@tiens.nguyen/gu-cli 1.0.792 → 1.0.794

package/install-path.mjs

@@ -56,11 +56,33 @@ if (isEntryPoint) {
     main();
   } catch (e) {
     // A postinstall that throws uninstalls the package. Report, swallow, succeed.
-    console.log(`gu-cli: PATH setup skipped (${e.message}) — see \`gu-cli doctor\` if \`gu\` is not found.`);
+    console.log(`gu-cli: PATH setup skipped (${e.message}) — run \`gu-cli fix-path\` if \`gu\` is not found.`);
   }
   process.exit(0);
 }
 
+/**
+ * The npm global prefix this package is installed under, from where its own files are — or "".
+ *
+ * For `gu-cli fix-path` (task #333): the same PATH repair as this postinstall, WITHOUT npm
+ * running it. npm 11 already prints "install scripts not yet covered by allowScripts" for this
+ * package on every install; it still runs the script today (checked on 11.19.1), but the day it
+ * stops, a custom-prefix user is back to "gu: command not found" with nothing to run. A global
+ * install lives at <prefix>/lib/node_modules/@tiens.nguyen/gu-cli; anything else (a checkout,
+ * `npm link`, a project's node_modules) is not one, and gets no PATH edit.
+ */
+export function globalPrefixOf(packageDir) {
+  const parts = resolve(String(packageDir ?? "")).split("/");
+  const n = parts.length;
+  if (n < 5 || parts[n - 3] !== "node_modules" || parts[n - 4] !== "lib") return "";
+  if (!parts[n - 2].startsWith("@")) return "";
+  // A project-local install is <project>/node_modules/… — never <x>/lib/node_modules, but a
+  // nested one could be; a prefix inside another node_modules tree is not a global prefix.
+  const prefix = parts.slice(0, n - 4);
+  if (prefix.includes("node_modules")) return "";
+  return prefix.join("/") || "/";
+}
+
 function main() {
   if (platform() === "win32") return;                 // registry PATH + PowerShell alias: not here
   if (process.env.CI) return;                          // no user shell to help in CI

package/model-doctor.mjs

@@ -130,6 +130,17 @@ export function isExternallyManaged(output) {
   return /externally[\s-]?managed/i.test(String(output ?? ""));
 }
 
+/**
+ * Is there no pip on this python at all? (task #333)
+ *
+ * A stock Ubuntu 24.04 ships python3 WITHOUT pip (python3-pip is a separate package), so the
+ * first install said "/usr/bin/python3: No module named pip" and gave up — although
+ * python3-venv was installed and a venv brings its own pip. Same remedy as PEP 668: a venv.
+ */
+export function isPipMissing(output) {
+  return /No module named pip\b/i.test(String(output ?? ""));
+}
+
 /** Run pip once. Resolves { code, err } — never rejects, so the caller owns the policy. */
 function runPip(python, pkgs, extraArgs = []) {
   return new Promise((resolve) => {
@@ -190,11 +201,16 @@ async function pipInstall(pkgs, log) {
   log(`  installing ${pkgs.join(" ")} … (pip, this can take a minute)`);
   let r = await runPip(python3Bin(), pkgs);
   if (r.code === 0) return;
-  if (!isExternallyManaged(r.err)) {
+  const noPip = isPipMissing(r.err);
+  if (!noPip && !isExternallyManaged(r.err)) {
     throw new Error(`pip install ${pkgs.join(" ")} exited ${r.code}`);
   }
 
-  log("  this python is managed by your OS (PEP 668) — it will not accept packages directly.");
+  log(
+    noPip
+      ? "  this python has no pip — using a private virtualenv, which brings its own."
+      : "  this python is managed by your OS (PEP 668) — it will not accept packages directly."
+  );
   const venvPy = await ensureVenv(log);
   if (venvPy) {
     r = await runPip(venvPy, pkgs);
@@ -208,6 +224,13 @@ async function pipInstall(pkgs, log) {
     }
   }
 
