@tiens.nguyen/gu-cli 1.0.804 → 1.0.805

package/gonext_agent_chat.py

@@ -796,7 +796,8 @@ def _synthesize_search(query, context, base_url, model_id, api_key="local",
     parts = []
     t0 = _t.time()
     try:
-        stream = client.chat.completions.create(
+        stream = _create_with_repair(
+            client,
             model=model_id or "default_model",
             messages=[
                 {"role": "system", "content": (
@@ -1084,9 +1085,28 @@ class _OutputBudgetExhausted(_AgentConfigError):
     same."""
 
 
-# The retry of a budget-exhausted reply gets this much room (the first attempt had 32,000).
+# The retry of a budget-exhausted reply gets at least this much room.
 _BUDGET_RETRY_MAX_TOKENS = 64000
 
+# Native Claude default output budget when the caller sets none. Thinking shares this budget on
+# the adaptive-thinking models, so 32,000 left too little room for code (cut-offs on big
+# requests). 64,000 still finishes inside GONEXT_MAX_STREAM_SECONDS at ~50 tok/s. Unknown
+# Claude models keep the old 32,000. Override with GU_CLAUDE_MAX_TOKENS.
+_CLAUDE_DEFAULT_MAX_TOKENS = 64000
+
+
+def _claude_default_max_tokens(model: str) -> int:
+    """Default max_tokens for a native Claude request: 64K, never above the model's known cap."""
+    try:
+        env = int(os.environ.get("GU_CLAUDE_MAX_TOKENS") or 0)
+    except ValueError:
+        env = 0
+    cap = _known_max_output((model or "").lower())
+    want = env or _CLAUDE_DEFAULT_MAX_TOKENS
+    if cap:
+        return min(want, cap)
+    return env or 32000
+
 
 def _output_budget_exhausted(content, finish_reason) -> bool:
     """Did this reply end at the output limit with nothing written? Pure.
@@ -1104,7 +1124,13 @@ def _budget_retry_kwargs(completion_kwargs, native_claude: bool, with_effort: bo
     kw = dict(completion_kwargs)
     current = int(kw.get("max_tokens") or kw.get("max_completion_tokens") or 0)
     if native_claude:
-        kw["max_tokens"] = max(_BUDGET_RETRY_MAX_TOKENS, current)
+        # More room than the first attempt: double it, up to the model's own cap (128K on the
+        # Opus/Sonnet/Fable 5.x rows), never below the flat 64,000.
+        _cap = _known_max_output(str(kw.get("model") or "").lower())
+        # No limit of ours on the first request: the adapter's default applied, so start from it.
+        current = current or _claude_default_max_tokens(str(kw.get("model") or ""))
+        _want = max(_BUDGET_RETRY_MAX_TOKENS, current * 2)
+        kw["max_tokens"] = max(_BUDGET_RETRY_MAX_TOKENS, current, min(_want, _cap) if _cap else current)
         if with_effort:
             kw["gu_effort"] = "low"
         else:
@@ -1114,6 +1140,10 @@ def _budget_retry_kwargs(completion_kwargs, native_claude: bool, with_effort: bo
         # server's own and the request is left as it is.
         key = "max_tokens" if kw.get("max_tokens") else "max_completion_tokens"
         kw[key] = max(_BUDGET_RETRY_MAX_TOKENS, current * 2)
+        # Never ask for more than the model can give: a known cap beats the flat 64,000.
+        _cap = _known_max_output(str(kw.get("model") or ""))
+        if _cap:
+            kw[key] = min(kw[key], _cap)
     return kw
 
 
@@ -1281,7 +1311,8 @@ def _anthropic_request(kw: dict) -> dict:
     stops = [s for s in (kw.get("stop") or []) if isinstance(s, str) and s.strip()]
     req = {
         "model": kw.get("model"),
-        "max_tokens": int(kw.get("max_tokens") or kw.get("max_completion_tokens") or 32000),
+        "max_tokens": int(kw.get("max_tokens") or kw.get("max_completion_tokens")
+                          or _claude_default_max_tokens(str(kw.get("model") or ""))),
         "messages": messages,
         # Mark 3: automatic caching for the growing tail (the step history).
         "cache_control": ephemeral,
@@ -1715,6 +1746,35 @@ def _clip(text: str, limit: int = 280) -> str:
     return f"{cut}…"
 
 
+def _trim_words(text: str, limit: int = 120) -> str:
+    """Shorten a one-line command preview for a status line WITHOUT cutting mid-word
+    (task #20). Ends on a whole token (a full flag, a whole path segment) and adds "…",
+    so "Command finished → gh issue comment 109 --body-f" reads as "… --repo tiennsloit/gu…".
+    Prefers a space boundary; falls back to the last "/" when the only space is far back
+    (a long path), and to a hard cut only for one giant token. A dangling shell operator
+    (&&, |, ;) is dropped so the line never ends on a half-chain."""
+    text = " ".join(str(text).split())
+    if len(text) <= limit:
+        return text
+    budget = max(1, limit - 1)  # room for the ellipsis
+    if len(text) > budget and text[budget] == " ":
+        head = text[:budget]
+    else:
+        seg = text[:budget]
+        sp = seg.rfind(" ")
+        sl = seg.rfind("/")
+        if sp >= budget * 0.6 or (sp > 0 and sl <= sp):
+            head = seg[:sp]
+        elif sl > 0:
+            head = seg[:sl + 1]
+        else:
+            head = seg
+    toks = head.rstrip().split(" ")
+    while len(toks) > 1 and toks[-1] in ("&&", "||", "|", ";", "\\", "-", "--"):
+        toks.pop()
+    return " ".join(toks).rstrip() + "…"
+
+
 def _render_numbered_tool_list(tools) -> str:
     """Render '  N. name(args) — description' lines from the REAL registered smolagents
     tool objects — their actual name/inputs/docstring — instead of a hand-maintained
@@ -2942,32 +3002,260 @@ def _without_params(kwargs: dict, names: list) -> dict:
     return {k: v for k, v in kwargs.items() if k not in names}
 
