@tiens.nguyen/gu-cli 1.0.768 → 1.0.770

package/gu-repl.mjs

@@ -25,6 +25,7 @@
  */
 import { readFile, mkdir, writeFile, unlink, rename } from "node:fs/promises";
 import { readStepTokens } from "./step-tokens.mjs";
+import { snapshotInput, restoreInput, replaceStoppedQuestion, stopNoteLines } from "./turn-stop.mjs";
 import { existsSync, statSync, readFileSync, writeFileSync, readdirSync, openSync, readSync, closeSync } from "node:fs";
 import { spawn } from "node:child_process";
 // FIRST, before anything that could itself fail on an old runtime: npm only WARNS about
@@ -96,6 +97,7 @@ import {
   physicalRows,
   inputPhysicalRows,
   buildFooterRows,
+  pasteHint,
   footerDrawSeq,
   footerEraseSeq,
   clearBlockSeq,
@@ -632,6 +634,10 @@ function reloadWorkerEnv() {
 // first-run branch also runs one — without this the same walkthrough printed twice in a single
 // run, MongoDB instructions and all. Reported live on Windows 11.
 let clientExpertRanThisProcess = false;
+// #301: setup chose "Load a saved preset" — main() opens /load-presets before the first prompt.
+// Declared HERE, above the first-run block: that block runs at module top level, before any
+// declaration further down exists.
+let openPresetsAtStart = false;
 
 if (!workerKey || !apiBase) {
   if (process.stdin.isTTY && process.stdout.isTTY) {
@@ -728,7 +734,12 @@ if (!workerKey || !apiBase) {
         await saveState({ ...(await loadState()), chosenMode: mode0 ?? "client" });
         if (mode0 === "client-expert") {
           clientExpertRanThisProcess = true;
-          const setup = await runClientExpertSetup({ ask: ask0 });
+          // #301/#300: Esc-aware and masked readers on the same rl0 — the model questions offer
+          // Esc, and a key or a password must not echo.
+          const { setupPrompts } = await import("./setup-prompts.mjs");
+          const sp = setupPrompts(rl0, { style: accent });
+          const setup = await runClientExpertSetup({ ask: ask0, askStep: sp.askStep, askSecret: sp.askSecret });
+          if (setup.loadPreset) openPresetsAtStart = true;
           // STOP when setup cannot go further.
           //
           // This used to fall through to the hosted sign-in, on the theory that "this machine
@@ -857,6 +868,7 @@ const COMMANDS = [
   // they worked, Tab-completed to nothing, and appeared in no help. Aliases is what the registry
   // already has for exactly this — /quit, /rag-local.
   { name: "/host-mode", desc: "undo client mode — run agent turns on THIS machine again" },
+  { name: "/undo", usage: "/undo [runId]", desc: "put back the files the last stopped turn changed (from its backups) — asks first" },
   { name: "/server", desc: "pick a deployment server (host/user) for this session" },
   { name: "/proxy", usage: "/proxy [show|set|on|off|clear|test]", desc: "route MODEL calls through an HTTP proxy (local calls always go direct)" },
   { name: "/s3", usage: "/s3 [test]", desc: "set up YOUR S3 bucket (RAG index, and the PDFs/downloads gu makes) and check the AWS keys work — without it, files are saved on this computer" },
@@ -1495,6 +1507,14 @@ const stripAnsiEscapes = (s) =>
 const PASTE_MIN_CHARS = 200;
 const PASTE_MIN_LINES = 3;
 const pasteStore = new Map(); // token -> the real text
+// Task #302: the last line as TYPED — placeholders and all — taken before it is expanded for the
+// model, so a turn stopped with Ctrl+C can give the question back for editing.
+let lastSubmittedInput = null;
+// Task #302: set while the input holds a stopped turn's question; the next line sent from it
+// REPLACES that question in history when it was edited. Cleared by "never mind" (Ctrl+C).
+let prefillFor = null;
+// Task #302: the backup run of the last stopped turn — what /undo reverts by default.
+let lastStoppedRun = null;
 // ---------- pasted images (task #284) ----------
 const imageStore = createImageStore();
 // Shown on the bottom row after a refused or failed image paste; clears itself.
