@tiens.nguyen/gu-cli 1.0.791 → 1.0.793

package/platform-tools.mjs

@@ -298,23 +298,68 @@ export function windowsLauncherScript({ cmd, args = [], cwd, env = {}, logFile }
   return lines.join("\r\n") + "\r\n";
 }
 
+/**
+ * WHAT THE TASK RUNS — the launcher script, with NO WINDOW (task #334).
+ *
+ * The task used to run the .cmd itself. A task runs in the user's desktop session, so cmd.exe got
+ * a console window there, and `start /b` keeps node attached to that console: the window stayed
+ * for as long as the API or the worker lived. One per launch — the API, the worker, a worker
+ * restart, an API restart — "3-4 command windows" on a Windows 11 desktop after a first install,
+ * each of which kills its process when closed. Measured on the box: two visible windows titled
+ * C:\WINDOWS\SYSTEM32\cmd.exe, owned by the two node processes.
+ *
+ * `conhost.exe --headless` is Windows' own way to give a console program a console with no
+ * window (Windows 10 1809 and later). Not wscript/VBScript — it is being removed from Windows —
+ * and not `powershell -WindowStyle Hidden`, which flashes a window before hiding it.
+ *
+ * THE QUOTES ARE THE OTHER FIX. The bare script path was split by schtasks at the first space,
+ * so from a home like C:\Users\Jo Smith nothing started at all (measured: no log, no process).
+ */
+export function hiddenTaskAction(scriptPath, systemRoot) {
+  const root = String(systemRoot || "C:\\Windows").replace(/[\\/]+$/, "");
+  return `"${root}\\System32\\conhost.exe" --headless cmd.exe /c "${scriptPath}"`;
+}
+
 /**
  * Register → run → deregister. The task is a LAUNCH MECHANISM, not a persistent registration:
  * it exists only to start the process outside our job, and is removed immediately afterwards
  * so nothing is left scheduled on the user's machine. The started process keeps running —
  * deleting a task does not kill what it launched (verified).
  */
-export function schtasksCommands(taskName, scriptPath) {
+export function schtasksCommands(taskName, scriptPath, { elevated = false, systemRoot = process.env.SystemRoot } = {}) {
   return {
     create: {
       cmd: "schtasks.exe",
-      args: ["/create", "/tn", taskName, "/tr", scriptPath, "/sc", "once", "/st", "00:00", "/f"],
+      // `/rl highest` ONLY from an elevated terminal — see isElevatedGroups. From an ordinary one
+      // it is refused for an administrator ("Access is denied") and the task is never created.
+      args: [
+        "/create", "/tn", taskName, "/tr", hiddenTaskAction(scriptPath, systemRoot), "/sc", "once", "/st", "00:00",
+        ...(elevated ? ["/rl", "highest"] : []),
+        "/f",
+      ],
     },
     run: { cmd: "schtasks.exe", args: ["/run", "/tn", taskName] },
     remove: { cmd: "schtasks.exe", args: ["/delete", "/tn", taskName, "/f"] },
   };
 }
 
+/**
+ * IS THIS TERMINAL ELEVATED? — from `whoami /groups` (task #333).
+ *
+ * A scheduled task runs with the user's ORDINARY token unless it is created `/rl highest`, even
+ * when the terminal that created it is elevated — and an SSH session of an administrator always
+ * is. So the background process had FEWER rights than the `gu` that started it. On the Windows
+ * 11 test box node.exe belongs to another user's nvm and only Administrators may run it: `gu`
+ * ran, the API it launched got "Access is denied.", and setup stopped at "not up yet".
+ * A background process should have the rights of the terminal that started it — as it does on
+ * macOS and Linux, where it is simply a child.
+ *
+ * S-1-16-12288 is the High Mandatory Level label (S-1-16-16384 = System). Pure, so it is testable.
+ */
+export function isElevatedGroups(whoamiGroups) {
+  return /S-1-16-(12288|16384)\b/.test(String(whoamiGroups ?? ""));
+}
+
 /**
  * Which pid owns a listening port, from `netstat -ano`.
  *
@@ -382,7 +427,8 @@ export async function spawnSurviving({ cmd, args = [], cwd, env = {}, logFile, t
     "utf8"
   );
 