 
+# ---------------------------------------------------------------------------------------------
+# REQUEST-SHAPE REPAIR. A user can pick ANY model, and providers reject request parameters per
+# model: newer OpenAI / reasoning models want max_completion_tokens and refuse max_tokens, kimi
+# and the o-series refuse any temperature but 1, old Ollama/vLLM/mlx servers refuse
+# max_completion_tokens, some servers refuse stop / stream_options. A list of model names goes
+# stale the day a model ships, so every call reacts to the 400 ITSELF: read what the provider
+# rejected, change exactly that, ask again, and remember the working shape per (server, model).
+# ---------------------------------------------------------------------------------------------
+_REQUEST_SHAPE_CACHE: dict = {}
+_REQUEST_SHAPE_LOADED = [False]
+_REPAIR_MAX_ATTEMPTS = 4
+# A reasoning model spends max_completion_tokens on hidden thinking first, so a tiny budget (the
+# router probe asks for 3) comes back EMPTY with finish_reason="length". Small budgets are raised.
+_REASONING_OUTPUT_FLOOR = 1024
+_REASONING_MODEL_RE = re.compile(r"^(o\d|gpt-5|gpt-6)")
+_TOKEN_KEYS = ("max_tokens", "max_completion_tokens")
+# Optional request fields that are safe to drop. NEVER model / messages / stream / tools.
+_DROPPABLE_PARAMS = ("stop", "presence_penalty", "frequency_penalty", "stream_options", "seed",
+                     "logprobs", "top_logprobs", "logit_bias", "n", "user",
+                     "parallel_tool_calls", "service_tier", "store", "metadata")
+_REJECT_WORDS = ("unsupported", "not supported", "unrecognized", "unknown parameter",
+                 "extra inputs", "not permitted", "unexpected keyword")
+
+
+def _token_key(kw: dict) -> str:
+    for k in _TOKEN_KEYS:
+        if kw.get(k):
+            return k
+    return ""
+
+
+def _output_limit_from_error(text) -> int:
+    """The output cap a provider named while refusing a too-large max_tokens, or 0. Pure.
+
+    "max_tokens is too large: 200000. This model supports at most 16384 completion tokens"."""
+    s = str(text or "").lower()
+    if not s or "context length" in s:
+        return 0
+    if not any(k in s for k in ("max_tokens", "max_completion_tokens", "completion tokens",
+                                "output tokens")):
+        return 0
+    for pat in (r"(?:at most|less than or equal to|no more than|up to|"
+                r"maximum (?:allowed )?(?:value )?(?:is|of))\s*:?\s*(\d[\d,]*)",
+                r"(?:supports?|allows?)\s+(?:a\s+)?(?:max(?:imum)?(?: of)?\s+)?(\d[\d,]*)\s+"
+                r"(?:completion|output|max)"):
+        m = re.search(pat, s)
+        if m:
+            try:
+                n = int(m.group(1).replace(",", ""))
+            except ValueError:
+                continue
+            if n >= 256:
+                return n
+    return 0
+
+
+def _repair_request(kwargs: dict, err):
+    """One fix for a 400 that rejected the request SHAPE. Pure.
+
+    Returns (new_kwargs, action) or None when nothing here can help. Actions: "clamp:<key>",
+    "rename-token", "drop:<names>". Never touches model / messages / stream."""
+    msg = str(err).lower()
+    if not any(k in msg for k in ("400", "invalid_request", "invalid request") + _REJECT_WORDS):
+        return None
+    kw = dict(kwargs)
+    tk = _token_key(kw)
+    # 1. the provider named its output cap
+    lim = _output_limit_from_error(msg)
+    if lim and tk:
+        try:
+            if int(kw[tk]) > lim:
+                kw[tk] = lim
+                return kw, f"clamp:{tk}"
+        except (TypeError, ValueError):
+            pass
+    rejects = any(w in msg for w in _REJECT_WORDS)
+    # 2. which spelling of the output budget this model wants
+    if "max_tokens" in kw and "max_tokens" in msg and (
+            "max_completion_tokens" in msg or rejects):
+        kw["max_completion_tokens"] = kw.pop("max_tokens")
+        return kw, "rename-token"
+    if ("max_completion_tokens" in kw and "max_completion_tokens" in msg
+            and "max_tokens" not in msg and rejects):
+        kw["max_tokens"] = kw.pop("max_completion_tokens")
+        return kw, "rename-token"
+    # 3. sampling parameters a reasoning model will not take
+    bad = [p for p in _unsupported_sampling_params(err) if p in kw]
+    if bad:
+        return _without_params(kw, bad), "drop:" + ",".join(bad)
+    # 4. any other optional field the provider says it does not know
+    if rejects:
+        names = [n for n in re.findall(r"['\"`]([a-z_]+)['\"`]", msg)
+                 if n in _DROPPABLE_PARAMS and n in kw]
+        if not names:
+            names = [n for n in _DROPPABLE_PARAMS
+                     if ("_" in n or n in ("seed", "logprobs")) and n in kw
+                     and re.search(r"(?<![a-z_])" + n + r"(?![a-z_])", msg)]
+        names = list(dict.fromkeys(names))
+        if names:
+            return _without_params(kw, names), "drop:" + ",".join(names)
+    return None
+
+
+def _shape_path() -> str:
+    return os.path.join(os.path.expanduser("~"), ".gonext", "request-shapes.json")
+
+
+def _shape_entries() -> dict:
+    """In-memory shapes, loaded once from disk (the agent process dies every turn)."""
+    if not _REQUEST_SHAPE_LOADED[0]:
+        _REQUEST_SHAPE_LOADED[0] = True
+        try:
+            with open(_shape_path(), "r", encoding="utf-8") as fh:
+                data = json.load(fh)
+            if isinstance(data, dict):
+                for k, v in data.items():
+                    if isinstance(v, dict):
+                        _REQUEST_SHAPE_CACHE.setdefault(str(k), v)
+        except Exception:  # noqa: BLE001 — missing/corrupt just means learning again
+            pass
+    return _REQUEST_SHAPE_CACHE
+
+
+def _save_shape(key: str, entry: dict) -> None:
+    """Persist one shape atomically (read-merge-write then rename, like the context windows)."""
+    if not key.split("|", 1)[0]:
+        return  # no server identity → nothing a later process could match
+    path = _shape_path()
+    try:
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        merged = {}
+        try:
+            with open(path, "r", encoding="utf-8") as fh:
+                loaded = json.load(fh)
+            if isinstance(loaded, dict):
+                merged = loaded
+        except Exception:  # noqa: BLE001
+            merged = {}
+        merged[key] = entry
+        tmp = f"{path}.{os.getpid()}.tmp"
+        with open(tmp, "w", encoding="utf-8") as fh:
+            json.dump(merged, fh, indent=2, sort_keys=True)
+        os.replace(tmp, path)
+    except Exception as e:  # noqa: BLE001 — never fail a turn over a cache write
+        _log(f"could not persist the learned request shape: {e}")
+
+
+def _clamp_output_budget(kw: dict, model: str, learned_cap: int = 0) -> dict:
+    """Keep the output budget inside the model's cap, and above the reasoning floor. Pure."""
+    tk = _token_key(kw)
+    if not tk:
+        return kw
+    try:
+        v = int(kw[tk])
+    except (TypeError, ValueError):
+        return kw
+    mid = (model or "").lower()
+    if _REASONING_MODEL_RE.match(mid) or tk == "max_completion_tokens":
+        v = max(v, _REASONING_OUTPUT_FLOOR)
+    cap = int(learned_cap or 0) or _known_max_output(mid)
+    if cap and v > cap:
+        v = cap
+    if v != kw[tk]:
+        kw = dict(kw)
+        kw[tk] = v
+    return kw
+
+
+def _apply_request_shape(kwargs: dict, key: str, model: str) -> dict:
+    """The request as this (server, model) is already known to accept it."""
+    kw = dict(kwargs)
+    entry = _shape_entries().get(key) or {}
+    for old, new in (entry.get("rename") or {}).items():
+        if old in kw and new not in kw:
+            kw[new] = kw.pop(old)
+    for p in entry.get("drop") or []:
+        if p not in ("model", "messages", "stream"):
+            kw.pop(p, None)
+    return _clamp_output_budget(kw, model, entry.get("max_out") or 0)
+
+
+def _remember_shape(key: str, new_kw: dict, action: str) -> None:
+    entry = dict(_shape_entries().get(key) or {})
+    if action == "rename-token":
+        entry["rename"] = ({"max_tokens": "max_completion_tokens"}
+                           if "max_completion_tokens" in new_kw
+                           else {"max_completion_tokens": "max_tokens"})
+    elif action.startswith("drop:"):
+        entry["drop"] = sorted(set(entry.get("drop") or []) | set(action[5:].split(",")))
+    elif action.startswith("clamp:"):
+        entry["max_out"] = int(new_kw[action[6:]])
+    _REQUEST_SHAPE_CACHE[key] = entry
+    _save_shape(key, entry)
+
+
+def _create_with_repair(client, **kwargs):
+    """client.chat.completions.create that fixes a 400 about the request SHAPE and retries.
+
+    Up to _REPAIR_MAX_ATTEMPTS repairs; each KIND of fix is applied at most once, so it can never
+    ping-pong between max_tokens and max_completion_tokens. An unfixable 400 is raised as it came."""
+    base = str(getattr(client, "base_url", "") or "")
+    model = str(kwargs.get("model") or "")
+    key = f"{base}|{model}"
+    kw = _apply_request_shape(kwargs, key, model)
+    done = set()
+    for _ in range(_REPAIR_MAX_ATTEMPTS):
+        try:
+            return client.chat.completions.create(**kw)
+        except Exception as e:  # noqa: BLE001
+            fixed = _repair_request(kw, e)
+            if not fixed:
+                raise
+            new_kw, action = fixed
+            if action in done or new_kw == kw:
+                raise
+            done.add(action)
+            dropped = [k for k in kw if k not in new_kw]
+            added = [k for k in new_kw if k not in kw]
+            if action == "rename-token":
+                _new_tk = _token_key(new_kw)
+                _old_tk = "max_tokens" if _new_tk == "max_completion_tokens" else "max_completion_tokens"
+                _log(f"model {model!r} wants {_new_tk} instead of {_old_tk}; "
+                     "retrying with it (remembered)")
+            elif action.startswith("clamp:"):
+                _log(f"model {model!r} caps its output at {new_kw[action[6:]]} tokens; "
+                     "retrying with it (remembered)")
+            else:
+                _log(f"model {model!r} rejects {', '.join(dropped)}; "
+                     "retrying at the model's own default")
+            _remember_shape(key, new_kw, action)
+            kw = new_kw
+    return client.chat.completions.create(**kw)
+
+
 def _chat_create(client, **kwargs):
-    """chat.completions.create with an mlx_lm safety net: if the server rejects the model
-    NAME as an unknown repo, retry once with 'default_model' — mlx_lm.server maps that
-    sentinel to whatever model it was launched with (`--model <path>`), so a server
-    started as e.g. `mlx_lm.server --model ~/mlx-models/Qwen3-14B-4bit` answers even when
-    we only know the bare name. Non-mlx servers surface their ORIGINAL error unchanged."""
+    """chat.completions.create with request-shape repair (see _create_with_repair) and an
+    mlx_lm safety net: if the server rejects the model NAME as an unknown repo, retry once with
+    'default_model' — mlx_lm.server maps that sentinel to whatever model it was launched with
+    (`--model <path>`). Non-mlx servers surface their ORIGINAL error unchanged."""
     try:
-        return client.chat.completions.create(**kwargs)
+        return _create_with_repair(client, **kwargs)
     except Exception as e:  # noqa: BLE001
         # THE PROVIDER JUST NAMED ITS OWN LIMIT. Recorded before anything else is tried: this is
         # the only source that cannot be stale, and without it a too-generous prior would refuse
         # every turn forever instead of being corrected by the first one.
         _learn_context_window(str(getattr(client, "base_url", "") or ""),
                               str(kwargs.get("model") or ""), e)
-        bad = [p for p in _unsupported_sampling_params(e) if p in kwargs]
-        if bad:
-            _log(f"model {kwargs.get('model')!r} rejects {', '.join(bad)}; "
-                 "retrying at the model's own default")
-            return client.chat.completions.create(**_without_params(kwargs, bad))
         if kwargs.get("model") != "default_model" and _retry_as_default_model_helps(e):
             _log(f"model {kwargs.get('model')!r} not found on server; retrying as "
                  "'default_model' (mlx_lm preloaded model)")
             try:
                 kwargs2 = dict(kwargs)
                 kwargs2["model"] = "default_model"
-                return client.chat.completions.create(**kwargs2)
+                return _create_with_repair(client, **kwargs2)
             except Exception:  # noqa: BLE001
                 raise e  # surface the clearer original error, not the retry's
         raise
@@ -2976,15 +3264,15 @@ def _chat_create(client, **kwargs):
 def _chat_create_stream(client, on_delta, **kwargs) -> str:
     """Like _chat_create but STREAMS the completion: on_delta(text) is called for each
     content piece AS IT ARRIVES (so the caller can emit it live), and the full assembled
-    text is returned once the stream ends. Applies the same mlx_lm model-not-found retry
-    as _chat_create — that failure always happens at/near the very first network
-    round-trip (before any token streams), so a clean retry from scratch never risks
+    text is returned once the stream ends. Applies the same request-shape repair and mlx_lm
+    model-not-found retry as _chat_create — those failures always happen at/near the very first
+    network round-trip (before any token streams), so a clean retry from scratch never risks
     re-emitting a partial answer twice."""
     kwargs = dict(kwargs)
     kwargs["stream"] = True
 