@@ -1609,6 +1629,23 @@ const isNetworkError = (e) =>
   /fetch failed|network|ECONN|ETIMEDOUT|EAI_AGAIN|socket hang up|und_err|terminated/i.test(
     String(e?.message ?? e)
   );
+/** Is the API on this machine? Then "unreachable" means the API process, not the network (#302). */
+const apiIsLocal = () => {
+  try {
+    const h = new URL(apiBase).hostname;
+    return h === "localhost" || h === "::1" || h === "[::1]" || h.startsWith("127.");
+  } catch {
+    return false;
+  }
+};
+/** How long a turn waits for the network (GONEXT_OFFLINE_WAIT_S, default 10 min) — the agent's own budget. */
+const offlineWaitMs = () => {
+  const v = Number(process.env.GONEXT_OFFLINE_WAIT_S);
+  return (Number.isFinite(v) && v >= 0 ? v : 600) * 1000;
+};
+// #302 part 3: a turn this terminal lost contact with (the network dropped) — its job may still be
+// running, so "continue" follows it again instead of asking the question a second time.
+let lostTurn = null;
 /**
  * Did OUR OWN deadline fire, rather than the connection failing? → boolean.
  *
@@ -1721,6 +1758,10 @@ rl.on("line", (l) => {
   // user pasted.
   // Images too (task #284): "[Image #1]" goes out as "[Image #1: <file>]" for the agent to
   // attach; the next message numbers its images from #1 again.
+  lastSubmittedInput = snapshotInput(stripAnsiEscapes(submitted), {
+    pastes: pasteStore,
+    images: new Map(imageStore.entries()),
+  });
   const clean = imageStore.expand(expandPasteTokens(stripAnsiEscapes(submitted)));
   imageStore.clear();
   const waiter = _lineWaiters.pop(); // innermost reader first — see _lineWaiters
@@ -2376,6 +2417,9 @@ const footerRows = () =>
     identity: identityLineText(),
     token: tokenLineText(),
     mode: modeLineText(),
+    // How to paste here (issue #67): the platform's text key, plus gu's image key when the coder
+    // can take an image.
+    modeHint: pasteHint({ images: coderTakesImages() }),
     // Its own row (#54), sized to the window so the fix it names is never the part cut off.
     notice: imageNotice
       ? orange("⚠ " + fitImageNotice(imageNotice, (process.stdout.columns || 80) - visibleLen(GUTTER) - 1))
@@ -5231,15 +5275,35 @@ async function reconfigureOllamaServer() {
 
   /** Load a box's models THROUGH THE PROXY (#160) — a bare fetch is what fails on a restricted
    *  network, and it fails as "no models", which is the wrong story entirely. */
-  const load = async (n) => {
+  const load = async (n, key = "") => {
     const res = await withPendingStatus(`loading models from ${n.host}`, () =>
-      proxyFetch(os.tagsUrlFor(n), { signal: AbortSignal.timeout(8000) })
+      proxyFetch(os.tagsUrlFor(n), {
+        signal: AbortSignal.timeout(8000),
+        // #301: the key typed for this server; absent → the request is what it always was.
+        ...(key ? { headers: { Authorization: `Bearer ${key}` } } : {}),
+      })
     );
     // The status is kept: a 404 here means "answered, but not an Ollama" (#43), not "unreachable".
     if (!res.ok) throw Object.assign(new Error(`HTTP ${res.status}`), { httpStatus: res.status });
     return am.parseOllamaTags(await res.json().catch(() => null));
   };
 
+  // #301: the way out, said under every server question (full once, short after), and the keys
+  // typed for servers, by host — saved against their rows once the settings are written.
+  const ui = await import("./model-setup-ui.mjs");
+  const hint = ui.createHinter();
+  const typedKeys = new Map();
+  const askKeyFor = async (host) => {
+    if (typedKeys.has(host)) return typedKeys.get(host); // same server for both roles → asked once
+    console.log(dim(`    ${hint()}`));
+    // askSecret: masked, kept out of history; Esc throws PromptCancelled → /model is cancelled
+    // with nothing changed, which is what "skip all" means here.