+  // Without pip AND without venv nothing here can install anything; --break-system-packages
+  // would only fail again with the same "No module named pip". Say what to install instead.
+  if (noPip) {
+    throw new Error(
+      "this python has no pip and no venv module — on Debian/Ubuntu: sudo apt install -y python3-venv, then gu doctor"
+    );
+  }
   log("  falling back to --break-system-packages (no virtualenv available)");
   r = await runPip(python3Bin(), pkgs, ["--break-system-packages"]);
   if (r.code === 0) return;
@@ -1246,7 +1269,13 @@ export async function ensureClaudeSdk({ log, confirm }) {
   return (await pyHasModule("anthropic")) ? "installed" : "failed";
 }
 
-export async function ensureAgentDeps({ log, confirm, modelHost = canHostMlxModels() }) {
+/**
+ * `agreed` names packages the caller has ALREADY asked about (task #333): `gu` asks "Install the
+ * agent framework now?" and then called this, which asked "Install the agent framework
+ * (smolagents + openai) — required to run the agent?" — the same question twice in a row on
+ * every first install. A yes that was just given is not asked for again.
+ */
+export async function ensureAgentDeps({ log, confirm, modelHost = canHostMlxModels(), agreed = [] }) {
   const out = {};
   log("");
   log("  Checking the agent's dependencies…");
@@ -1264,7 +1293,7 @@ export async function ensureAgentDeps({ log, confirm, modelHost = canHostMlxMode
       out[key] = "present";
       return;
     }
-    if (!(await confirm(question, true))) {
+    if (!agreed.includes(key) && !(await confirm(question, true))) {
       out[key] = "skipped";
       log(`  Skipped ${pkgs.join(" ")} — install later: ${python3Bin()} -m pip install -U ${pkgs.join(" ")}`);
       return;