     def _run(kw):
-        stream = client.chat.completions.create(**kw)
+        stream = _create_with_repair(client, **kw)
         parts = []
         for chunk in stream:
             choices = getattr(chunk, "choices", None)
@@ -3002,13 +3290,6 @@ def _chat_create_stream(client, on_delta, **kwargs) -> str:
         # authority that cannot go stale, so it is recorded before any retry is considered.
         _learn_context_window(str(getattr(client, "base_url", "") or ""),
                               str(kwargs.get("model") or ""), e)
-        # Same safety as the model-not-found retry below: a 400 rejects the REQUEST, so it
-        # lands before any delta streams and a clean re-run can't emit a partial answer twice.
-        bad = [p for p in _unsupported_sampling_params(e) if p in kwargs]
-        if bad:
-            _log(f"model {kwargs.get('model')!r} rejects {', '.join(bad)}; "
-                 "retrying at the model's own default")
-            return _run(_without_params(kwargs, bad))
         if kwargs.get("model") != "default_model" and _retry_as_default_model_helps(e):
             _log(f"model {kwargs.get('model')!r} not found on server; retrying as "
                  "'default_model' (mlx_lm preloaded model)")
@@ -3241,6 +3522,11 @@ def _plain_reply(messages: list, base_url: str, api_key: str, model_id: str,
     # gets persisted to conversation history); raising lets it become a genuine job
     # failure instead (see docstring). Kept short/clean (no embedded newlines/HTML — a
     # raw nginx 502 page can be a whole document) for whichever caller logs/surfaces it.
+    # The FIRST error is the model the user asked for; when the stand-in failed differently
+    # (e.g. a 502 on the fallback), the real cause would otherwise be hidden.
+    if first_err is not None and last_err is not first_err and str(first_err) != str(last_err):
+        raise RuntimeError(f"couldn't get a response ({_clip(str(first_err), 110)}; "
+                           f"then {_clip(str(last_err), 70)})")
     raise RuntimeError(f"couldn't get a response ({_clip(str(last_err), 160)})")
 
