageNotice(text) {
   imageNotice = text;
   if (imageNoticeTimer) clearTimeout(imageNoticeTimer);
@@ -2340,6 +2376,8 @@ const footerRows = () =>
     notice: imageNotice
       ? orange("⚠ " + fitImageNotice(imageNotice, (process.stdout.columns || 80) - visibleLen(GUTTER) - 1))
       : "",
+    // Task #14: the skipped-setup warning — persistent (not a timed notice), red, its own row.
+    missing: missingNoticeText() ? red(missingNoticeText()) : "",
   });
 // True only while the MAIN loop's ">> " prompt is waiting for input. The bar belongs to that
 // prompt, so it must never appear under an ask()/askSecret() question or during a turn.
@@ -5301,6 +5339,13 @@ async function reconfigureOllamaServer() {
     role: "coder",
   });
 
+  // Task #14: skipping is a real answer, not a failure — but the bottom bar must keep saying
+  // what it cost. Declining the AGENT + embed server leaves both roles unset → both warnings.
+  if (!agent && !agentOnProvider) {
+    agentMissing = true; // no agent model chosen → the agent falls back to the coding model
+    embedMissing = true; // the embedder lives on the agent server → RAG is off until /embed-model
+  }
+
   if (!agent && !coder) {
     console.log(dim("  nothing set — models stay as they are.\n"));
     return;
@@ -10749,7 +10794,7 @@ async function main() {
   // machine that had been working for months.
   try {
     const { loadState, saveState, askMode } = await import("./client-expert-run.mjs");
-    const { clientExpertAvailable, expertPlanPending, shouldAskMode, parseLicenseFlag, resolveFirstRunMode } =
+    const { clientExpertAvailable, expertPlanPending, shouldAskMode, parseLicenseFlag, resolveFirstRunMode, promptForLicenseToken } =
       await import("./client-expert-setup.mjs");
     const st = await loadState();
     const { probeMachine } = await import("./client-expert-run.mjs");
@@ -10766,10 +10811,25 @@ async function main() {
       // Same rule as the first run: the mode menu is a pro-license feature — without
       // `--license <token>` this machine defaults to private (Client Expert) when it can
       // run it, instead of being asked.
-      const plan = resolveFirstRunMode({
-        licenseToken: parseLicenseFlag(argv),
+      const licenseToken1 = parseLicenseFlag(argv);
+      let plan = resolveFirstRunMode({
+        licenseToken: licenseToken1,
         expertAvailable: gate.available,
       });
+      if (plan.ask) {
+        // Same as the first run: warn and re-ask on a bad token instead of silently picking
+        // private (task #13); empty Enter declines to the private default.
+        const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+        const pick1 = await promptForLicenseToken(ask, licenseToken1, {
+          validateOpts: {
+            hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
+          },
+          warn: (m) => console.log(dim(`\n${m}`)),
+        });
+        if (pick1.declined || !pick1.token) {
+          plan = resolveFirstRunMode({ licenseToken: "", expertAvailable: gate.available });
+        }
+      }
       const chosen = plan.ask
         ? await askMode(ask, {
             expertAvailable: gate.available,
@@ -10969,6 +11029,13 @@ async function main() {
     // #125) when no /model override is active.
     if (p.codingModelId) defaultCodingModel = p.codingModelId;
     if (p.codingBaseURL) defaultCodingUrl = p.codingBaseURL;
+    // Task #14: seed the bottom warnings from the AUTHORITATIVE payload. `agentMissing` is set
+    // by the API when no agent model is configured (and it fell back to the coding model);
+    // `ragEnabled` false means no embed model was chosen. Boot may have already set these from
+    // the local setup answers — OR them in, never clear a local "missing" on a maybe, because
+    // private mode's local API can itself be unconfigured.