+    const k = (await askSecret(`  API key for ${host} (Enter for none): `)).trim();
+    typedKeys.set(host, k);
+    console.log(GUTTER + dim(ui.keyConfirmation(host, k)));
+    return k;
+  };
+
   /** Ask for one server and load it. Returns {normalized, models} or null (declined/failed). */
   const askServer = async (label, dflt, { require = false, short = "server", role = "coder" } = {}) => {
     for (let attempt = 0; attempt < 3; attempt++) {
@@ -5251,13 +5315,15 @@ async function reconfigureOllamaServer() {
       // — normalizeOllamaUrl adds it — and displayUrl round-trips, so what is shown can be fed
       // straight back as the default.
       console.log(dim(`  ${label} — Enter keeps ${os.displayUrl(dflt)}`));
+      console.log(dim(`    ${hint()}`));
       // THE ROW MUST SAY WHICH SERVER IT IS ASKING FOR. It said a bare "server:" — chosen to
       // fit the frozen row, which traded away the one thing the label was for. Two questions
       // in a row, both reading "server:", and the reader cannot tell which one they are
       // answering (reported: "it should say 'Agent + Embedder server' then 'Coding Server',
       // it only says 'server:'"). `short` is the role in the fewest words that still name it.
       const typed = (await ask(`  ${short}: `)).trim();
-      if (/^(no|n|skip|-)$/i.test(typed)) return null;
+      // "s" is the advertised skip (#301); the older words still work.
+      if (ui.readStepAnswer(typed).kind === "skip") return null;
       // EVERY READING OF A BARE HOSTNAME, in order. Typing "ollama2.gomarsic.cc" means
       // https://…:443 behind a proxy, while "192.168.1.40" means http://…:11434 — one guess
       // is right for one of them and produces a timeout that looks like a dead server for the
@@ -5270,15 +5336,33 @@ async function reconfigureOllamaServer() {
       let n = null;
       let models = null;
       let lastErr = null;
-      for (const cand of candidates) {
-        try {
-          models = await load(cand);
-          n = cand;
-          if (candidates.length > 1) console.log(dim(`  using ${os.displayUrl(cand.url)}`));
-          break;
-        } catch (err) {
-          lastErr = err;
+      // #301: a TYPED public address may need a key — asked before listing, so a server that
+      // needs one can list its models. A LAN box is never asked.
+      let key = "";
+      if (ui.shouldAskKey({ typed, host: candidates[0].host })) key = await askKeyFor(candidates[0].host);
+      const tryAll = async () => {
+        for (const cand of candidates) {
+          try {
+            models = await load(cand, key);
+            n = cand;
+            if (candidates.length > 1) console.log(dim(`  using ${os.displayUrl(cand.url)}`));
+            return;
+          } catch (err) {
+            lastErr = err;
+          }
         }
+      };
+      await tryAll();
+      // Refused for want of credentials: ask now, whatever the address looked like, and list again.
+      if (!n && ui.needsKeyAfterStatus(lastErr?.httpStatus) && !key) {
+        console.log(yellow(`  ${candidates[0].host} needs an API key to list its models.`));
+        typedKeys.delete(candidates[0].host);
+        key = await askKeyFor(candidates[0].host);
+        if (key) await tryAll();
+      }
+      if (!n && ui.needsKeyAfterStatus(lastErr?.httpStatus)) {
+        console.log(red(`  ${candidates[0].host} refused the request (HTTP ${lastErr.httpStatus})${key ? " — that key was not accepted" : ""}.`));
+        continue;
       }
       if (!n) {
         if (lastErr?.httpStatus === 404) {
@@ -5305,7 +5389,7 @@ async function reconfigureOllamaServer() {
         const need = os.checkRequired(models);
         if (!need.ok) {
           for (const l of os.describeNotReady(n.host, need.missing)) console.log(yellow(`  ${l}`));
-          console.log(dim("  (or type 'no' to skip — you can set it later with /model)"));
+          console.log(dim("  (or type s to skip — you can set it later with /model)"));
           continue;
         }
         console.log(dim(`  ✓ ${n.host} has the ${os.REQUIRED_AGENT_PREFIX} family and the embedder`));
@@ -5328,10 +5412,10 @@ async function reconfigureOllamaServer() {
   if (agentOnProvider) {
     const host = hostOf(String(settings.agentModelUrl ?? ""));
     console.log(dim(`  The agent model is on ${host} (OpenAI-compatible) — kept as it is; change it with /agent-model.`));
-    console.log(dim("  Enter keeps the current address; type 'no' to skip."));
+    console.log(dim("  Enter keeps the current address."));
   } else {
     console.log(dim("  TWO servers may be used: the agent + embedder on one, the coder on another."));
-    console.log(dim("  Enter keeps the current address; type 'no' to skip a role."));
+    console.log(dim("  Enter keeps the current address."));
     agent = await askServer("Agent + embedding server", curAgent, {
       require: true,
       short: "agent + embed server",
@@ -5476,6 +5560,32 @@ async function reconfigureOllamaServer() {
     console.log(GUTTER + dim("if this machine's local API is old, restart it with `gu api restart`.\n"));
     return;
   }
+  // #301: THE KEYS TYPED FOR THE SERVERS, bound to their rows now that the rows exist (the API
+  // refuses a key for a row it does not have). Before the cloud check below, so a key typed for
+  // the Ollama cloud is not asked for a second time. Reported by host, never by value.