 
@@ -3486,7 +3772,7 @@ def _model_context_window(base_url: str, model_id: str, api_key: str = "") -> in
     #    rather than living forever. Being here at all is what stops a hosted model quietly
     #    throwing away history on every turn.
     if win <= 0:
-        win = _known_context_window(model_id)
+        win = _known_context_window(model_id, base_url)
         if win > 0:
             _log(f"context window: no source reported one for {model_id!r}; using the published "
                  f"{win} for its family. /context-window <tokens> overrides this.")
@@ -3580,17 +3866,125 @@ _KNOWN_CTX_WINDOWS: list = [
 ]
 
 
-def _known_context_window(model_id: str) -> int:
-    """A published window for a well-known family, or 0. LAST RESORT — see the note above."""
+def _known_context_window(model_id: str, base_url: str = "") -> int:
+    """A published window for a well-known family, or 0. LAST RESORT — see the note above.
+    The cloud token table (_cloud_limit) is asked first, then the built-in rows."""
     mid = (model_id or "").strip().lower()
     if not mid:
         return 0
+    cloud = _cloud_limit(mid, "ctx", base_url)
+    if cloud:
+        return cloud
     for pattern, tokens, _source in _KNOWN_CTX_WINDOWS:
         if re.match(pattern, mid):
             return tokens
     return 0
 
