@tiens.nguyen/gu-cli 1.0.896 → 1.0.898

package/README.md

@@ -1,9 +1,9 @@
 <h1 align="center">gu — the coding agent for your own models</h1>
 
 <p align="center">
-  <strong>A coding agent in your terminal that runs on Ollama or any OpenAI-compatible API.</strong><br>
-  It reads your repo, makes the change, runs the tests and shows you what it did.<br>
-  <strong>Free installs run entirely on your machine. Free for 30 days: no account, no sign-in, no card.</strong>
+  <strong>Describe the change. gu edits your repo, runs the tests and shows you the diff, with Ollama or any OpenAI-compatible API.</strong><br>
+  Your prompts and code go to the model you choose, not to gu: its API and database run on your computer.<br>
+  <strong>Free for 30 days: no account, no sign-in, no card.</strong>
 </p>
 
 <p align="center">
@@ -18,7 +18,8 @@
   <a href="https://gucli.com">Website</a> ·
   <a href="https://gucli.com/start">Docs</a> ·
   <a href="https://gucli.com/pricing">Pricing</a> ·
-  <a href="https://gucli.com/support">Support</a>
+  <a href="https://gucli.com/support">Support</a><br>
+  <sub>The website is also in Tiếng Việt, 中文 and 日本語.</sub>
 </p>
 
 <p align="center">
@@ -40,8 +41,13 @@ gu
 computer. Press Enter to use it, pick a model provider, then type what you want done.
 
 A free install is **private**: gu's API and its database (MongoDB) run on this computer, next to
-your code. The first run shows what it will install and asks before installing anything.
-Needs **Node.js 20.19+**.
+your code, and your prompts and code go to the model you pick, not to gu. The first run shows what it will
+install and asks before installing anything. Needs **Node.js 20.19+**.
+
+**Local or hosted: you choose once, at the first run.** Free installs run in *Local mode* (above).
+With a Pro token, gu uses gu's hosted API and models instead. To switch later, run `gu clear` and
+set gu up again. In Local mode `gu clear` also deletes this computer's conversations (it asks
+first); `gu clear --keep-history` keeps them.
 
 > **`gu: command not found`?** Run `npx @tiens.nguyen/gu-cli fix-path`. See [Troubleshooting](#troubleshooting).
 
@@ -65,11 +71,15 @@ Needs **Node.js 20.19+**.
 ## Is gu for you?
 
 **A good fit if** you run (or want to run) your own models, can't send code to someone else's
-cloud, work on remote Linux boxes over SSH, or want a coding agent that costs $4 a month instead
-of a model subscription.
+cloud, work on remote Linux boxes over SSH, or want a terminal coding agent that is free with
+your own models and $4 a month with ours.
 
 **Want a frontier model?** gu runs those too, through any OpenAI-compatible API, and keeps
-everything else: the edits in your repo, the tests, the browser check and `/undo`.
+everything else: the edits in your repo, the tests, the browser check and `/undo`. (Your code then
+goes to that provider, as with any tool that uses it.)
+
+**Not a fit if** you want one click and no setup: gu asks you to pick a model, and it works best
+with a strong one.
 
 ## Quick start
 
@@ -89,8 +99,8 @@ gu uses up to three models, each with its own command:
 | `/agent-model` | **agent**: talks to you and plans | this machine |
 | `/embed-model` | **embedding**: RAG (`nomic-embed-text`, `qwen3-embedding`), local or remote | this machine |
 
-Run `/doctor` any time to check that each one answers. Coding works best with a strong model:
-small local models often fail at multi-step changes.
+Run `/doctor` any time to check that each one answers. Pick a strong model for coding: small
+local models often fail at multi-step changes.
 