+  {
+    const used = [agent?.normalized?.url, coder?.normalized?.url].filter(Boolean);
+    // By HOSTNAME: the key was asked for urlCandidates' host, which carries no port, while a URL's
+    // .host does — box.example.com:8443 would otherwise never match its own key.
+    const hostnameOf = (u) => { try { return new URL(u).hostname; } catch { return ""; } };
+    const pending = [...typedKeys].filter(([host, k]) => k && used.some((u) => hostnameOf(u) === host));
+    if (pending.length) {
+      const fresh = await withPendingStatus("storing the key", fetchWorkerSettings);
+      const ps = await import("./coding-provider-setup.mjs");
+      for (const [host, k] of pending) {
+        const url = used.find((u) => hostnameOf(u) === host);
+        const found = ps.providerRowForUrl(ps.existingBackendRows(fresh ?? {}), url);
+        if (!found) {
+          console.log(yellow(`  no server row holds ${host} yet — add its key with ctrl+k in /model.`));
+          continue;
+        }
+        const ok = await withPendingStatus("saving the key", () => addCodingKey(host, k, found.id));
+        console.log(ok
+          ? GUTTER + dim(`✓ key stored for ${host} — the server's default key`)
+          : red(`  couldn't store the key for ${host} — add it with ctrl+k.`));
+      }
+    }
+  }
   // THE OLLAMA CLOUD NEEDS ITS OWN KEY. Reported: choosing https://ollama.com here listed its 20 models
   // (that list is public) and saved, without a key — and the next turn failed "REJECTED the coding API
   // key", having borrowed an unrelated sk-… key. Asked for now, bound to the row just saved.
@@ -6567,6 +6677,103 @@ async function runSavePresetCommand(line) {
  * key is saved under the preset's name and made that row's default, and the embedder is set. The
  * user reconfirms before anything changes, like /load-settings.
  */
+/**
+ * After Ctrl+C stopped THIS terminal's turn (task #302): say what it left behind, and give the
+ * question back.
+ *
+ *   · the command it was in the middle of, if any — that one cannot be made safe, only named
+ *   · the files it changed (its backup run's manifest) — kept as they are; /undo offers to put
+ *     them back, because part of the work may be wanted and nothing is reverted by itself
+ *   · the question, exactly as typed (placeholders and all), back in the input — edit it and
+ *     press Enter; Ctrl+C clears it. Never sent by itself.
+ *
+ * What the turn printed stays on screen: it is the record of what it did.
+ */
+async function afterStoppedTurn({ taskLine, submittedInput, turnStartMs, stoppedCommand = "", typed = "" }) {
+  let files = [];
+  try {
+    const ws = await import("./workspace-revert.mjs");
+    const runId = ws.runSince(turnStartMs);
+    if (runId) {
+      const changes = (await ws.readRunChanges(runId)) ?? [];
+      files = changes.filter((c) => c?.action !== "create_dir").map((c) => c.path);
+      if (files.length) lastStoppedRun = runId;
+    }
+  } catch {
+    /* no backups readable — nothing to name */
+  }
+  // A bare "continue" was the typed line: giving THAT back is no help, so only the note.
+  const canRestore = Boolean(submittedInput?.raw) && !isResumeWord(typed);
+  for (const l of stopNoteLines({ files, command: stoppedCommand, restored: canRestore })) {
+    console.log(GUTTER + dim(l));
+  }
+  console.log("");
+  if (!canRestore) return;
+  const text = restoreInput(submittedInput, { pasteStore, imageStore });
+  rl.line = text;
+  rl.cursor = text.length;
+  rl.historyIndex = -1;
+  prefillFor = { task: taskLine };
+  if (barPinned()) paintBar();
+}
+
+/**
+ * /undo — put back what a stopped turn changed (task #302): the last stopped turn's run, or the
+ * run named. Shows exactly what it will do and asks first — a file edited by hand since the turn
+ * would lose those edits, and that is said too.
