gdmcode 0.1.3__tar.gz → 0.1.4__tar.gz

{gdmcode-0.1.3 → gdmcode-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gdmcode
-Version: 0.1.3
+Version: 0.1.4
 Summary: gdm: AI coding agent for professional developers
 Project-URL: Homepage, https://github.com/guidegdm/gdmcode
 Project-URL: Repository, https://github.com/guidegdm/gdmcode
@@ -204,7 +204,7 @@ gdm login grok        # or: gemini | codex | all
 
 Secrets are stored in the OS keychain — never in TOML files.
 
-Interactive setup is also available inside `gdm` with `/login` and `/proxy`. First launch without credentials shows onboarding instead of starting model agents.
+Interactive setup is also available inside `gdm` with `/login`, `/logout`, and `/proxy`. First launch without credentials shows onboarding instead of starting model agents; type a normal message like `hey` to test the connected LLM.
 
 Full configuration reference: [docs/configuration.md](docs/configuration.md)
 

{gdmcode-0.1.3 → gdmcode-0.1.4}/README.md

@@ -107,7 +107,7 @@ gdm login grok        # or: gemini | codex | all
 
 Secrets are stored in the OS keychain — never in TOML files.
 
-Interactive setup is also available inside `gdm` with `/login` and `/proxy`. First launch without credentials shows onboarding instead of starting model agents.
+Interactive setup is also available inside `gdm` with `/login`, `/logout`, and `/proxy`. First launch without credentials shows onboarding instead of starting model agents; type a normal message like `hey` to test the connected LLM.
 
 Full configuration reference: [docs/configuration.md](docs/configuration.md)
 

{gdmcode-0.1.3 → gdmcode-0.1.4}/docs/cli-reference.md

@@ -71,11 +71,11 @@ Authenticate with an AI provider and store credentials in the OS keychain.
 gdm logout [PROVIDER]
 ```
 
-Remove stored credentials for a provider.
+Remove stored credentials for a provider, proxy, or all routes.
 
 | Argument | Values | Default |
 |----------|--------|---------|
-| `PROVIDER` | `grok`, `gemini`, `codex`, `all` | `all` |
+| `PROVIDER` | `grok`, `gemini`, `codex`, `proxy`, `all` | `all` |
 
 ---
 
@@ -186,4 +186,4 @@ Manage the gdm background daemon (code indexing, session compression, security s
 
 | Argument | Values | Default |
 |----------|--------|---------|
-| `ACTION` | `start`, `stop`, `status` | `status` |
+| `ACTION` | `start`, `stop`, `status` | `status` |

{gdmcode-0.1.3 → gdmcode-0.1.4}/docs/quick-start.md

@@ -48,6 +48,10 @@ requests and should not store provider keys server-side.
 You can run `gdm health` after login/proxy setup to check API connectivity, the database, tool
 availability, and budget state.
 
+To disconnect later, run `gdm logout grok` or use `/logout grok` inside the interactive shell.
+`/logout all` forgets stored provider and proxy credentials; environment variables or TOML keys
+must be removed manually if they are still present.
+
 ## 4. Navigate to your project
 
 ```bash
@@ -65,7 +69,9 @@ gdm "fix the login bug"
 
 If you start `gdm` before connecting a model, it shows setup guidance and keeps slash commands
 available instead of loading the agent loop. Once connected, the agent will read relevant files,
-plan a solution, and propose edits. At autonomy level 2
+plan a solution, and propose edits. Type `hey` as a quick connection test; if the provider rejects
+the request, gdm explains whether it looks like no LLM, invalid key, rate limit, billing/credit, or
+network/proxy trouble. At autonomy level 2
 (default) it will ask before writing files or running shell commands. Lower the level for more
 prompts; raise it for more independence.
 

{gdmcode-0.1.3 → gdmcode-0.1.4}/docs/security-hardening.md

@@ -144,6 +144,8 @@ actor attribution in audit logs.
 **Rules:**
 - API keys, tokens, and passwords must be stored in the OS keychain via `gdm login`.
 - Relay tokens should be entered with `/proxy token` so they are hidden at the terminal.
+- Use `gdm logout <provider>` or `/logout <provider>` to remove keychain/fallback credentials.
+  Environment variables and TOML entries override logout and must be removed manually.
 - They must **never** appear in `config.toml`, `team.toml`, or any environment variable committed
   to version control.
 - `team.toml` is committed to git — treat it as fully public.

gdmcode-0.1.4/gdmcode/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.4"

{gdmcode-0.1.3 → gdmcode-0.1.4}/gdmcode/auth.py

@@ -217,7 +217,7 @@ def login_interactive(provider: str, store: CredentialStore | None = None) -> No
       - "codex" → paste API key
 