 ## Using gu
 
@@ -167,7 +177,7 @@ gu doctor                      set up and check models on this machine
 gu rag [plan [path] | --test]  test the embedder, estimate index time
 gu workspace revert [runId]    undo an agent run's file edits from its backups
 gu support                     send a support request with masked logs
-gu clear [--yes]               back to a fresh machine (asks first)
+gu clear [--keep-history]      back to a fresh machine (asks first)
 gu fix-path | fix-powershell   repair PATH / remove PowerShell's `gu` alias
 ```
 
@@ -188,6 +198,7 @@ gu fix-path | fix-powershell   repair PATH / remove PowerShell's `gu` alias
 | --- | --- | --- |
 | **Free trial** | 30 days, from the first run | nothing: the token is created for you |
 | **Free plan** | 3 more months on that computer | a free account at [gucli.com](https://gucli.com) |
+| **After that** | gu asks for a token | Pro, or a voucher for more free days |
 | **Pro** | **$4 a month** or **$40 a year** (+ VAT where it applies) | hosted models (no model server to run), any number of computers, provider budgets |
 
 On Pro, the hosted models and the hosted API run on gu's servers, so the prompts and code you
@@ -206,6 +217,11 @@ so the step that adds npm's bin folder to your PATH may not have run. Run
 `npx @tiens.nguyen/gu-cli fix-path`. It also finds what an old install left behind (broken links,
 a second gu from another npm, a stale PATH line) and asks before fixing each one. `--check` only reports.
 
+**`EACCES` / permission denied during install (macOS, Linux).** npm's global folder belongs to
+root. No sudo needed: run `npm config set prefix ~/.npm-global`, then install again. gu adds that
+folder to your PATH; open a new terminal. With nvm, skip that (nvm refuses an npm prefix):
+`nvm use` a Node 20.19 or newer and install again.
+
 **Windows: `gu` runs `Get-Unique`.** PowerShell has a built-in `gu` alias. Run `gu-cli fix-powershell`.
 
 **Node version.** gu needs **Node.js 20.19+** (a Pro install using only hosted models runs on 18+).

package/agent-model-command.mjs

@@ -119,6 +119,11 @@ export function agentModelRows(models, current) {
  * model is always named, because that is the one fact still true when the network is not.
  */
 export function describeTagsFailure({ url, current, error, proxied = false } = {}) {
+  // NOTHING CONFIGURED IS NOT A FAILURE (GH #397). There was no list to fetch, so "couldn't fetch
+  // the model list from (no agent model URL configured)", its echo and a /proxy hint were three
+  // ways of saying one thing — and the proxy cannot help with a URL that does not exist. Same
+  // sentence /model uses for the same state.
+  if (!url && !current) return ["No agent model configured."];
   const lines = [
     `couldn't fetch the model list from ${url || "(no agent model URL configured)"}`,
   ];
@@ -355,6 +360,16 @@ export function agentRecoveryOptions({ keyProblem = false, host = "" } = {}) {
   ];
 }
 
+/**
+ * Which recovery row the cursor starts on (GH #397). A key problem → the key row. NOTHING SET UP →
+ * "add a provider": the only way forward there, and what /model already highlights for its own
+ * "No coding model configured." Otherwise "leave it", so Enter on an unreachable box changes nothing.
+ */
+export function agentRecoveryDefault(options, { keyProblem = false, configured = true } = {}) {
+  const want = keyProblem ? "key" : configured ? "leave" : "provider";
+  return Math.max(0, options.findIndex((o) => o.action === want));
+}
+
 // ---------------------------------------------------------------------------------------------
 // #44 — WHAT TO CHANGE comes first.
 // ---------------------------------------------------------------------------------------------

package/agent-model-label.mjs