-  const t = schtasksCommands(taskName, script);
+  const elevated = isElevatedGroups(await run("whoami.exe", ["/groups"]));
+  const t = schtasksCommands(taskName, script, { elevated });
   const created = await run(t.create.cmd, t.create.args);
   if (created === null) {
     // No scheduler (or no rights): fall back to a plain detached spawn. It dies with an SSH

package/preset-apply.mjs

@@ -18,7 +18,7 @@
  */
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { buildFullPreset, keysToApply } from "./presets-transfer.mjs";
+import { buildFullPreset, keysToApply, keyHiddenInName, shownKeyName } from "./presets-transfer.mjs";
 import { planLoad, toSettingsPatch } from "./settings-transfer.mjs";
 import { existingBackendRows, providerRowForUrl } from "./coding-provider-setup.mjs";
 
@@ -86,7 +86,7 @@ export async function applyTransfer(value, { api, io, fromLine = "", carriesSecr
     : plan.lines;
   for (const l of lines) say(l);
   if (summary && plan.replaces) say(`replaces the ${plan.replaces} coding provider${plan.replaces === 1 ? "" : "s"} on this account.`);
-  for (const w of warnings) say("⚠ " + w, "warn");
+  for (const w of new Set(warnings)) say("⚠ " + w, "warn");
   if (carriesSecrets) say("this file contains API keys in plain text — delete it when you are done.", "warn");
   const go = String((await io.ask("apply this? [y/N] ")) ?? "").trim().toLowerCase();
   if (go !== "y" && go !== "yes") {
@@ -116,22 +116,32 @@ export async function applyTransfer(value, { api, io, fromLine = "", carriesSecr
   const rows = existingBackendRows(fresh);
   const { add, kept } = keysToApply(value, { currentKeys: keys, rows, missing: plan.missingKeys });
   for (const k of kept) {
-    say(`kept your existing key ${k.name} for ${k.backendUrl} (the preset's copy was not used).`);
+    say(`kept your existing key ${shownKeyName(k)} for ${k.backendUrl} (the preset's copy was not used).`);
     if (k.default && k.rowId && k.existingId && !(await api.setDefaultKey(k.rowId, k.existingId))) {
       say(`could not make ${k.name} the default for ${k.backendUrl} — pick it in /model with ctrl+k.`, "err");
     }
   }
-  for (const k of add) {
-    const where = k.backendUrl ? ` for ${k.backendUrl}` : "";
-    const typed = k.key || String((await io.ask(`key "${k.name}"${k.tail ? ` (…${k.tail})` : ""}${where} — paste it, or Enter to skip: `)) ?? "").trim();
+  for (const k0 of add) {
+    const where = k0.backendUrl ? ` for ${k0.backendUrl}` : "";
+    // A NAME THAT IS THE KEY ITSELF (see keyHiddenInName): use it as the value it always was, and
+    // give the key a real name — its server — so the secret stops being printed as a label.
+    const hidden = k0.key ? "" : keyHiddenInName(k0);
+    let hostName = "";
+    try {
+      hostName = new URL(k0.backendUrl).hostname;
+    } catch { /* no server — keep a neutral name */ }
+    const k = hidden ? { ...k0, key: hidden, name: hostName || "key" } : k0;
+    const shown = shownKeyName(k0);
+    if (hidden) say(`the key named ${shown}${where} IS the key — using it, saved as "${k.name}".`);
+    const typed = k.key || String((await io.ask(`key "${shown}"${k.tail ? ` (…${k.tail})` : ""}${where} — paste it, or Enter to skip: `)) ?? "").trim();
     if (!typed) {
-      say(`skipped ${k.name} — add it later with ctrl+k.`);
+      say(`skipped ${shown}${where} — its value is not in the preset; add it later with ctrl+k.`);
       continue;
     }
     const id = await api.addKey(k.name, typed, k.rowId);
     if (!id) {
       out.failed.push(k.name);
-      say(`could not add ${k.name}${where} — add it in /model with ctrl+k.`, "err");
+      say(`could not add ${shown}${where} — add it in /model with ctrl+k.`, "err");
       continue;
     }
     out.added.push(k.name);