+ */
+async function runUndoCommand(line) {
+  const ws = await import("./workspace-revert.mjs");
+  const named = line.trim().slice("/undo".length).trim();
+  const runId = named || lastStoppedRun;
+  console.log("");
+  if (!runId) {
+    console.log(GUTTER + dim("nothing to undo — /undo puts back what a turn you stopped with Ctrl+C changed."));
+    console.log(GUTTER + dim(`(older runs: ${ws.BACKUPS_ROOT} — /undo <run>)\n`));
+    return;
+  }
+  const changes = await ws.readRunChanges(runId);
+  if (!changes) {
+    console.log(GUTTER + red(`no backups for run ${runId}.\n`));
+    return;
+  }
+  const steps = ws.planRevert(changes);
+  if (!steps.length) {
+    console.log(GUTTER + dim("that turn changed no files.\n"));
+    return;
+  }
+  let manifestAt = 0;
+  try {
+    manifestAt = statSync(join(ws.BACKUPS_ROOT, runId, "manifest.json")).mtimeMs;
+  } catch {
+    /* unknown — no "edited since" warnings */
+  }
+  const verb = { restore: "restore", delete: "delete ", rmdir: "remove " };
+  for (const st of steps) {
+    let since = "";
+    try {
+      if (manifestAt && st.op !== "rmdir" && statSync(st.path).mtimeMs > manifestAt + 1000) {
+        since = yellow("  (changed since — those edits would be lost)");
+      }
+    } catch {
+      /* gone already */
+    }
+    console.log(GUTTER + `${verb[st.op]} ${st.path}` + since);
+  }
+  if (!(await askYesNo("Put these back?", false))) {
+    console.log(GUTTER + dim("(nothing changed)\n"));
+    return;
+  }
+  const r = await ws.applyRevert(steps);
+  for (const l of r.lines) console.log(GUTTER + dim(l));
+  console.log(
+    GUTTER + (r.failed ? yellow : dim)(
+      `${r.restored} restored, ${r.deleted} removed${r.failed ? `, ${r.failed} failed` : ""} — the backups are kept.`
+    ) + "\n"
+  );
+  if (runId === lastStoppedRun) lastStoppedRun = null;
+}
+
 async function runLoadPresetsCommand(line) {
   const pr = await import("./presets-transfer.mjs");
   const home = homedir();
@@ -9472,24 +9679,29 @@ async function ensureTokenForTurn() {
   return false;
 }
 
-async function runAgentTurn(history, { attachJobId = "" } = {}) {
+async function runAgentTurn(history, { attachJobId = "", ownJob = false } = {}) {
   // #238: when the licence is ENFORCED and this account is not entitled, no turn is sent. Decided at
   // startup (see licenceBlock) — never re-checked here, so a turn cannot die halfway through.
   if (licenceBlock) {
     console.log(GUTTER + orange("Not sent.") + dim(" " + licenceBlock) + "\n");
     return;
   }
-  const attached = Boolean(attachJobId);
+  // TWO THINGS "attaching" used to mean at once (task #302, part 3): the question is NOT sent
+  // again (skipAsk), and the job is SOMEONE ELSE'S (attached — Ctrl+C only stops watching, its
+  // tokens are theirs to count). Re-attaching to this terminal's OWN turn after a lost connection
+  // is the first without the second: Ctrl+C there is a real cancel.
+  const skipAsk = Boolean(attachJobId);
+  const attached = skipAsk && !ownJob;
   // PRIVATE MODE NEEDS THE gu TOKEN (task #246): the local API fetches the agent's instructions
   // from the gu service with it. Asked for HERE, before anything is sent, with the steps — rather
   // than letting the turn fail and leaving the user to decode why.
-  if (!attached && !(await ensureTokenForTurn())) return;
+  if (!skipAsk && !(await ensureTokenForTurn())) return;
   inputVisible = false; // the frozen zone shows an empty prompt for the duration (#141)
   // Something on screen from the FIRST moment (task #140): Enter has just wiped the bar, and
   // the next thing to draw itself is the turn's ticker — which stays silent until the daemon
   // claims the job, seconds away. This names what is actually happening meanwhile.