package/model-fallback.mjs

@@ -0,0 +1,127 @@
+/**
+ * ANOTHER MODEL STOOD IN — and the screen says so (task #343).
+ *
+ * Reported: "When the coding model has an issue and it falls back to another model it should show
+ * a warning at the bottom bar in yellow." Until now a fallback was a line in the worker's log: the
+ * turn "worked", only with a model nobody picked, and worse code or an answer with no tools was
+ * the only evidence.
+ *
+ * The agent reports each fallback as one step — `__MODELFALLBACK__::{json}` (see MODEL_FALLBACK in
+ * gonext_agent_chat.py) — and this module turns it into the bar's row and the turn's history line.
+ * Pure: no terminal, no colour. The caller paints it yellow.
+ *
+ * WHAT IS A FALLBACK. Only "a different model did the work, or answered". A retry on the same
+ * model is not one, and a turn that failed outright (429 overloaded, 502) is not one either —
+ * nothing answered, and the failure notice already says that.
+ */
+
+export const MODELFALLBACK_PREFIX = "__MODELFALLBACK__::";
+
+const text = (v) => String(v ?? "").replace(/\s+/g, " ").trim();
+
+/** One step line → the fallback it reports, or null when it is not one (or is malformed). */
+export function parseModelFallback(line) {
+  const s = String(line ?? "");
+  if (!s.startsWith(MODELFALLBACK_PREFIX)) return null;
+  let body;
+  try {
+    body = JSON.parse(s.slice(MODELFALLBACK_PREFIX.length));
+  } catch {
+    return null;
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+  const from = text(body.from);
+  const to = text(body.to);
+  // Without the model that was used instead there is nothing true to say.
+  if (!from && !to) return null;
+  return {
+    role: body.role === "chat" ? "chat" : "coder",
+    from,
+    to,
+    reason: text(body.reason),
+    // Absent = the stand-in had tools / did answer: only an explicit false changes the wording.
+    tools: body.tools !== false,
+    answered: body.answered !== false,
+  };
+}
+
+const clipName = (name, max) => (name.length <= max ? name : name.slice(0, Math.max(1, max - 1)) + "…");
+
+/** A model name is never shortened below this — fewer characters no longer identify it. */
+const NAME_FLOOR = 5;
+
+/** The sentence's three parts, so the fitting below can shorten each on its own. */
+function parts(fb, { fromMax = Infinity, toMax = Infinity } = {}) {
+  const from = clipName(fb.from || (fb.role === "chat" ? "the chat model" : "the coding model"), fromMax);
+  const to = clipName(fb.to || "another model", toMax);
+  const same = Boolean(fb.from) && fb.from === fb.to;
+  const subject = fb.role === "chat" ? `chat model ${from}` : same ? from : `coder ${from}`;
+  // "unavailable": it never started (its server named no model). "failed": it was asked and broke.
+  const verb = fb.tools && fb.answered ? "unavailable" : "failed";
+  let outcome;
+  if (!fb.answered) outcome = same ? "and its plain reply failed too" : `${to} failed too`;
+  else if (fb.role === "chat") outcome = `${to} answered`;
+  else if (fb.tools) outcome = `coding with ${to}`;
+  else outcome = same ? "answered without tools" : `${to} answered without tools`;
+  return { subject, verb, outcome };
+}
+
+const join = ({ subject, verb, outcome }, reason) =>
+  `⚠ ${subject} ${verb}${reason ? ` (${reason})` : ""} — ${outcome}`;
+
+/**
+ * The bar's row for a fallback, FITTED to `width` columns (after the gutter): every bar row must
+ * stay one physical row (#109), and a row clipped mid-name hides the one thing it is for. So the
+ * REASON is shortened first, then dropped, and only then are the model names shortened — the
+ * longer one first.
+ */
+export function fallbackNotice(fb, { width = 80, gutter = "   " } = {}) {
+  if (!fb) return "";
+  const room = Math.max(20, (width || 80) - 1 - gutter.length);
+  const full = join(parts(fb), fb.reason);
+  if (full.length <= room) return full;
+  const bare = join(parts(fb), "");
+  if (fb.reason) {
+    const left = room - bare.length - 3; // " (" + ")"
+    if (left >= 6) return join(parts(fb), clipName(fb.reason, left));
+  }
+  if (bare.length <= room) return bare;
+  let fromMax = Math.max(NAME_FLOOR, (fb.from || "").length);
+  let toMax = Math.max(NAME_FLOOR, (fb.to || "").length);
+  while (join(parts(fb, { fromMax, toMax }), "").length > room && (fromMax > NAME_FLOOR || toMax > NAME_FLOOR)) {
+    if (fromMax >= toMax && fromMax > NAME_FLOOR) fromMax -= 1;
+    else toMax -= 1;
+  }
+  // A window too narrow even for that: cut the row rather than let it wrap onto a second one.
+  return clipName(join(parts(fb, { fromMax, toMax }), ""), room);
+}
+
+/** The line a fallback leaves in the turn's history — whole, wrapped by the caller. */
+export function fallbackHistoryLine(fb) {
+  return fb ? join(parts(fb), fb.reason) : "";
+}
+
+/**
+ * THE CODER WAS DROPPED FOR WANT OF A KEY (task #222): the API omits a coding backend whose API
+ * key is missing and the chat model does the coding. Nothing failed, so the agent has nothing to
+ * report — the terminal knows it from the payload and says it on the same row.
+ */
+export function keyMissingNotice({ coder = "", width = 80, gutter = "   " } = {}) {
+  const room = Math.max(20, (width || 80) - 1 - gutter.length);
+  const tail = " — coding with the chat model · ctrl+k";
+  const named = `⚠ no API key for coder ${text(coder)}${tail}`;
+  if (text(coder) && named.length <= room) return named;
+  const plain = `⚠ no API key for the coding model${tail}`;
+  if (plain.length <= room) return plain;
+  return clipName("⚠ no coder API key — on the chat model · ctrl+k", room);
+}
+
+/**
+ * What the bar shows after a turn ended. A fallback reported THIS turn stays; a turn that was
+ * answered with none reported means the model works again, so the warning goes; a turn that
+ * failed or was stopped proves nothing either way and leaves it as it was.
+ */
+export function fallbackAfterTurn({ current = null, reportedThisTurn = null, answered = false } = {}) {
+  if (reportedThisTurn) return reportedThisTurn;
+  return answered ? null : current;
+}