@@ -153,7 +153,7 @@ export function sameModelName(a, b) {
 /** Plain-text fallback for each reason we cannot name the model. Never a sentinel. */
 export const UNKNOWN_MODEL_TEXT = Object.freeze({
   remote: "(named by the remote server)",
-  "not-set": "not set — /agent-model",
+  "not-set": "same as the coding model",
   "no-server": "(no model server running)",
   ambiguous: "(the loaded model)",
 });

package/client-expert-run.mjs

@@ -20,8 +20,9 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { createHash } from "node:crypto";
-import { localModeNodeProblem } from "./node-version.mjs";
+import { localModeNodeProblem, nvmNodeVersions } from "./node-version.mjs";
 import { downloadMongodExe, startPortableMongod, portableMongoInstalled, mongoWinPaths, mongodCommandLine, MONGO_WIN_VERSION, mongodRuns, isDllNotFoundExit, installVcRuntime, VC_REDIST_URL } from "./mongo-windows.mjs";
+import { macosMajor, macNeedsOwnMongo, mongoMacPaths, macMongoInstalled, downloadMongodMac, mongodRunsMac, MONGO_MAC_OLD_VERSION, MONGO_MAC_BREW_MIN_MAJOR } from "./mongo-mac.mjs";
 import {
   apiDepsInstalled,
   installApiDeps,
@@ -248,11 +249,17 @@ export async function probeMongo() {
   // saying ("you already have mongosh") and because `verify` runs through it.
   const serverPath = (await tryRun("sh", ["-c", "command -v mongod || true"])) || "";
   const shellPath = (await tryRun("sh", ["-c", "command -v mongosh || true"])) || "";
+  // gu's own mongod on macOS 13 and older (GH #403) is not on PATH; `portable` says to start that one.
+  const portable = process.platform === "darwin" && (await macMongoInstalled());
+  // On those Macs Homebrew's mongod cannot run, so it does not count as installed: "it is not
+  // running" would send the reader to a server that can never start.
+  const brewUsable = !(process.platform === "darwin" && macNeedsOwnMongo(macosMajor()));
   return {
     running: false,
     how: null,
-    installed: Boolean(serverPath.trim()),
+    installed: (brewUsable && Boolean(serverPath.trim())) || portable,
     shellInstalled: Boolean(shellPath.trim()),
+    portable,
   };
 }
 
@@ -298,7 +305,12 @@ export async function probeDockerForMongo(name = MONGO_DOCKER_NAME) {
  * macOS: make a native MongoDB answer on 27017 (task #304). → { ok, explained }.
  * `explained` = it printed its own guidance, so the caller adds none.
  */
-export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.log(l), brewHasTrust = null } = {}) {
+export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.log(l), brewHasTrust = null, osMajor = macosMajor, ownMongo = ensureOwnMongoMac } = {}) {
+  // macOS 13 and older: Homebrew's MongoDB installs and then cannot run there (GH #403), so gu
+  // runs its own. A Mac that already has gu's own mongod keeps using it after a macOS upgrade.
+  if (!mongo.silentPort && (mongo.portable || macNeedsOwnMongo(osMajor()))) {
+    return ownMongo(ask, mongo, { log });
+  }
   const mn = await import("./mongo-native.mjs");
   brewHasTrust ??= mn.brewHasTrust;
   const brew = mn.findBrew();
@@ -351,6 +363,71 @@ export async function ensureNativeMongoMac(ask, mongo, { log = (l) => console.lo
   return { ok: true, explained: true };
 }
 
+/**
+ * macOS 13 and older (GH #403): gu's own mongod 8.0.5 in ~/.gonext/mongodb, run on 127.0.0.1 —
+ * no Homebrew, no service, no sudo. Shown, asked, then done, like the other platforms.
+ * Not started at login: gu's start-up check (preflightLocalMongo) starts it again when needed.
+ */
+export async function ensureOwnMongoMac(ask, mongo, {
+  log = (l) => console.log(l),
+  osMajor = macosMajor,
+  paths = mongoMacPaths(),
+  download = downloadMongodMac,
+  runs = (p) => mongodRunsMac(p.exe),
+  start = startPortableMongod,
+  waitFor = null,