-  startPendingStatus(attached ? "attaching" : "sending");
-  const res = attached ? null : await fetch(`${apiBase}/api/worker/agent-ask`, {
+  startPendingStatus(skipAsk ? "attaching" : "sending");
+  const res = skipAsk ? null : await fetch(`${apiBase}/api/worker/agent-ask`, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
     // cwd = this terminal's folder → agent puts download/unzip output here (when it's
@@ -9549,7 +9761,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
     }
     throw new Error(data?.error || `agent-ask failed (HTTP ${res.status})`);
   }
-  const jobId = attached ? attachJobId : data?.jobId;
+  const jobId = skipAsk ? attachJobId : data?.jobId;
   if (!jobId) throw new Error("agent-ask returned no jobId.");
 
   // THE CODER WAS DROPPED, AND NOTHING SAID SO (task #222 phase 0). When the picked coding
@@ -9561,7 +9773,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
   // Read off codingKeyMissingKnown, never off `data`: the flag lives under `payload` and this
   // response is a different shape, so reaching for it here would be undefined — falsy — and
   // warn nobody, which is the bug agent-payload-shape.test.mjs exists to catch.
-  if (!attached && codingKeyMissingKnown === true) {
+  if (!skipAsk && codingKeyMissingKnown === true) {
     console.log(
       GUTTER + orange("⚠ no API key for the coding model") +
         dim(" — coding is running on your chat model. ctrl+k to set it.\n")
@@ -9573,7 +9785,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
   // hand-over to the turn's own ticker happens the moment that worker claims it. An ATTACHED
   // job is usually already running, so it says what is true of it instead — the poll below
   // corrects either of them within a second.
-  setPendingStatus(attached ? "attaching — reading its progress" : "queued — waiting for the worker");
+  setPendingStatus(skipAsk ? "attaching — reading its progress" : "queued — waiting for the worker");
   following = true;
   followingAttached = attached;
   typedDuringTurn = false;
@@ -9615,6 +9827,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
   // key lookup failed." — a cold Mongo connection, NOT a bad key) must NOT kill a
   // long-running turn. Tolerate a run of them; only give up after too many in a row.
   let pollFailures = 0;
+  let pollOfflineSince = 0; // #302 part 3: when a remote API stopped answering (0 = reachable)
   const MAX_POLL_FAILURES = 6; // ~6 tries with backoff before conceding the follow
   let jobRunning = false; // only tick "thinking…" once the worker has claimed the job
   // Sticky: the agent RAN, so the coding model was called ("thinking…" was on screen). A
@@ -10455,6 +10668,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
         if (jr.ok) {
           job = parsed;
           pollFailures = 0; // a clean poll resets the tolerance window
+          pollOfflineSince = 0;
         } else if (jr.status >= 400 && jr.status < 500) {
           // Client error (bad/expired key, job genuinely gone) — NOT transient, fail fast.
           throw new Error(parsed?.error || `job poll failed (HTTP ${jr.status})`);
@@ -10470,11 +10684,33 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
         const transient = err?.transient === true || isNetworkError(err);
         if (!transient) throw err;
         pollFailures += 1;
-        if (pollFailures >= MAX_POLL_FAILURES) {
+        // THE NETWORK, NOT THE API (task #302, part 3). A REMOTE API that cannot be reached is
+        // usually this machine being offline — a Wi-Fi drop, a VPN reconnecting — while the turn
+        // itself carries on on its worker. So a network error is waited out for the same budget
+        // the agent gives its own calls, instead of giving up after ~13s. A LOCAL API unreachable
+        // is the API process itself gone (see "Agent killed its own API"), which waiting will not
+        // fix — that keeps the quick give-up.
+        const offlineWait = isNetworkError(err) && !apiIsLocal() ? offlineWaitMs() : 0;
+        if (offlineWait) {
+          if (!pollOfflineSince) pollOfflineSince = Date.now();
+          const waited = Date.now() - pollOfflineSince;
+          if (waited < offlineWait) {
+            setPendingStatus(`reconnecting to the API… (${Math.round(waited / 1000)}s)`);
+            await sleep(Math.min(1000 * pollFailures, 10000)); // backoff, capped at 10s
+            continue;
+          }
+        }
+        if (offlineWait || pollFailures >= MAX_POLL_FAILURES) {
           clearStatus();
-          throw new Error(
-            `lost contact with the API after ${pollFailures} tries (${String(err.message).slice(0, 80)}). ` +
-              "The turn may still be running on the worker — try 'continue'."
+          // The job id travels with the error: the turn may well still be running on its worker,
+          // and "continue" should FOLLOW it again rather than ask the same question twice.