package/presets-transfer.mjs

@@ -337,7 +337,12 @@ export function validateFullPreset(doc) {
     }
   }
   const noKey = v.backends.filter((b) => !v.keys.some((k) => k.key && sameServer(k.backendUrl, b.url)));
-  for (const b of noKey) warnings.push(`${b.url} has no key in the preset — it keeps whatever key this machine has for it (or none).`);
+  for (const b of noKey) {
+    const named = v.keys.some((k) => !k.key && sameServer(k.backendUrl, b.url));
+    warnings.push(named
+      ? `${b.url}: the preset names its key but does not carry the value — you will be asked to paste it.`
+      : `${b.url} has no key in the preset — it keeps whatever key this machine has for it (or none).`);
+  }
   // THE DEFAULT CODER must be a server and model the preset itself sets up.
   const cd = doc.codingDefault && typeof doc.codingDefault === "object" ? doc.codingDefault : {};
   if (cd.url !== undefined && cd.url !== "" && !isHttpUrl(cd.url)) {
@@ -404,6 +409,35 @@ const mask = (k) => {
   return v.length <= 8 ? "…" + v.slice(-2) : `${v.startsWith("sk-") ? "sk-" : v.slice(0, 3)}…${v.slice(-4)}`;
 };
 
+/**
+ * IS THIS KEY'S *NAME* ACTUALLY THE KEY? (reported 2026-10-02) → the key, or "".
+ * A key pasted into the NAME question is stored as a name, and from then on it is printed in full
+ * wherever a name is shown ("skipped sk-E8Iv…3E66 — add it later") and travels in every names-only
+ * export — while its value is asked for again. The tail settles it: a name that is key-shaped AND
+ * ends in the recorded last four characters is the key.
+ */
+export function keyHiddenInName(k) {
+  const name = clean(k?.name);
+  const tail = clean(k?.tail);
+  if (name.length < 20 || /\s/.test(name) || keyProblem(name)) return "";
+  if (tail ? !name.endsWith(tail) : !/^(sk|pk|rk|xai|gsk|ghp|hf)[-_]/i.test(name)) return "";
+  return name;
+}
+
+/** A key NAME as it may be shown: a name that is itself a key is masked like one. */
+export function shownKeyName(k) {
+  const name = clean(typeof k === "string" ? k : k?.name);
+  const secret = keyHiddenInName(typeof k === "string" ? { name } : k);
+  return secret ? `${mask(secret)} (a key saved as its own name)` : name;
+}
+
+/** How many of a preset's keys carry a VALUE, and how many are only a name. */
+export function presetKeyCounts(v) {
+  const keys = Array.isArray(v?.keys) ? v.keys : [];
+  const withValue = keys.filter((k) => k.key).length;
+  return { withValue, nameOnly: keys.length - withValue };
+}
+
 /** The whole preset with every key MASKED — what is printed; the file / the copy keep the real keys. */
 export function maskedFullPreset(doc) {
   return { ...doc, keys: (Array.isArray(doc?.keys) ? doc.keys : []).map((k) => ({ ...k, ...(k.key ? { key: mask(k.key) } : {}) })) };
@@ -414,8 +448,15 @@ export function fullPresetSummary(v, codingDefault) {
   const lines = [];
   for (const b of v.backends) {
     const models = [...new Set([b.defaultModel, ...(b.models ?? [])].filter(Boolean))];
-    const key = v.keys.find((k) => k.backendUrl && ensureV1Root(k.backendUrl).toLowerCase() === ensureV1Root(b.url).toLowerCase());
-    lines.push(`  ${b.url}  ${models.join(", ") || "(no models)"}${key?.key ? `  · key ${key.name} ${mask(key.key)}` : "  · no key"}`);
+    const mine = v.keys.filter((k) => k.backendUrl && ensureV1Root(k.backendUrl).toLowerCase() === ensureV1Root(b.url).toLowerCase());
+    const key = mine.find((k) => k.key);
+    // "no key" was printed for a server whose key the preset NAMES but does not carry — the same
+    // words as a server with no key at all, so a names-only preset read as an empty one.
+    const named = mine.filter((k) => !k.key).map((k) => `${shownKeyName(k)}${k.tail && !keyHiddenInName(k) ? ` …${k.tail}` : ""}`);
+    const tell = key?.key
+      ? `  · key ${shownKeyName(key)} ${mask(key.key)}`
+      : named.length ? `  · key NAME only (${named.join(", ")}) — the value is not in this preset` : "  · no key";
+    lines.push(`  ${b.url}  ${models.join(", ") || "(no models)"}${tell}`);
   }
   if (codingDefault?.url || codingDefault?.model) lines.push(`coding model: ${codingDefault.model || "?"} at ${codingDefault.url || "?"}`);
   return lines;