+    if (p.agentMissing === true) agentMissing = true;
+    if (p.ragEnabled !== true) embedMissing = true;
     // A RESTORED PICK MUST STILL EXIST. The stored id names a model on the box this folder was
     // last pointed at — and the box can change (`/model` → change the Ollama server), a model
     // can be removed, or the folder can be opened on another machine entirely. Sending a name
@@ -11676,10 +11743,12 @@ async function main() {
     }
     if (line === "/agent-model") {
       await chooseAgentModel();
+      agentMissing = false; // Task #14: an agent model was just chosen → clear its warning
       continue;
     }
     if (line === "/embed-model") {
       await chooseEmbedModel();
+      embedMissing = false; // Task #14: an embed model was just chosen → clear its warning
       continue;
     }
     if (line === "/server") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.763",
+  "version": "1.0.765",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -58,6 +58,7 @@
     "cli-token.mjs",
     "credential-recovery.mjs",
     "settings-transfer.mjs",
+    "presets-transfer.mjs",
     "device-login.mjs",
     "daemon-control.mjs",
     "log-policy.mjs",

package/presets-transfer.mjs

@@ -0,0 +1,215 @@
+/**
+ * MODEL PRESETS — the files /save-preset writes and /load-presets reads (#6).
+ *
+ * HOW A PRESET DIFFERS FROM A SETTINGS FILE. /save-settings asks nothing: it writes the whole
+ * account, names the keys, and refuses to carry a single secret. /save-preset is the opposite
+ * posture: the user TYPES the preset — a name and the JSON themselves — so whatever they put is
+ * by definition something they chose to store, including a live API key. The validator therefore
+ * REQUIRES what /save-settings forbids: apiUrl, apiKey, agentModel, codingModel and embedModel
+ * are all mandatory, and the file lands 0600 in the same home-folder location.
+ *
+ * WHAT A PRESET APPLIES. Everything but the embedder maps to a coding backend row: one row holds
+ * the URL, the coding model (as defaultModel) and — if the agent model is a different model on
+ * the same server — the agent model as an extra model of that row. The embedder is the global
+ * ragEmbedUrl/ragEmbedModel pair, exactly like a settings file. The apiKey is stored under the
+ * preset's name, bound to that row, and made the row's DEFAULT key so the resolver finds it.
+ *
+ * THE MARKER. A preset file carries "gu": "preset" (not "settings") so /load-settings never
+ * offers it and /load-presets never offers a settings file — two commands, two folders' worth of
+ * files, no cross-picking.
+ */
+
+import { basename, extname, isAbsolute, join, resolve } from "node:path";
+import { ensureV1Root, isCancelWord, MAX_MODELS_PER_SERVER } from "./coding-provider-setup.mjs";
+
+/** The file name used when none is given — in the default folder (the home directory). */
+export const DEFAULT_PRESET_NAME = "gu-preset.json";
+
+/** Bumped only when an older gu could not read a newer preset correctly. */
+export const PRESET_FILE_VERSION = 1;
+
+const clean = (v) => (typeof v === "string" ? v.trim() : "");
+const isHttpUrl = (v) => typeof v === "string" && /^https?:\/\/\S+$/i.test(v.trim());
+
+/** A preset name is a file name: no path separators, no dots that hide it, one word of space. */
+export function isPresetName(name) {
+  const n = clean(name);
+  return Boolean(n) && n.length <= 60 && !/[\/]/.test(n) && !/^\.+$/.test(n) && !isCancelWord(n);
+}
+
+/**
+ * What was typed → the file to use. Same rules as settingsFilePath: the DEFAULT FOLDER is the
+ * home directory, so a bare NAME is all anyone has to type ("work" → ~/work.json); a real path
+ * still works as one. Returns "" for a cancel word, which the caller treats as a cancel.
+ */
+export function presetFilePath(typed, home) {
+  const t = clean(typed).replace(/^['"]|['"]$/g, "").trim();
+  if (!t) return join(home, DEFAULT_PRESET_NAME);
+  if (isCancelWord(t)) return "";
+  if (t === "~") return join(home, DEFAULT_PRESET_NAME);
+  if (t.startsWith("~/")) return withJson(join(home, t.slice(2)));
+  if (isAbsolute(t) || t.startsWith("./") || t.startsWith("../") || /[\/]/.test(t)) return resolve(t);
+  return withJson(join(home, t));
+}
+
+const withJson = (p) => (extname(basename(p)) ? p : `${p}.json`);
+
+/**
+ * The preset files in the default folder, newest first — what /load-presets offers. Only files
+ * that ARE preset files (the "gu": "preset" marker). `entries` = [{ name, text, mtimeMs }], and
+ * each name is returned as just the preset name (the .json comes off — it is the name the user
+ * typed when saving).