+          throw Object.assign(
+            new Error(
+              `lost contact with the API after ${offlineWait ? `${Math.round(offlineWait / 60000)} min` : `${pollFailures} tries`} ` +
+                `(${String(err.message).slice(0, 80)}). The turn may still be running on the worker — ` +
+                "type continue to follow it again."
+            ),
+            { lostJobId: jobId }
           );
         }
         await sleep(Math.min(700 * pollFailures, 3000)); // linear backoff, capped at 3s
@@ -10705,7 +10941,7 @@ async function runAgentTurn(history, { attachJobId = "" } = {}) {
         // turn (main() drops it from history).
         clearStatus();
         process.stdout.write("\n" + GUTTER + dim("(cancelled — the agent was stopped)") + "\n");
-        return { text: "", shown: false, cancelled: true, started: reachedModel };
+        return { text: "", shown: false, cancelled: true, started: reachedModel, stoppedCommand: runningCmd || "" };
       }
       if (job.jobStatus === "failed") {
         clearStatus();
@@ -10869,8 +11105,18 @@ async function main() {
       // recorded, so once the choice was saved this block was skipped and the plan sat on disk
       // untouched. Picking it up here is what makes the sentence true.
       const { runClientExpertSetup } = await import("./client-expert-run.mjs");
-      const setup = await runClientExpertSetup({ ask });
+      const { SKIP_ALL } = await import("./model-setup-ui.mjs");
+      // #301: keys (and the MongoDB password) through the REPL's own masked prompt; a cancelled
+      // one means "skip the rest", not a crash of the setup.
+      const toSkipAll = (e) => (e instanceof PromptCancelled ? SKIP_ALL : Promise.reject(e));
+      const setup = await runClientExpertSetup({
+        ask,
+        // Esc at a model question throws PromptCancelled here; in setup it means "skip all".
+        askStep: (q) => ask(q).catch(toSkipAll),
+        askSecret: (q) => askSecret(q).catch(toSkipAll),
+      });
       if (setup?.complete) reloadWorkerEnv();
+      if (setup?.loadPreset) openPresetsAtStart = true;
     }
   } catch {
     /* never block the REPL on the mode question — the banner still shows what is configured */
@@ -11548,6 +11794,7 @@ async function main() {
     rl.line = "";
     rl.cursor = 0;
     rl.historyIndex = -1;
+    prefillFor = null; // "never mind" also lets go of a restored question (#302)
     if (_lineQueue.length > 0) _lineQueue.length = 0;
     prunePasteStore("");
     imageStore.clear();
@@ -11621,6 +11868,17 @@ async function main() {
   // rows it pushes up are real output rather than half-drawn setup.
   syncBarPinning();
 
+  // #301: setup's "Load a saved preset" — the picker opens now that the terminal exists. The whole
+  // /load-presets flow (the list, the plan, the confirmation, the key) is that command's own.
+  if (openPresetsAtStart) {
+    openPresetsAtStart = false;
+    try {
+      await runLoadPresetsCommand("/load-presets");
+    } catch (e) {
+      console.log(GUTTER + dim(`(could not open the presets: ${e?.message ?? e} — run /load-presets)`));
+    }
+  }
+
   for (;;) {
     stopPendingStatus(); // nothing from a previous turn may still be animating (task #140)
     // The bar and the input line live in the frozen rows at the bottom of the window (task
@@ -11668,6 +11926,12 @@ async function main() {
     footerActive = false; // a line arrived from the queue (no Enter keypress) → disarm
     if (lineRaw === null) break; // stdin closed
     const line = lineRaw.trim();
+    // #302: what was typed for THIS line (before expansion), and whether it was sent from a
+    // stopped turn's restored question.
+    const submittedInput = lastSubmittedInput;
+    lastSubmittedInput = null;
+    const editedFrom = prefillFor?.task ?? "";
+    prefillFor = null;
     // readline's echo is suppressed while the input line is frozen, so the submitted question
     // is printed here instead — it belongs in the scrollback like every other line. Its marker
     // is the GREY one: the cyan ">>" belongs to the live input line alone.
@@ -11802,6 +12066,10 @@ async function main() {
       await runS3Command(line);
       continue;
     }
+    if (line === "/undo" || line.startsWith("/undo ")) {
+      await runUndoCommand(line);
+      continue;
+    }
     if (line === "/save-preset" || line.startsWith("/save-preset ")) {
       await runSavePresetCommand(line);
       continue;
@@ -12054,6 +12322,10 @@ async function main() {
     // mid-retry still has something to resume next time.
     sessionUnfinishedTask = "";
     const { task: taskLine, resumed, nothingToResume } = resumeTask(line, pendingResume);
+    // #302 part 3: "continue" after a lost connection FOLLOWS the job that may still be running,
+    // rather than sending the question again. Anything else typed lets it go.