 
+# OUTPUT-TOKEN CAPS — the sibling of _KNOWN_CTX_WINDOWS, for the reply instead of the prompt.
+# Only rows with a citation are listed; a model that matches nothing is left UNCLAMPED and the
+# provider's own refusal ("max_tokens is too large … at most N") is learned by _repair_request and
+# remembered per (server, model). A missing row therefore costs one retry, a wrong row would cost
+# every request, so this list stays short on purpose. Specific rows first.
+_KNOWN_MAX_OUTPUT = [
+    # Anthropic models overview (https://platform.claude.com/docs/en/models/overview, read 2026-10-05):
+    # Fable 5.1 / Opus 5.5 / Sonnet 5.5 = 128K max output, Haiku 4.5 = 64K.
+    (r"^claude-haiku-4-5", 64_000, "https://platform.claude.com/docs/en/models/overview"),
+    (r"^claude-(opus|sonnet|fable)-5", 128_000, "https://platform.claude.com/docs/en/models/overview"),
+    (r"^gpt-6", 128_000, "OpenAI API models overview (read through a web search summary; "
+                         "GPT-6 Astra / 6.1 Sol / 6 Luna: 128,000 output tokens)"),
+    (r"^gpt-5\.1-codex-max", 128_000, "https://developers.openai.com/api/docs/models/gpt-5-codex "
+                                      "(the note beside _KNOWN_CTX_WINDOWS: 128,000 max output)"),
+    (r"^gpt-4o-mini", 16_384, "OpenAI model page for GPT-4o mini, read through a web search "
+                              "summary: 16,384 maximum output tokens"),
+]
+
+
+def _known_max_output(model_id: str, base_url: str = "") -> int:
+    """A published output cap for a well-known family, or 0 (= do not clamp). Cloud table first."""
+    mid = (model_id or "").strip().lower()
+    if not mid:
+        return 0
+    cloud = _cloud_limit(mid, "out", base_url)
+    if cloud:
+        return cloud
+    for pattern, tokens, _source in _KNOWN_MAX_OUTPUT:
+        if re.match(pattern, mid):
+            return tokens
+    return 0
+
+
+# CLOUD TOKEN TABLE (GET /api/model-limits, pushed from the deploy app's "Push token table to
+# cloud" button). Read ONCE per job, best effort: a missing or failing API never stops a turn, it
+# only means the built-in tables below are used. Order at lookup time: this machine's learned
+# limits and the server's own answer come first (callers), then THIS table, then the built-in one.
+_CLOUD_LIMITS: dict = {"rows": [], "loaded": False}
+
+
+def _fetch_cloud_limits(api_base: str, timeout: float = 5.0) -> int:
+    """Load the cloud token-limit rows into _CLOUD_LIMITS; returns how many. Never raises."""
+    base = (api_base or "").rstrip("/")
+    _CLOUD_LIMITS["loaded"] = True
+    if not base:
+        return 0
+    try:
+        req = urllib.request.Request(f"{base}/api/model-limits", method="GET")
+        with urllib.request.urlopen(req, timeout=timeout, context=_ssl_context()) as resp:
+            data = json.loads(resp.read().decode("utf-8", "replace") or "{}")
+    except Exception as e:  # noqa: BLE001
+        _log(f"cloud token table not read ({type(e).__name__}); using the built-in table")
+        return 0
+    rows = []
+    for r in (data.get("rows") if isinstance(data, dict) else None) or []:
+        if not isinstance(r, dict) or not isinstance(r.get("model"), str) or not r.get("model"):
+            continue
+        host = str(r.get("host") or "").strip().lower()
+        rows.append({
+            "host": "" if host == "*" else host,
+            "model": r["model"],
+            "regex": r.get("origin") == "table",
+            "ctx": r.get("contextWindow") if isinstance(r.get("contextWindow"), int) and r.get("contextWindow") > 0 else 0,
+            "out": r.get("maxOutput") if isinstance(r.get("maxOutput"), int) and r.get("maxOutput") > 0 else 0,
+        })
+    _CLOUD_LIMITS["rows"] = rows
+    _log(f"cloud token table: {len(rows)} rows")
+    return len(rows)
+
+
+def _cloud_limit(model_id: str, field: str, base_url: str = "") -> int:
+    """The cloud table's value for this model (field "ctx" or "out"), or 0.
+
+    A row for THIS server beats an any-server row; an exact model id beats a family regex."""
+    mid = (model_id or "").strip().lower()
+    if not mid or not _CLOUD_LIMITS["rows"]:
+        return 0
+    try:
+        from urllib.parse import urlparse
+        host = (urlparse(base_url).hostname or "").lower() if base_url else ""
+    except Exception:  # noqa: BLE001
+        host = ""
+    best, best_rank = 0, -1
+    for r in _CLOUD_LIMITS["rows"]:
+        val = r.get(field) or 0
+        if not val:
+            continue
+        if r["host"] and r["host"] != host:
+            continue
+        if r["regex"]:
+            try:
+                hit = re.match(r["model"], mid) is not None
+            except re.error:
+                hit = False
+        else:
+            hit = r["model"].strip().lower() == mid
+        if not hit:
+            continue
+        rank = (2 if r["host"] else 0) + (1 if not r["regex"] else 0)
+        if rank > best_rank:
+            best, best_rank = val, rank
+    return best
+
+
 # "maximum context length is 128000 tokens" · "max_tokens is too large: 200000" ·
 # "input length ... exceeds ... 32768" — every provider words it differently and every one of
 # them names the number, which is the only part that matters.
@@ -7241,7 +7635,7 @@ def _ws_request_approval(api_base, worker_key, job_id, command, reason, deadline
         _srv, _, _rest = command[len("__MCPTOOL__::"):].partition("\t")
         _emit({"type": "step", "text": f"Awaiting your approval: MCP tool {_srv}/{_rest.split(chr(9))[0]}"})
     else:
-        _emit({"type": "step", "text": f"Awaiting your approval to run: {command[:70]}"})
+        _emit({"type": "step", "text": f"Awaiting your approval to run: {_trim_words(command)}"})
     deadline = _t.time() + max(30, int(deadline_s))  # per-call; risky=180s, __MAXSTEP__ long
     while _t.time() < deadline:
         _t.sleep(1.2)
@@ -9900,6 +10294,10 @@ def run_agent_chat(cfg):
     # Per-turn, like _compact_state above: the high-water mark that decides when a trim
     # pass is worth breaking the prefix cache for. See _trim_due.
     _trim_state: dict = {"next_at": _TRIM_FIRST_AT_CHARS}
+    # Cloud token table (GET /api/model-limits): read before the window is resolved so the first
+    # turn already uses it. Best effort, once per process; a failure only means the built-in table.
+    if not _CLOUD_LIMITS["loaded"]:
+        _fetch_cloud_limits(worker_api_base)
     _ctx_window = _model_context_window(coding_base_url, coding_model_id, coding_api_key)
     _compact_at = _compact_threshold(_ctx_window)
     _caps = _set_obs_caps(_ctx_window)
@@ -10407,7 +10805,9 @@ def run_agent_chat(cfg):
             self._apply_rate_limit()
             t0 = time.monotonic()
             _log("streamed generate: request issued (stream=True), awaiting first token…")
-            stream = self.client.chat.completions.create(**completion_kwargs)
+            # Request-shape repair (max_tokens vs max_completion_tokens, sampling params the
+            # model refuses, output cap named by the provider) — see _create_with_repair.
+            stream = _create_with_repair(self.client, **completion_kwargs)
             parts = []
             rparts = []  # reasoning-channel text (task #111: may hold the <code> block)
             role = "assistant"
@@ -13099,7 +13499,7 @@ def run_agent_chat(cfg):
                             _emit({"type": "step", "text": f"Server already up → {_urls} (reused)"})
                             _last_obs["text"] = msg
                             return msg
-                _emit({"type": "step", "text": f"Running → {command[:70]}"})
+                _emit({"type": "step", "text": f"Running → {_trim_words(command)}"})
                 t = max(5, min(int(timeout_seconds or 180), 600))
                 # Own process group (start_new_session) + output to a log file. This is
                 # what lets a server OUTLIVE this job process, and what lets a timeout
@@ -13154,7 +13554,7 @@ def run_agent_chat(cfg):
                             if rc == 0 else f"FAILED (exit {rc})"
                         )
                         _emit({"type": "step", "text":
-                               f"Command {'finished' if rc == 0 else 'failed'} → {command[:50]}"})
+                               f"Command {'finished' if rc == 0 else 'failed'} → {_trim_words(command)}"})
                         # SAY "no output" RATHER THAN SHOW NOTHING (task #204). An empty result
                         # was indistinguishable from a command that never ran — which is exactly
                         # what `cd X && Y` used to do — and the model read the silence as a