+} = {}) {
+  const installing = !mongo.portable;
+  const { host, port } = mongoHostPort(LOCAL_MONGO_URI);
+  if (installing) {
+    const major = osMajor();
+    log(dim(`\n  Homebrew's MongoDB needs macOS ${MONGO_MAC_BREW_MIN_MAJOR} or newer${major ? ` (this Mac has macOS ${major})` : ""}, so gu runs`));
+    log(dim(`  its own MongoDB ${MONGO_MAC_OLD_VERSION} instead — no Homebrew, no service, no password:\n`));
+    log(`    download MongoDB ${MONGO_MAC_OLD_VERSION} (about 85 MB) into ${paths.dir}`);
+  } else {
+    log(dim("\n  gu's MongoDB is installed but not running. This starts it:\n"));
+  }
+  log("    " + mongodCommandLine({ port, paths }));
+  log("");
+  const yes = await readYesNo(ask, `  ${installing ? "Install" : "Start"} MongoDB now? [Y/n]: `, true, log);
+  if (!yes) {
+    log(dim(`\n  Not ${installing ? "installed" : "started"} — run the commands above yourself.`));
+    return { ok: false, explained: true };
+  }
+  log("\n  " + bold(installing ? "Installing MongoDB" : "Starting MongoDB") + dim(installing ? "   about 85 MB" : ""));
+  if (installing) {
+    try {
+      await download({ paths, log });
+    } catch (e) {
+      log("\n  " + red("✗ ") + `could not download MongoDB: ${e?.message ?? e}`);
+      return { ok: false, explained: true };
+    }
+  }
+  const probe = await runs(paths);
+  if (!probe.ok) {
+    log("\n  " + red("✗ ") + `MongoDB cannot run on this Mac: ${probe.why}`);
+    return { ok: false, explained: true };
+  }
+  let started;
+  try {
+    started = await start({ port, paths });
+  } catch (e) {
+    started = { ok: false, error: e };
+  }
+  if (!started?.ok) {
+    log("\n  " + red("✗ ") + `MongoDB could not be started${started?.error ? `: ${started.error.message ?? started.error}` : ""}`);
+    return { ok: false, explained: true };
+  }
+  const wait = waitFor ?? (await import("./mongo-native.mjs")).waitForMongo;
+  if (!(await wait(host, port, { timeoutMs: 60000 }))) {
+    log("\n  " + red("✗ ") + `MongoDB was ${installing ? "installed" : "started"} but is not answering at ${host}:${port} yet.`);
+    log(dim(`  Its log:  ${paths.log}   — then run gu again.`));
+    return { ok: false, explained: true };
+  }
+  log("  " + cyan("✓ MongoDB is running") + dim(` at ${host}:${port} (started by gu — data in ${paths.data})`));
+  return { ok: true, explained: true };
+}
+
 /** /etc/os-release → { id, codename, versionId }, or null where there is none (not Linux). */
 export function readOsRelease({ read = (f) => readFileSync(f, "utf8") } = {}) {
   let text = "";
@@ -622,7 +699,8 @@ export async function preflightLocalMongo({
   log("\n  " + red("gu: MongoDB is not answering") + dim(` at ${host}:${port}`) +
     red(mongo.installed || mongo.silentPort || !local ? "." : " — it is not installed on this machine."));
   log(dim("  Local mode keeps your conversations, models and keys in that database, so"));
-  log(dim(`  nothing can start without it. The API on :${LOCAL_API_PORT} is fine — it is waiting on this.`));
+  // Nothing here checks the API, so say nothing about it (it was "fine" with no API process, GH #406).
+  log(dim("  nothing can start without it. gu starts the API once the database answers."));
   if (!local) {
     log(dim(`\n  That database is on another machine (${host}). Start it there, then run gu again.\n`));
     return { ok: false, fixed: false, installed: false };
@@ -1132,7 +1210,7 @@ export async function runClientExpertSetup({
   // BEFORE ANYTHING IS INSTALLED (task #333): the API needs a newer Node than gu does. Not part
   // of the gate on purpose — a gate "no" makes the first run settle on Cloud mode for good,
   // while the fix here is a Node upgrade, after which `gu` must resume Local setup.