     Args:
-        provider: one of "grok", "gemini", "codex", "all"
+        provider: one of "grok", "gemini", "codex", "proxy", "all"
         store: CredentialStore instance (creates a new one if None)
     """
     from rich.console import Console
@@ -254,15 +254,18 @@ def logout(provider: str, store: CredentialStore | None = None) -> None:
     console = Console()
     s = store or CredentialStore()
 
+    provider = provider.lower().strip()
     if provider == "all":
-        for prov in ("grok", "gemini", "gemini_refresh", "codex"):
+        for prov in ("grok", "gemini", "gemini_refresh", "codex", "proxy"):
             s.delete(prov)
-        console.print("[green]✓[/green] Logged out from all providers.")
-    else:
+        console.print("[green]✓[/green] Logged out from all providers and proxy.")
+    elif provider in {"grok", "gemini", "codex", "proxy"}:
         s.delete(provider)
         if provider == "gemini":
             s.delete("gemini_refresh")
         console.print(f"[green]✓[/green] Logged out from [bold]{provider}[/bold].")
+    else:
+        console.print("[red]Unknown provider.[/red] Valid providers: grok, gemini, codex, proxy, all")
 
 
 # ---------------------------------------------------------------------------

{gdmcode-0.1.3 → gdmcode-0.1.4}/gdmcode/cli.py

@@ -92,10 +92,10 @@ def cmd_login(
 def cmd_logout(
     provider: Annotated[
         str,
-        typer.Argument(help="Provider to log out from: grok | gemini | codex | all"),
+        typer.Argument(help="Provider to log out from: grok | gemini | codex | proxy | all"),
     ] = "all",
 ) -> None:
-    """Remove stored credentials for a provider."""
+    """Remove stored credentials for a provider, proxy, or all routes."""
     from gdmcode.auth import logout
     logout(provider)
 

{gdmcode-0.1.3 → gdmcode-0.1.4}/gdmcode/commands.py

@@ -7,7 +7,9 @@ Supported commands: /help /model /cost /tasks /btw /compact /clear /status
 from __future__ import annotations
 
 import logging
+import os
 import subprocess
+import tomllib
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
@@ -78,10 +80,25 @@ _COMMANDS: dict[str, str] = {
     "/artifacts [view|diff|search|export] ...": "List, view, diff, search, or export saved artifacts",
     "/save [name]": "Save the last assistant response as a named artifact",
     "/login [provider]": "Authenticate inside the REPL: grok | gemini | codex | all",
+    "/logout [provider]": "Forget credentials: grok | gemini | codex | proxy | all",
     "/proxy [on|off|url <url>|token <tok>|status]": "Route LLM calls via proxy (for geo-blocked regions)",
     "/exit, /quit": "Exit the REPL",
 }
 
+_LOGOUT_PROVIDERS: frozenset[str] = frozenset({"grok", "gemini", "codex", "proxy", "all"})
+_PROVIDER_ENV_KEYS: dict[str, tuple[str, ...]] = {
+    "grok": ("XAI_API_KEY",),
+    "gemini": ("GEMINI_API_KEY",),
+    "codex": ("OPENAI_API_KEY",),
+    "proxy": ("GDM_PROXY_TOKEN", "GDM_PROXY_ENABLED"),
+}
+_PROVIDER_TOML_KEYS: dict[str, tuple[tuple[str, str], ...]] = {
+    "grok": (("api", "xai_api_key"),),
+    "gemini": (("api", "gemini_api_key"),),
+    "codex": (("api", "openai_api_key"),),
+    "proxy": (("proxy", "enabled"),),
+}
+
 
 @dataclass
 class CommandResult:
@@ -102,6 +119,7 @@ class CommandResult:
     proxy_url: str | None = None
     proxy_token: str | None = None
     prompt_secret: str | None = None  # if set, REPL prompts for hidden input then calls apply_proxy_token
+    reset_agent: bool = False  # credentials/model route changed; caller should rebuild loop
 
 
 class CommandDispatcher:
@@ -221,6 +239,8 @@ class CommandDispatcher:
                 return self._cmd_save(parts[1] if len(parts) > 1 else "")
             case "/login":
                 return self._cmd_login(parts[1] if len(parts) > 1 else "all")
+            case "/logout":
+                return self._cmd_logout(parts[1] if len(parts) > 1 else "all")
             case "/proxy":
                 return self._cmd_proxy(parts[1:])
             case "/exit" | "/quit":
@@ -237,7 +257,12 @@ class CommandDispatcher:
 
     def _cmd_help(self) -> CommandResult:
         """Display a table of all available slash commands."""
-        tbl = Table(title="gdm slash commands", header_style="bold cyan", show_lines=False)
+        tbl = Table(
+            title="gdm interactive commands",
+            caption="Type a normal message like 'hey' to talk to the connected LLM.",
+            header_style="bold cyan",
+            show_lines=False,
+        )
         tbl.add_column("Command", style="cyan", no_wrap=True)
         tbl.add_column("Description")
         for cmd, desc in _COMMANDS.items():
@@ -1383,9 +1408,76 @@ class CommandDispatcher:
         return CommandResult(
             handled=True,
             refresh_config=True,
+            reset_agent=True,
             output="[green]Login updated.[/green] The next agent turn will use the refreshed credentials.",
         )
 