package/gu-repl.mjs

@@ -130,6 +130,7 @@ import {
   shouldCancelPrompt,
   rankSlashCommands,
   slashMenuWindow,
+  trimWords,
 } from "./terminal-layout.mjs";
 import { completedFlush, splitLiveStream } from "./completed-flush.mjs";
 import { isScaffoldStep, isGroupableStep, stepGroupRows, relativizePaths } from "./step-group.mjs";
@@ -1512,6 +1513,11 @@ function applyClick({ row, col }) {
     void runPricesUpdate();
     return;
   }
+  if (limitsRowTarget && row === updateRowAbs &&
+      col - 1 >= limitsRowTarget.from && col - 1 < limitsRowTarget.to) {
+    void runLimitsSeen();
+    return;
+  }
   if (logsRowTarget && row === updateRowAbs &&
       col - 1 >= logsRowTarget.from && col - 1 < logsRowTarget.to) {
     void runClearLogs();
@@ -2814,6 +2820,7 @@ function zoneNotice(width) {
     if (up) items.push({ key: "update", clickable: true, paint: accent, text: up.text.slice(up.from) });
   }
   if (priceUpdate) items.push({ key: "prices", clickable: true, paint: accent, text: `${priceUpdateText()} (click)` });
+  if (limitsUpdate) items.push({ key: "limits", clickable: true, paint: accent, text: `${limitsUpdate.label} (click)` });
   if (tokenNotice?.text) items.push({ key: "token", paint: tokenNotice.urgent ? yellow : dim, text: tokenNotice.text });
   const agents = agentsIndicator(otherAgents);
   if (agents) items.push({ key: "agents", clickable: true, paint: accent, text: `${agents} running (click)` });
@@ -2900,6 +2907,7 @@ function frozenZone() {
   updateRowTarget = notice?.spans.update ?? null;
   agentsRowTarget = notice?.spans.agents ?? null;
   pricesRowTarget = notice?.spans.prices ?? null;
+  limitsRowTarget = notice?.spans.limits ?? null;
   logsRowTarget = notice?.spans.logs ?? null;
   jumpSpan = notice?.spans.jump ?? null;
   return { ...zone, rows, statusRows: sep, noticeRow: Boolean(notice) };
@@ -2970,7 +2978,7 @@ function paintBar() {
   // THE NOTICE ROW is the one directly above the separator (#318) — never the separator itself.
   const noticeAbs = zone.noticeRow ? sepAbs - 1 : 0;
   jumpRowTarget = scrolledBack() && jumpSpan ? { row: noticeAbs, ...jumpSpan } : null;
-  updateRowAbs = updateRowTarget || agentsRowTarget || pricesRowTarget || logsRowTarget ? noticeAbs : 0;
+  updateRowAbs = updateRowTarget || agentsRowTarget || pricesRowTarget || limitsRowTarget || logsRowTarget ? noticeAbs : 0;
   // preserveCaret:false — the save slot holds the OUTPUT position (see regionUi), and the caret
   // is parked on the input line right after, so there is nothing to preserve here.
   ui(
@@ -3132,6 +3140,8 @@ let updateRowAbs = 0;
 let agentsRowTarget = null;
 // …and "new prices updated <date>" (#323).
 let pricesRowTarget = null;
+// …and "output token limits updated <date>" — the cloud token table changed.
+let limitsRowTarget = null;
 // …and "clear logs · 175 MB" (#329), shown only once the logs are worth a row.
 let logsRowTarget = null;
 // A terminal left with a scrolling region is a broken shell — a hard guarantee, like the
@@ -8095,6 +8105,88 @@ async function runPricesUpdate() {
   }
 }
 