package/node-version.mjs

@@ -17,7 +17,7 @@ export const MIN_NODE_MAJOR = 18;
 /** The message for a too-old runtime, or "" when this one is fine. Pure, so it is testable. */
 export function nodeVersionProblem(version = process.version) {
   const major = Number.parseInt(String(version).replace(/^v/, "").split(".")[0], 10);
-  if (!Number.isFinite(major) || major >= MIN_NODE_MAJOR) return "";
+  if (!Number.isFinite(major) || major >= MIN_NODE_MAJOR) {return "";}
   return (
     `gu needs Node ${MIN_NODE_MAJOR} or newer — this is ${version}.\n` +
     `  Node ${major} has no global fetch, which the setup and update paths rely on.\n` +
@@ -30,10 +30,58 @@ export function nodeVersionProblem(version = process.version) {
   );
 }
 
+/**
+ * LOCAL MODE NEEDS MORE THAN GU DOES (task #333). The Local API ships the mongodb 7 driver, whose
+ * floor is Node 20.19 — and setup loads that driver IN THIS PROCESS to seed the database, then
+ * starts the API with this same node. On Node 18 the first sign was "Could not prepare the
+ * database: crypto is not defined", halfway through a first install, after MongoDB and the API
+ * were already in place. Found on a stock Ubuntu 24.04, whose own `nodejs` package is 18.19.
+ *
+ * Kept apart from MIN_NODE_MAJOR on purpose: the CLI itself (Cloud mode) still runs on 18.
+ */
+export const LOCAL_API_MIN_NODE = "20.19.0";
+
+/** True when `version` is at least `min` (both "x.y.z", a leading v allowed). */
+export function nodeAtLeast(version, min) {
+  const parts = (v) => String(v).replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const a = parts(version);
+  const b = parts(min);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) {return (a[i] ?? 0) > (b[i] ?? 0);}
+  }
+  return true;
+}
+
+/** Why Local mode cannot run on this node, with what to do — or "" when it can. Pure. */
+export function localModeNodeProblem(version = process.version, platform = process.platform) {
+  if (nodeAtLeast(version, LOCAL_API_MIN_NODE)) {return "";}
+  const how =
+    platform === "win32"
+      ? ["  winget install OpenJS.NodeJS.LTS      (or: nvm install lts with nvm-windows)"]
+      : platform === "darwin"
+        ? ["  brew install node                     (or: nvm install --lts)"]
+        : [
+            "  nvm install --lts && nvm alias default lts/*",
+            "  or NodeSource:",
+            "    curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -",
+            "    sudo apt install -y nodejs",
+          ];
+  return (
+    `Local mode needs Node ${LOCAL_API_MIN_NODE} or newer — this is ${version}.\n` +
+    "  Its API uses the MongoDB 7 driver, which does not run on older Node.\n" +
+    (platform === "linux" ? "  (Ubuntu 24.04's own nodejs package is 18.)\n" : "") +
+    "\n" +
+    how.join("\n") +
+    "\n\n" +
+    "  Then reinstall gu with that Node: npm i -g @tiens.nguyen/gu-cli\n" +
+    "  Nothing was installed or changed."
+  );
+}
+
 /** Print the problem and exit, or return quietly. */
 export function requireSupportedNode() {
   const problem = nodeVersionProblem();
-  if (!problem) return;
+  if (!problem) {return;}
   // console.error, not the REPL's own writer: this runs before any of that exists.
   console.error("\n" + problem + "\n");
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.792",
+  "version": "1.0.794",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -105,6 +105,7 @@
     "proxy-dispatcher.mjs",
     "model-doctor.mjs",
     "coding-key-prompt.mjs",
+    "model-fallback.mjs",
     "server-keys.mjs",
     "add-server.mjs",
     "powershell-alias.mjs",

package/platform-tools.mjs

@@ -298,23 +298,68 @@ export function windowsLauncherScript({ cmd, args = [], cwd, env = {}, logFile }
   return lines.join("\r\n") + "\r\n";
 }
 