+ */
+export function presetFilesIn(entries) {
+  return (Array.isArray(entries) ? entries : [])
+    .filter((e) => e && /\.json$/i.test(e.name) && /"gu"\s*:\s*"preset"/.test(String(e.text ?? "")))
+    .sort((a, b) => (b.mtimeMs ?? 0) - (a.mtimeMs ?? 0))
+    .map((e) => e.name.replace(/\.json$/i, ""));
+}
+
+/**
+ * Parse + validate the JSON the user typed after /save-preset <name>. EVERY field is required —
+ * a preset that holds only some of the setup is a trap: loading it half-configures a machine and
+ * the half that is missing is the half nobody notices until a turn fails.
+ *
+ *   { "apiUrl": "https://api.openai.com/v1",
+ *     "apiKey": "sk-…",
+ *     "agentModel": "gpt-5",
+ *     "codingModel": "gpt-5",
+ *     "embedModel": "nomic-embed-text",
+ *     "embedUrl": "https://ollama.com" }        ← embedUrl optional; defaults to apiUrl
+ *
+ * ONE PROBLEM, NAMED — the first real problem refuses the whole preset, before anything is
+ * written. Returns { ok: true, preset } or { ok: false, problem }.
+ */
+export function validatePreset(text) {
+  let doc;
+  try {
+    doc = JSON.parse(String(text));
+  } catch {
+    return { ok: false, problem: "that is not JSON — paste one object: { apiUrl, apiKey, agentModel, codingModel, embedModel }." };
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    return { ok: false, problem: "a preset is one JSON object: { apiUrl, apiKey, agentModel, codingModel, embedModel }." };
+  }
+  if (!isHttpUrl(doc.apiUrl)) {
+    return { ok: false, problem: `apiUrl must be an http(s) URL — got ${JSON.stringify(doc.apiUrl)}.` };
+  }
+  if (!clean(doc.apiKey)) {
+    return { ok: false, problem: "apiKey is required — a preset saves the key so loading needs nothing else." };
+  }
+  for (const f of ["agentModel", "codingModel", "embedModel"]) {
+    if (!clean(doc[f])) return { ok: false, problem: `${f} is required and must be a model name — got ${JSON.stringify(doc[f])}.` };
+  }
+  if (doc.embedUrl !== undefined && doc.embedUrl !== "" && !isHttpUrl(doc.embedUrl)) {
+    return { ok: false, problem: `embedUrl must be an http(s) URL — got ${JSON.stringify(doc.embedUrl)}.` };
+  }
+  const apiUrl = ensureV1Root(clean(doc.apiUrl));
+  return {
+    ok: true,
+    preset: {
+      apiUrl,
+      apiKey: clean(doc.apiKey),
+      agentModel: clean(doc.agentModel),
+      codingModel: clean(doc.codingModel),
+      embedModel: clean(doc.embedModel),
+      embedUrl: doc.embedUrl ? ensureV1Root(clean(doc.embedUrl)) : apiUrl,
+    },
+  };
+}
+
+/** The object /save-preset writes. The name travels INSIDE the file so a renamed file still says what it was. */
+export function buildPreset({ name, preset, now = new Date(), host = "" } = {}) {
+  return {
+    gu: "preset",
+    version: PRESET_FILE_VERSION,
+    note: "A named model preset: server, key and the agent / coding / embedding models. This file CONTAINS a live API key.",
+    name: clean(name),
+    savedAt: new Date(now).toISOString(),
+    ...(host ? { savedOn: host } : {}),
+    apiUrl: preset.apiUrl,
+    apiKey: preset.apiKey,
+    agentModel: preset.agentModel,
+    codingModel: preset.codingModel,
+    embedModel: preset.embedModel,
+    embedUrl: preset.embedUrl,
+  };
+}
+
+/**
+ * Read a preset FILE back. Strict like validatePreset, plus the markers so a settings file or a
+ * random JSON is refused with a sentence instead of applied as a preset.