+// ---------------------------------------------------------------------------------------------
+// "OUTPUT TOKEN LIMITS UPDATED <date>": the cloud token table (GET /api/model-limits, Mongo
+// "model_limits", pushed by the Deploy app's "Push token table to cloud" button) is checked at
+// start and hourly beside the version and price checks. When its updatedAt is newer than the one
+// this machine last saw (~/.gonext/model-limits-seen.json), a clickable item joins the notice
+// row. Nothing needs applying: the worker reads the cloud table on every run. The click lists
+// what changed and marks it seen.
+// ---------------------------------------------------------------------------------------------
+let limitsUpdate = null; // { updatedAt, label, rows } while unseen changes wait
+const limitsSeenFile = () => join(homedir(), ".gonext", "model-limits-seen.json");
+
+async function readLimitsSeen() {
+  try {
+    const { readFile } = await import("node:fs/promises");
+    return String(JSON.parse(await readFile(limitsSeenFile(), "utf8"))?.seenAt ?? "");
+  } catch {
+    return "";
+  }
+}
+
+async function fetchCloudLimits() {
+  const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+  const base = (String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE).replace(/\/+$/, "");
+  try {
+    const r = await fetch(`${base}/api/model-limits`, { signal: AbortSignal.timeout(8000) });
+    if (!r.ok) return null;
+    const j = await r.json().catch(() => null);
+    return j && Array.isArray(j.rows) ? j : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Did the cloud token table change since this machine looked? Fails silently to "no". */
+async function refreshLimitsUpdate() {
+  if (process.env.GU_NO_UPDATE_CHECK === "1") return;
+  try {
+    const ln = await import("./model-limits-notice.mjs");
+    const cloud = await fetchCloudLimits();
+    if (!cloud) return;
+    const seenAt = await readLimitsSeen();
+    const was = Boolean(limitsUpdate);
+    if (!seenAt && cloud.updatedAt) {
+      // First run on this machine: the current table is the baseline, not news.
+      await markLimitsSeen(cloud.updatedAt);
+      limitsUpdate = null;
+    } else {
+      limitsUpdate = ln.hasNewerLimits(seenAt, cloud.updatedAt)
+        ? { updatedAt: cloud.updatedAt, label: ln.limitsUpdateLabel(cloud.updatedAt), rows: cloud.rows, seenAt }
+        : null;
+    }
+    if (Boolean(limitsUpdate) !== was && barPinned()) paintBar();
+  } catch {
+    /* a limits notice is never worth an error */
+  }
+}
+
+async function markLimitsSeen(updatedAt) {
+  try {
+    const { mkdir, writeFile } = await import("node:fs/promises");
+    await mkdir(join(homedir(), ".gonext"), { recursive: true });
+    await writeFile(limitsSeenFile(), JSON.stringify({ seenAt: updatedAt }) + "\n");
+  } catch {
+    /* not remembering only means the notice comes back */
+  }
+}
+
+/** The notice's click: say what changed, then mark it seen. */
+async function runLimitsSeen() {
+  const u = limitsUpdate;
+  if (!u) return;
+  const ln = await import("./model-limits-notice.mjs");
+  const c = ln.changedLimitLines(u.rows, u.seenAt);
+  console.log("\n" + GUTTER + accent(`✓ ${u.label}`) +
+    dim(` — ${c.count} row${c.count === 1 ? "" : "s"} changed in the cloud token table; gu uses them from the next turn.`));
+  for (const l of c.lines) console.log(GUTTER + dim("  " + l));
+  console.log("");
+  await markLimitsSeen(u.updatedAt);
+  limitsUpdate = null;
+  if (barPinned()) paintBar();
+}
+
 // ---------------------------------------------------------------------------------------------
 // "CLEAR LOGS" (#329): a quiet item at the right of the notice row once gu's logs are worth a row,
 // and /clear-logs for where there is no mouse. A click deletes nothing: it MEASURES — the logs,
@@ -11421,7 +11513,7 @@ async function runAgentTurn(history, { attachJobId = "", ownJob = false } = {})
     // long CPU-bound step reads as what it's actually reasoning about, not "Thinking")
     // > the "almost done" heartbeat > the bare fallback.
     const max = Math.max(24, (process.stdout.columns || 80) - 14);
-    const fit = (s) => (s.length > max ? s.slice(0, max - 1) + "…" : s);
+    const fit = (s) => trimWords(s, max); // whole words + "…" (task #20)
     // Prompt tokens this turn (task #83) + the peak single request (task #84). The global
     // OUTPUT total (task #104) used to hang off this line too, but the bottom bar carries it
     // now ("… total ↓ n") one row below — showing the same figure twice read as a bug.
@@ -12047,7 +12139,12 @@ async function runAgentTurn(history, { attachJobId = "", ownJob = false } = {})
           continue;
         }
         const st = classifyBullet(stepText);
-        const bRows = wrapBlock(stepText, GUTTER, process.stdout.columns || 80);
+        // A finished/failed command fits ONE row, trimmed at a word boundary with "…" (task #20).
+        const mCmd = /^(Command (?:finished|failed) → )(.+)$/.exec(stepText);
+        const shown = mCmd
+          ? mCmd[1] + trimWords(mCmd[2], Math.max(20, (process.stdout.columns || 80) - GUTTER.length - mCmd[1].length - 1))
+          : stepText;
+        const bRows = wrapBlock(shown, GUTTER, process.stdout.columns || 80);
         // One empty line above EVERY bullet now (see openBullet), which SUBSUMES the old
         // special case that opened only the turn's final phase — opensAnswerPhase's blank is
         // just one of these. Still idempotent, so it cannot double the seam the caller owns.
@@ -13304,6 +13401,9 @@ async function main() {
   // #323: gu's newest published price + cache tables — same cadence, same silent failure.
   void refreshPriceUpdate();
   setInterval(() => void refreshPriceUpdate(), UPDATE_CHECK_MS).unref();
+  // The cloud token table (model_limits): "output token limits updated <date>" — same cadence.
+  void refreshLimitsUpdate();
+  setInterval(() => void refreshLimitsUpdate(), UPDATE_CHECK_MS).unref();
   void refreshLogsSize();
   setInterval(() => void refreshLogsSize(), UPDATE_CHECK_MS).unref();
   // The gu token (#232): same arrangement — background, never delays the prompt, unref'd.