+/**
+ * WHAT THE TASK RUNS — the launcher script, with NO WINDOW (task #334).
+ *
+ * The task used to run the .cmd itself. A task runs in the user's desktop session, so cmd.exe got
+ * a console window there, and `start /b` keeps node attached to that console: the window stayed
+ * for as long as the API or the worker lived. One per launch — the API, the worker, a worker
+ * restart, an API restart — "3-4 command windows" on a Windows 11 desktop after a first install,
+ * each of which kills its process when closed. Measured on the box: two visible windows titled
+ * C:\WINDOWS\SYSTEM32\cmd.exe, owned by the two node processes.
+ *
+ * `conhost.exe --headless` is Windows' own way to give a console program a console with no
+ * window (Windows 10 1809 and later). Not wscript/VBScript — it is being removed from Windows —
+ * and not `powershell -WindowStyle Hidden`, which flashes a window before hiding it.
+ *
+ * THE QUOTES ARE THE OTHER FIX. The bare script path was split by schtasks at the first space,
+ * so from a home like C:\Users\Jo Smith nothing started at all (measured: no log, no process).
+ */
+export function hiddenTaskAction(scriptPath, systemRoot) {
+  const root = String(systemRoot || "C:\\Windows").replace(/[\\/]+$/, "");
+  return `"${root}\\System32\\conhost.exe" --headless cmd.exe /c "${scriptPath}"`;
+}
+
 /**
  * Register → run → deregister. The task is a LAUNCH MECHANISM, not a persistent registration:
  * it exists only to start the process outside our job, and is removed immediately afterwards
  * so nothing is left scheduled on the user's machine. The started process keeps running —
  * deleting a task does not kill what it launched (verified).
  */
-export function schtasksCommands(taskName, scriptPath) {
+export function schtasksCommands(taskName, scriptPath, { elevated = false, systemRoot = process.env.SystemRoot } = {}) {
   return {
     create: {
       cmd: "schtasks.exe",
-      args: ["/create", "/tn", taskName, "/tr", scriptPath, "/sc", "once", "/st", "00:00", "/f"],
+      // `/rl highest` ONLY from an elevated terminal — see isElevatedGroups. From an ordinary one
+      // it is refused for an administrator ("Access is denied") and the task is never created.
+      args: [
+        "/create", "/tn", taskName, "/tr", hiddenTaskAction(scriptPath, systemRoot), "/sc", "once", "/st", "00:00",
+        ...(elevated ? ["/rl", "highest"] : []),
+        "/f",
+      ],
     },
     run: { cmd: "schtasks.exe", args: ["/run", "/tn", taskName] },
     remove: { cmd: "schtasks.exe", args: ["/delete", "/tn", taskName, "/f"] },
   };
 }
 
+/**
+ * IS THIS TERMINAL ELEVATED? — from `whoami /groups` (task #333).
+ *
+ * A scheduled task runs with the user's ORDINARY token unless it is created `/rl highest`, even
+ * when the terminal that created it is elevated — and an SSH session of an administrator always
+ * is. So the background process had FEWER rights than the `gu` that started it. On the Windows
+ * 11 test box node.exe belongs to another user's nvm and only Administrators may run it: `gu`
+ * ran, the API it launched got "Access is denied.", and setup stopped at "not up yet".
+ * A background process should have the rights of the terminal that started it — as it does on
+ * macOS and Linux, where it is simply a child.
+ *
+ * S-1-16-12288 is the High Mandatory Level label (S-1-16-16384 = System). Pure, so it is testable.
+ */
+export function isElevatedGroups(whoamiGroups) {
+  return /S-1-16-(12288|16384)\b/.test(String(whoamiGroups ?? ""));
+}
+
 /**
  * Which pid owns a listening port, from `netstat -ano`.
  *
@@ -382,7 +427,8 @@ export async function spawnSurviving({ cmd, args = [], cwd, env = {}, logFile, t
     "utf8"
   );
 