+    const reattach = lostTurn && isResumeWord(line) && lostTurn.taskLine === taskLine ? lostTurn : null;
+    lostTurn = null;
     // "continue" with nothing behind it runs NOTHING (task #201). It used to be sent to the
     // model as the literal word, which then got remembered as the unfinished task — so every
     // later "continue" retried "continue". Worse than the loop: with no task the model invents
@@ -12072,6 +12344,9 @@ async function main() {
     // "where were we?" reached the model with no history and it said nothing had been asked.
     // Only the failure NOTICE stays out of history (task #144). A resume, or the same question
     // typed again after a failure, is already the last entry and is not pushed a second time.
+    // #302: the restored question, EDITED and sent — a change of mind, so it takes the stopped
+    // one's place instead of standing beside it (then the block below sees it as pending).
+    if (editedFrom) replaceStoppedQuestion(history, editedFrom, taskLine);
     if (isPendingQuestion(history, taskLine)) {
       delete history[history.length - 1].status; // it is the current task again, not a stopped one
     } else {
@@ -12079,7 +12354,9 @@ async function main() {
     }
     await saveSession(cwd, history, { unfinishedTask: isResumeWord(taskLine) ? "" : taskLine });
     try {
-      const turn = await runAgentTurn(history);
+      const turnStartMs = Date.now();
+      if (reattach) console.log(GUTTER + dim("following the turn that was running when the connection went…\n"));
+      const turn = await runAgentTurn(history, reattach ? { attachJobId: reattach.jobId, ownJob: true } : {});
       // NOT SENT (licence block, or the token prompt declined): runAgentTurn already said so.
       // Nothing began, and "continue" can send it once the cause is fixed (task #247).
       if (!turn) {
@@ -12088,7 +12365,7 @@ async function main() {
         continue;
       }
       const { text: answer, shown, cancelled, started, detached, inputTokens, outputTokens,
-              turnOutputTokens, elapsedMs } = turn;
+              turnOutputTokens, elapsedMs, stoppedCommand } = turn;
       // Detached: the agent keeps running on the worker, so the question is neither answered
       // nor stopped — leave it untagged, and say nothing contradicting "the job keeps running".
       if (detached) continue;
@@ -12185,6 +12462,7 @@ async function main() {
           // Stopped AFTER the model was called = too slow or stuck, never a change of mind: the
           // request still stands (task #247, the user's rule). Before that, nothing had begun.
           await markInterrupted(cwd, history, taskLine, started ? "stopped" : "cancelled");
+          await afterStoppedTurn({ taskLine, submittedInput, turnStartMs, stoppedCommand, typed: line });
         } else {
           await markInterrupted(cwd, history, taskLine, "failed");
           // The turn ended cleanly but empty — no exception to summarize, so say exactly that.
@@ -12197,6 +12475,8 @@ async function main() {
       // turn that just threw auto-fire the next one.
       if (_lineQueue.length > 0) _lineQueue.length = 0;
       await rememberUnfinishedTask(cwd, taskLine); // …and "continue" can retry it (task #150)
+      // #302 part 3: the connection went, not the turn — keep its job so "continue" follows it.
+      lostTurn = err?.lostJobId ? { jobId: err.lostJobId, taskLine } : null;
       printTurnError(err?.message, {
         resumable: true,
         failures: noteTaskFailure(taskLine, classifyTurnFailure(err?.message)),

package/image-paste.mjs

@@ -248,6 +248,16 @@ export function createImageStore() {
       const present = new Set(String(line ?? "").match(TOKEN_RE) ?? []);
       for (const t of [...store.keys()]) if (!present.has(t)) store.delete(t);
     },
+    /** The live entries — snapshotted when a line is sent, so a stopped turn can give it back (#302). */
+    entries() {
+      return [...store];
+    },
+    /** Put one back exactly as it was (#302): same token, and later images number after it. */
+    restore(token, path) {
+      store.set(token, path);
+      const n = Number(/#(\d+)/.exec(String(token))?.[1]);
+      if (Number.isFinite(n) && n > seq) seq = n;
+    },
     /** After a message is sent: the next one numbers its images from #1 again. */
     clear() {
       store.clear();