-  const nodeProblem = localModeNodeProblem(process.version, machine.platform);
+  const nodeProblem = localModeNodeProblem(process.version, machine.platform, { nvmVersions: nvmNodeVersions() });
   if (nodeProblem) {
     console.log("\n  " + red("✗ ") + nodeProblem + "\n");
     return { complete: false, stoppedAt: "node" };
@@ -1189,6 +1267,7 @@ export async function runClientExpertSetup({
     // "Docker is not available here": a machine without Docker is the ordinary case on a server
     // and on Windows, not an error to open with.
     let explained = false;
+    const hadServer = Boolean(mongo.installed);
     if (machine.platform !== "darwin" && !mongo.silentPort && (await probeDockerForMongo()).usable) {
       if (await startMongoInDocker(ask)) {
         mongo.running = true;
@@ -1233,6 +1312,8 @@ export async function runClientExpertSetup({
       mongo.running = true;
       mongo.how = after.how;
     }
+    // Setup INSTALLED it a moment ago, so it has no credentials of its own to ask about.
+    mongo.installedNow = !hadServer;
   }
 
   console.log("\n  " + cyan("✓ MongoDB is running") + dim(` (${mongo.how})`));
@@ -1251,6 +1332,8 @@ export async function runClientExpertSetup({
     if (mongoUri !== LOCAL_MONGO_URI) {
       console.log(dim("  using the MongoDB credentials from the previous run"));
     }
+  } else if (credsDecision === "ask" && mongo.installedNow) {
+    state = { ...state, mongoCredsConfirmed: true };
   } else if (credsDecision === "ask") {
     const credsChoice = await askMongoCredentials(ask, askSecret);
     if (credsChoice.exit) {
@@ -1575,8 +1658,10 @@ export async function runClientExpertSetup({
     }
     if (skipModels) {
       console.log("");
-      console.log("  " + cyan("✓ Model setup skipped") + dim(addProvider
-        ? ` — ${addProvider.name || "the provider list"}: its key and model are asked as soon as gu starts`
+      // "skipped" is only true when nothing was chosen: a provider that was picked is NOT skipped,
+      // its key and model are just asked in gu itself (GH #397).
+      console.log("  " + cyan(addProvider ? `✓ ${addProvider.name || "Provider"} chosen` : "✓ Model setup skipped") + dim(addProvider
+        ? " — gu asks for its key and model as soon as it starts"
         : loadPreset
         ? " — the preset picker opens as soon as gu starts"
         : " — set them any time with /model (or /use-presets)"));

package/coding-provider-setup.mjs

@@ -729,7 +729,7 @@ const NOT_A_CHAT_MODEL = [
   /moderation/i,
   /\btts\b|-tts|text-to-speech/i,
   /whisper|transcribe|audio|realtime|voice/i,
-  /image|vision-preview|dall-?e|sora/i,
+  /image|vision-preview|dall-?e|sora|video/i,
   /search(-preview|-api)?$|-search-/i,
   /rerank|guard|classifier/i,
   // OpenAI's original completion endpoints — they take a prompt, not messages.

package/daemon-control.mjs

@@ -18,7 +18,8 @@ import {
   spawnSurviving,
 } from "./platform-tools.mjs";
 import { isLocalApiBase } from "./terminal-layout.mjs";
-const PROC_LIST = processListCommand();
+// Only this user's processes (GH #396): another account's gu daemon is not "ours is running".
+const PROC_LIST = processListCommand(process.platform, { ownUser: true });
 
 const DIR = join(homedir(), ".gonext");
 export const PID_FILE = join(DIR, "worker.pid");

package/doctor-check.mjs

@@ -63,6 +63,50 @@ export function rolesFromSettings(s) {
   ];
 }
 
+/**
+ * THE MODELS A TURN ACTUALLY RUNS ON (GH #397), from the agent-payload the turn itself fetches.
+ *
+ * rolesFromSettings reads the legacy single-provider fields. /model now stores the coder as a
+ * provider row (agentCodingBackends), so on a machine set up with today's /model the coder read
+ * as "not configured" while turns ran on it fine — and the chat model was probed WITHOUT its key,