package/model-limits-notice.mjs

@@ -0,0 +1,50 @@
+/**
+ * "OUTPUT TOKEN LIMITS UPDATED <date>": the cloud token table (GET /api/model-limits, Mongo
+ * "model_limits", written by the Deploy app's "Push token table to cloud" button through
+ * PUT /api/model-limits) changed since this machine last looked.
+ *
+ * The worker already READS the cloud table at the start of every run, so nothing has to be
+ * applied. The notice is there so a change is VISIBLE. It sits in the same place as gu's other
+ * updates ("⭯ updates…", "new prices updated…"). A click lists what changed and marks it seen.
+ *
+ * Pure: the fetch, the clock and the file belong to gu-repl.mjs. A failed probe means "no notice".
+ */
+
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+/** Is the cloud table's updatedAt newer than the one this machine saw? ("" seen = never.) */
+export function hasNewerLimits(seenAt, updatedAt) {
+  const u = Date.parse(updatedAt ?? "");
+  if (!Number.isFinite(u)) return false;
+  const s = Date.parse(seenAt ?? "");
+  return !Number.isFinite(s) || u > s;
+}
+
+/** The notice: "output token limits updated 5 Oct 2026". */
+export function limitsUpdateLabel(updatedAt) {
+  const d = new Date(updatedAt ?? "");
+  if (Number.isNaN(d.getTime())) return "output token limits updated";
+  return `output token limits updated ${d.getUTCDate()} ${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
+}
+
+const fmt = (n) => (Number.isFinite(n) ? `${Math.round(n / 1000)}K` : "—");
+
+/**
+ * The rows changed after `seenAt`, newest first, as lines:
+ *   "claude-opus-5-5  · any host · max output 128K · window 1000K"
+ * Everything when nothing was seen yet. At most `max` lines, then "…and N more".
+ */
+export function changedLimitLines(rows, seenAt = "", { max = 12 } = {}) {
+  const s = Date.parse(seenAt ?? "");
+  const changed = (Array.isArray(rows) ? rows : [])
+    .filter((r) => r && r.model && (!Number.isFinite(s) || Date.parse(r.updatedAt ?? "") > s))
+    .sort((a, b) => String(b.updatedAt ?? "").localeCompare(String(a.updatedAt ?? "")));
+  const lines = changed.slice(0, max).map((r) => {
+    const parts = [r.model, r.host ? r.host : "any host"];
+    if (r.maxOutput) parts.push(`max output ${fmt(r.maxOutput)}`);
+    if (r.contextWindow) parts.push(`window ${fmt(r.contextWindow)}`);
+    return parts.join(" · ");
+  });
+  if (changed.length > max) lines.push(`…and ${changed.length - max} more`);
+  return { count: changed.length, lines };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.804",
+  "version": "1.0.805",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -73,6 +73,7 @@
     "preset-editor.mjs",
     "preset-apply.mjs",
     "model-prices.mjs",
+    "model-limits-notice.mjs",
     "device-login.mjs",
     "daemon-control.mjs",
     "log-policy.mjs",

package/terminal-layout.mjs

@@ -1007,6 +1007,31 @@ export const isToolStepSummary = (line) => / \| → /.test(line);
 // Glyph vocabulary for an action line: a FAILURE pops (✗, full-bright), a completed
 // action recedes (✓, dim), anything else is neutral (●, dim). Returns the KIND only —
 // the REPL owns the colours, so this stays pure and testable.
+/**
+ * Shorten a one-line command preview WITHOUT cutting mid-word (task #20): end on a whole
+ * token (a full flag, a whole path segment) and add "…". Prefers a space; falls back to the
+ * last "/" when the only space is far back (a long path); hard-cuts only one giant token.
+ * A dangling shell operator (&&, |, ;) is dropped. Mirrors _trim_words in gonext_agent_chat.py.
+ */
+export function trimWords(text, limit) {
+  const s = String(text ?? "").split(/\s+/).filter(Boolean).join(" ");
+  if (s.length <= limit) return s;
+  const budget = Math.max(1, limit - 1);
+  let head;
+  if (s[budget] === " ") head = s.slice(0, budget);
+  else {
+    const seg = s.slice(0, budget);
+    const sp = seg.lastIndexOf(" ");
+    const sl = seg.lastIndexOf("/");
+    if (sp >= budget * 0.6 || (sp > 0 && sl <= sp)) head = seg.slice(0, sp);
+    else if (sl > 0) head = seg.slice(0, sl + 1);
+    else head = seg;
+  }
+  const toks = head.trimEnd().split(" ");
+  while (toks.length > 1 && ["&&", "||", "|", ";", "\\", "-", "--"].includes(toks[toks.length - 1])) toks.pop();
+  return toks.join(" ").trimEnd() + "…";
+}
+
 export function bulletKind(text) {
   if (/\bfail(ed|s|ure)?\b|\berror(ed)?\b|→\s*(?:HTTP\s*)?[45]\d\d\b/i.test(text)) return "fail";
   if (/^(?:Command finished|Server up|App launched)\b|→\s*(?:HTTP\s*)?2\d\d\b|\b(?:passed|succeeded|ready)\b/i.test(text))