-  const t = schtasksCommands(taskName, script);
+  const elevated = isElevatedGroups(await run("whoami.exe", ["/groups"]));
+  const t = schtasksCommands(taskName, script, { elevated });
   const created = await run(t.create.cmd, t.create.args);
   if (created === null) {
     // No scheduler (or no rights): fall back to a plain detached spawn. It dies with an SSH

package/terminal-layout.mjs

@@ -528,6 +528,21 @@ export function buildFooterRows({
   ];
 }
 
+/**
+ * The bytes that print a NEW thought block into the transcript (task #344): its painted rows,
+ * with ONE empty line above when the row above is not already blank (`gap`).
+ *
+ * A thought used to go directly under whatever was last printed. Under "✓ Command finished → …"
+ * it then read as that command's output, and under a bright "✗ Command failed → …" as its error
+ * text — but a thought is printed when its step's reasoning ends, before that step's tools
+ * report: it introduces what follows. Never two blanks: the caller passes gap=false when the
+ * last row is already empty. No blank BELOW either — the next bullet opens its own.
+ */
+export function thoughtPrintSeq(paintedRows, { gap = false } = {}) {
+  if (!paintedRows.length) return "";
+  return (gap ? "\n" : "") + paintedRows.join("\n") + "\n";
+}
+
 /**
  * Bytes that draw the bar below the input line and put the caret back exactly where readline
  * left it. Relative moves only: the block must survive the terminal scrolling — writing past
@@ -2156,6 +2171,24 @@ export const HIDDEN_COMMANDS = [
                                 // the INPUT total — which does not exist yet as a counter
 ];
 
+/**
+ * NOTHING TO ANSWER WITH (#99): an agent payload with no model server in it at all.
+ *
+ * A missing AGENT model alone is fine — the API puts the coding model in its place (and sets
+ * `agentMissing`). With no coder either, `agentBaseURL` is empty: there is no server to send a
+ * question to. The API (from 1.0.220) refuses such a question in words; this lets the terminal
+ * say the same against an API that still queues a job nothing can read ("✗ Job not found.").
+ */
+export function nothingToAnswerWith(payload) {
+  if (!payload || typeof payload !== "object") return false; // unknown is not "none"
+  return !String(payload.agentBaseURL ?? "").trim();
+}
+
+export const NO_MODEL_LINES = [
+  "No model is set for this account, so there is nothing to answer with.",
+  "Pick a coding model with /model (and an agent model with /agent-model), then ask again.",
+];
+
 /**
  * Does this API base point at a server on THIS machine? (task #154)
  *
@@ -2177,9 +2210,20 @@ export function isLocalApiBase(apiBase) {
  * entire distinction — go unmentioned. Reported live on a fully set-up Ubuntu box that said
  * plain "client".
  */
-export function modeRow({ clientExpert, clientMode }) {
+export function modeRow({ clientExpert, clientMode, modelUrls = [], coderWhere }) {
   if (clientExpert) {
-    return { label: "client expert", detail: "(API + database here · models remote)" };
+    // "models remote" WAS A CONSTANT (task #333): a box running its own Ollama on 127.0.0.1 —
+    // the whole stack on one machine — was told its models were somewhere else. Said only when
+    // EVERY configured model server is this machine; one cloud coder is still "remote".
+    const urls = modelUrls.map((u) => String(u ?? "").trim()).filter(Boolean);
+    // `coderWhere` is the active coder's "host[:port]" label (coding-choice-tags.mjs), which
+    // names this machine as 127.0.0.1. Passed but empty = not known → not claimed to be here.
+    const coderHere = coderWhere === undefined || /^127\.0\.0\.1(:|$)/.test(String(coderWhere));
+    const allHere = urls.length > 0 && urls.every(isLocalApiBase) && coderHere;
+    return {
+      label: "client expert",
+      detail: allHere ? "(API, database and models here)" : "(API + database here · models remote)",
+    };
   }
   if (clientMode) {
     return { label: "client", detail: "(agent runs here · models remote)" };