+ * so a working Qwen/OpenAI setup showed "HTTP 401 No API-key provided". Asking the same endpoint
+ * a turn asks means /doctor checks what a turn uses, key included.
+ *
+ * `codingKey` is fetched separately (the payload never carries the coder's key). The embedder is
+ * not in the payload, so it still comes from settings. Returns null when there is no payload, so
+ * the caller can fall back to rolesFromSettings.
+ */
+export function rolesFromPayload(payload, settings, codingKey = "") {
+  if (!payload || typeof payload !== "object") return null;
+  const str = (v) => String(v ?? "").trim();
+  // "local" is the API's "no key needed" marker, not a credential.
+  const realKey = (k) => (str(k) && str(k) !== "local" ? str(k) : "");
+  const [, , embed] = rolesFromSettings(settings);
+  const agentSet = payload.agentMissing !== true;
+  // NO SEPARATE AGENT MODEL: the coding model answers the chat calls too (GH #397), so check it
+  // on THAT path with its key — a "not set" here hid a 401 on "hi" while coding turns worked.
+  const chat = agentSet
+    ? { url: str(payload.agentBaseURL), model: str(payload.agentModelId), apiKey: realKey(payload.agentApiKey) }
+    : { url: str(payload.codingBaseURL), model: str(payload.codingModelId), apiKey: realKey(codingKey) };
+  return [
+    {
+      role: "chat",
+      label: "chat model",
+      why: agentSet ? "answers and routes every turn" : "answers and routes every turn (the coding model, none set apart)",
+      ...chat,
+    },
+    {
+      role: "code",
+      label: "coding model",
+      why: "writes the code",
+      url: str(payload.codingBaseURL),
+      model: str(payload.codingModelId),
+      apiKey: realKey(codingKey),
+    },
+    embed,
+  ];
+}
+
 /**
  * WHY a model that will not answer is not answering, when the host is an Ollama.
  *
@@ -166,7 +210,8 @@ export async function checkRole(
   try {
     res = await fetchImpl(endpoint, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      // The key goes in the header only — never into the result, which is printed.
+      headers: { "Content-Type": "application/json", ...(r.apiKey ? { Authorization: `Bearer ${r.apiKey}` } : {}) },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(timeoutMs),
     });
@@ -245,3 +290,23 @@ export function doctorLines(results) {
   }
   return out;
 }
+
+/**
+ * THE VERDICT LINE (GH #397). "✓ every configured model answered." was printed when NOTHING was
+ * configured — vacuously true, and green on a machine that cannot answer a single question. The
+ * check mark is only earned by a model that answered; with none set up the verdict says so and
+ * names where to start. Returns { tone: "ok" | "warn" | "bad", text }.
+ */
+export function doctorSummary(results) {
+  const list = Array.isArray(results) ? results : [];
+  const bad = list.filter((r) => r.status !== "ok" && r.status !== "unset");
+  const ok = list.filter((r) => r.status === "ok");
+  const unset = list.filter((r) => r.status === "unset");
+  if (bad.length) return { tone: "bad", text: `✗ ${bad.length} of ${list.length} did not answer.` };
+  if (!ok.length) return { tone: "warn", text: "· no model is set up yet, so nothing was checked — start with /model." };
+  if (unset.length) {
+    const names = unset.map((r) => r.label).join(", ");
+    return { tone: "warn", text: `✓ ${ok.length} answered · not set up: ${names}.` };
+  }
+  return { tone: "ok", text: "✓ every configured model answered." };
+}

package/embed-model-command.mjs

@@ -228,14 +228,14 @@ export function embedNotice({ state, model } = {}) {
  * WHICH SETUP ROWS THE BOTTOM BAR SHOWS (first-run noise, #188). A fresh install used to stack
  * three warnings at once. Now they come in order of need, and pure (no OS-specific logic):