package/settings-transfer.mjs

@@ -344,7 +344,7 @@ export function planLoad(file, current = {}) {
   }
   if (missingKeys.length) {
     lines.push(`${missingKeys.length} API key${missingKeys.length === 1 ? "" : "s"} this account does not have — gu will ask for ${missingKeys.length === 1 ? "it" : "them"} after:`);
-    for (const k of missingKeys) lines.push(`  ${k.name}${k.tail ? ` (…${k.tail})` : ""}${k.backendUrl ? ` for ${k.backendUrl}` : ""}`);
+    for (const k of missingKeys) lines.push(`  ${listedKeyName(k)}${k.tail ? ` (…${k.tail})` : ""}${k.backendUrl ? ` for ${k.backendUrl}` : ""}`);
   }
   // The account default is NOT in the file and is not touched — said out loud, because someone
   // loading "their models" onto a machine reasonably expects the coder to change too.
@@ -352,6 +352,19 @@ export function planLoad(file, current = {}) {
   return { lines, missingKeys, replaces: currentRows.length, adds: file.backends.length };
 }
 
+/**
+ * A key NAME as this list may print it. A key typed into the name question is stored AS the name,
+ * and the full secret was then printed here (reported 2026-10-02). A key-shaped name ending in the
+ * key's recorded tail is masked. (presets-transfer.mjs keyHiddenInName is the same rule, with the
+ * stricter key checks it has; it imports this module, so the rule cannot be shared the other way.)
+ */
+function listedKeyName(k) {
+  const name = String(k?.name ?? "").trim();
+  const tail = String(k?.tail ?? "").trim();
+  if (name.length >= 20 && !/\s/.test(name) && tail && name.endsWith(tail)) return `${name.slice(0, 3)}… (a key saved as its own name)`;
+  return name;
+}
+
 /**
  * The POST body for /api/worker/settings. Only fields a worker key may write.
  *

package/terminal-layout.mjs

@@ -2156,6 +2156,24 @@ export const HIDDEN_COMMANDS = [
                                 // the INPUT total — which does not exist yet as a counter
 ];
 
+/**
+ * NOTHING TO ANSWER WITH (#99): an agent payload with no model server in it at all.
+ *
+ * A missing AGENT model alone is fine — the API puts the coding model in its place (and sets
+ * `agentMissing`). With no coder either, `agentBaseURL` is empty: there is no server to send a
+ * question to. The API (from 1.0.220) refuses such a question in words; this lets the terminal
+ * say the same against an API that still queues a job nothing can read ("✗ Job not found.").
+ */
+export function nothingToAnswerWith(payload) {
+  if (!payload || typeof payload !== "object") return false; // unknown is not "none"
+  return !String(payload.agentBaseURL ?? "").trim();
+}
+
+export const NO_MODEL_LINES = [
+  "No model is set for this account, so there is nothing to answer with.",
+  "Pick a coding model with /model (and an agent model with /agent-model), then ask again.",
+];
+
 /**
  * Does this API base point at a server on THIS machine? (task #154)
  *
@@ -2177,9 +2195,20 @@ export function isLocalApiBase(apiBase) {
  * entire distinction — go unmentioned. Reported live on a fully set-up Ubuntu box that said
  * plain "client".
  */
-export function modeRow({ clientExpert, clientMode }) {
+export function modeRow({ clientExpert, clientMode, modelUrls = [], coderWhere }) {
   if (clientExpert) {
-    return { label: "client expert", detail: "(API + database here · models remote)" };
+    // "models remote" WAS A CONSTANT (task #333): a box running its own Ollama on 127.0.0.1 —
+    // the whole stack on one machine — was told its models were somewhere else. Said only when
+    // EVERY configured model server is this machine; one cloud coder is still "remote".
+    const urls = modelUrls.map((u) => String(u ?? "").trim()).filter(Boolean);
+    // `coderWhere` is the active coder's "host[:port]" label (coding-choice-tags.mjs), which
+    // names this machine as 127.0.0.1. Passed but empty = not known → not claimed to be here.
+    const coderHere = coderWhere === undefined || /^127\.0\.0\.1(:|$)/.test(String(coderWhere));
+    const allHere = urls.length > 0 && urls.every(isLocalApiBase) && coderHere;
+    return {
+      label: "client expert",
+      detail: allHere ? "(API, database and models here)" : "(API + database here · models remote)",
+    };
   }
   if (clientMode) {
     return { label: "client", detail: "(agent runs here · models remote)" };