+ */
+export function validatePresetFile(text) {
+  let doc;
+  try {
+    doc = JSON.parse(String(text));
+  } catch {
+    return { ok: false, problem: "that file is not JSON — is it a file /save-preset wrote?" };
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc) || doc.gu !== "preset") {
+    return { ok: false, problem: 'that file is not a gu preset file (no "gu": "preset" marker).' };
+  }
+  if (doc.version !== PRESET_FILE_VERSION) {
+    return {
+      ok: false,
+      problem: `that preset is version ${JSON.stringify(doc.version)}; this gu writes and reads version ${PRESET_FILE_VERSION}. Update gu, or save it again.`,
+    };
+  }
+  const back = validatePreset(JSON.stringify(doc));
+  if (!back.ok) return back;
+  return { ok: true, name: clean(doc.name), preset: back.preset, savedAt: clean(doc.savedAt), savedOn: clean(doc.savedOn) };
+}
+
+/**
+ * The POST body for /api/worker/settings that applies a preset. One coding backend row carries
+ * the server and BOTH models: the coding model as the default, the agent model as a second
+ * model of the same row when they differ — one server is one row, the rule every picker and the
+ * API itself already enforce. A row this account already has for that server KEEPS ITS ROW ID
+ * (the settings-transfer reason: a key whose row is re-minted is stranded forever). The embedder
+ * is the global pair, cleared of any account-wide key pick so the row's keys resolve it.
+ */
+export function presetToSettingsPatch(preset, current = {}) {
+  const existing = Array.isArray(current.agentCodingBackends) ? current.agentCodingBackends : [];
+  const sameServer = (a, b) =>
+    Boolean(clean(a) && clean(b)) && ensureV1Root(clean(a)).toLowerCase() === ensureV1Root(clean(b)).toLowerCase();
+  const mine = existing.find((r) => r?.id && sameServer(r.url, preset.apiUrl));
+  const models = [...new Set([preset.agentModel, preset.codingModel])].filter((m) => m !== preset.codingModel);
+  const row = {
+    ...(mine?.id ? { id: mine.id } : {}),
+    kind: mine?.kind ?? "openai",
+    url: preset.apiUrl,
+    defaultModel: preset.codingModel,
+    models: models.slice(0, MAX_MODELS_PER_SERVER),
+    enabled: true,
+  };
+  return {
+    patch: {
+      agentCodingBackends: [row],
+      agentModelUrl: preset.apiUrl,
+      agentModelName: preset.agentModel,
+      ragEmbedUrl: preset.embedUrl,
+      ragEmbedModel: preset.embedModel,
+      ragEmbedKeyId: "",
+    },
+    existingRowId: mine?.id ?? "",
+  };
+}
+
+/** The lines /load-presets prints before it asks — what applying the preset will do. */
+export function presetPlanLines(name, preset, current = {}) {
+  const same = (a, b) => clean(a).toLowerCase() === clean(b).toLowerCase();
+  const lines = [];
+  lines.push(`preset "${name}":`);
+  lines.push(`  server:        ${preset.apiUrl}`);
+  lines.push(`  coding model:  ${preset.codingModel}`);
+  lines.push(`  agent model:   ${preset.agentModel}`);
+  const embedSame = same(preset.embedUrl, current.ragEmbedUrl) && same(preset.embedModel, current.ragEmbedModel);
+  lines.push(`  embedding:     ${preset.embedModel} at ${preset.embedUrl}${embedSame ? "  (already set)" : ""}`);
+  if (!embedSame && preset.embedModel !== clean(current.ragEmbedModel) && clean(current.ragEmbedModel)) {
+    lines.push("  a different embedder: every knowledge base rebuilds on its next search.");
+  }
+  lines.push(`  api key:       saved as "${clean(name)}", made the server's default`);
+  lines.push("  replaces the coding provider list with this one server.");
+  return lines;
+}

package/terminal-layout.mjs

@@ -476,6 +476,7 @@ export function buildFooterRows({
   token = "",
   mode = "",
   notice = "",
+  missing = "",
 }) {
   const w = Math.max(20, width || 80);
   return [
@@ -488,6 +489,10 @@ export function buildFooterRows({
     // used to be appended to that row and was clipped at the right edge ("…pick one with /mo").
     // Present only while it shows; paintBar re-cuts the frozen zone when the count changes.
     ...(notice ? [clipVisible(gutter + notice, w - 1)] : []),
+    // Task #14: a skipped model setup stays VISIBLE. When private/client-expert setup was
+    // declined the agent model and/or the embed model is unset — say so at the bottom, every
+    // frame, until one is chosen. Its own row, under the passing notice, so it persists.
+    ...(missing ? [clipVisible(gutter + missing, w - 1)] : []),
   ];
 }