  *  - nothing to answer with → ONLY "coding model not set" (the one thing to do first);
- *  - a coding model exists but no agent model → the agent row (the coding model stands in);
+ *  - a coding model exists but no agent model → NOTHING: one model that also talks is the normal
+ *    setup, not a fault (GH #397). `agentMissing` is still accepted and ignored.
  *  - no embed model → NOTHING until embedding was actually needed (`embedNeeded`: the agent tried
  *    a RAG tool, or the user opened /embed-model), then the embed row.
  */
 export function setupNoticeRows({ noModel = false, agentMissing = false, embedMissing = false, embedNeeded = false, embedWhy } = {}) {
   if (noModel) return ["coding model not set · /model"];
   return [
-    ...(agentMissing ? ["agent model not set — using the coding model · /agent-model"] : []),
     ...(embedMissing && embedNeeded ? [embedNotice(embedWhy) || "no embed model — RAG is off · /embed-model"] : []),
   ];
 }

package/gonext_agent_chat.py

@@ -1707,7 +1707,9 @@ def _coding_backend_flags(backend):
         # — it applies whenever a folder is registered, i.e. every coding session — and 20 was
         # far too low for real work: a NestJS feature routinely spends that on reading and
         # installing before it has written a line, so the run stopped to ask mid-task
-        # (user, 2026-08-10: "lets increase it to 100 instead of 20").
+        # (user, 2026-08-10: "lets increase it to 100 instead of 20"). Then 200 for the same reason
+        # (GH #395, user, 2026-11-06: "increase step per turn to 200 instead of 100, only if reach 200
+        # steps it will ask for permission to continue"): the __MAXSTEP__ question is only asked at 200.
         #
         # Raising it is cheap because the budget is a STOP, not a reservation: a turn that needs
         # 12 steps still takes 12. What it changes is how often a working run is interrupted to
@@ -1716,7 +1718,7 @@ def _coding_backend_flags(backend):
         #
         # The no-workspace defaults stay small on purpose: without a registered folder there are
         # no file tools, so a long run there is a model looping rather than making progress.
-        "budget": (20, 100) if backend == "openai" else (10, 100) if backend == "ollama" else (5, 40),
+        "budget": (20, 200) if backend == "openai" else (10, 200) if backend == "ollama" else (5, 40),
     }
 
 

package/gu-cli.mjs

@@ -400,7 +400,7 @@ if (["start", "stop", "status", "logs", "restart"].includes(args[0])) {
     if (await ctl.isClientMode()) {
       console.log(
         "[gu-worker] CLIENT mode — this machine runs the agent but serves no models;\n" +
-          "                it calls your model machine over the network. `/host-mode` undoes it."
+          "                it calls your model machine over the network. `gu clear` starts setup over."
       );
     }
     if (s.running) {
@@ -4214,7 +4214,13 @@ async function runAgentChatJob(job) {
     const input = JSON.stringify({
       messages: payload?.messages ?? [],
       agentBaseURL,
-      agentApiKey: payload?.agentApiKey ?? "",
+      // NO AGENT MODEL SET (GH #397): the API points the chat calls at the coding model and sends
+      // the placeholder key "local". Chat calls ("hi", the plain-reply fallback, routing) must
+      // carry the CODER's real key, or a hosted provider answers 401 while coding turns work.
+      agentApiKey:
+        payload?.agentMissing === true && codingApiKey
+          ? codingApiKey
+          : (payload?.agentApiKey ?? ""),
       agentModelId,
       // Task #134: on a CLIENT the RAG embedder lives on the model machine, so "run doctor
       // here" is advice that cannot work. The agent uses this to say the right thing.