+    def _credential_sources_after_logout(self, providers: list[str]) -> list[str]:
+        """Return non-keychain sources that can still reconnect after /logout."""
+        targets = ["grok", "gemini", "codex", "proxy"] if "all" in providers else providers
+        sources: list[str] = []
+        for provider in targets:
+            for env_key in _PROVIDER_ENV_KEYS.get(provider, ()):
+                if os.environ.get(env_key):
+                    sources.append(f"environment variable {env_key}")
+
+        cfg_file = Path.home() / ".config" / "gdm" / "config.toml"
+        if cfg_file.exists():
+            try:
+                cfg = tomllib.loads(cfg_file.read_text(encoding="utf-8"))
+            except Exception as exc:  # noqa: BLE001
+                sources.append(f"{cfg_file} could not be checked ({exc})")
+            else:
+                for provider in targets:
+                    for section, key in _PROVIDER_TOML_KEYS.get(provider, ()):
+                        if cfg.get(section, {}).get(key):
+                            sources.append(f"{cfg_file} [{section}].{key}")
+        return sources
+
+    def _cmd_logout(self, provider: str) -> CommandResult:
+        """Forget stored credentials for one provider, proxy, or all routes."""
+        provider = provider.lower().strip()
+        if provider not in _LOGOUT_PROVIDERS:
+            return CommandResult(
+                handled=True,
+                output="[red]Usage:[/red] /logout [grok|gemini|codex|proxy|all]",
+            )
+
+        providers = ["grok", "gemini", "codex", "proxy"] if provider == "all" else [provider]
+        try:
+            from gdmcode.auth import CredentialStore
+
+            store = CredentialStore()
+            for prov in providers:
+                store.delete(prov)
+                if prov == "gemini":
+                    store.delete("gemini_refresh")
+        except Exception as exc:  # noqa: BLE001
+            log.exception("logout failed")
+            return CommandResult(handled=True, output=f"[red]Logout failed:[/red] {exc}")
+
+        if "proxy" in providers:
+            self._proxy_enabled = False
+            self._proxy_token = ""
+
+        label = "all providers and proxy" if provider == "all" else provider
+        lines = [f"[green]✓ Logged out from {label}.[/green]"]
+        sources = self._credential_sources_after_logout(providers)
+        if sources:
+            lines.append("[yellow]Still connected through source(s) /logout cannot remove:[/yellow]")
+            lines.extend(f"  [dim]- {source}[/dim]" for source in sources)
+            lines.append("[dim]Remove those values manually, then restart or run /logout again.[/dim]")
+        else:
+            lines.append("[dim]Type /login or /proxy token when you want to reconnect.[/dim]")
+
+        return CommandResult(
+            handled=True,
+            output="\n".join(lines),
+            refresh_config=True,
+            reset_agent=True,
+            proxy_action="disable" if "proxy" in providers else None,
+        )
+
     def apply_proxy_token(self, token: str) -> CommandResult:
         """Store proxy token received via hidden prompt (never written to history)."""
         token = token.strip()

{gdmcode-0.1.3 → gdmcode-0.1.4}/gdmcode/integrations/mcp_server.py

@@ -51,7 +51,7 @@ _INTERNAL_ERROR   = -32603
 class MCPServer:
     """Minimal MCP server with stdio transport."""
 
-    def __init__(self, name: str = "gdmcode", version: str = "0.1.3") -> None:
+    def __init__(self, name: str = "gdmcode", version: str = "0.1.4") -> None:
         self._name = name
         self._version = version
         self._tools: dict[str, MCPTool] = {}

{gdmcode-0.1.3 → gdmcode-0.1.4}/gdmcode/repl.py

@@ -15,6 +15,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING
 
 from rich.console import Console
+from rich.markup import escape
 from rich.panel import Panel
 from rich.status import Status
 
@@ -126,7 +127,42 @@ def _fmt_args(args: dict) -> str:  # type: ignore[type-arg]
     return ", ".join(parts)
 
 
-def _render_event(event: object, status: Status, console: Console) -> None:
+def _format_llm_error(error: object) -> str:
+    """Return an actionable, safe-to-render message for model/provider failures."""
+    status_code = getattr(error, "status_code", None) or getattr(error, "status", None)
+    raw = str(error or "").strip() or "Unknown model error"
+    text = raw.lower()
+    if status_code is None:
+        import re
+
+        match = re.search(r"\b(?:http\s*)?(401|402|403|429|500|503)\b", text)
+        if match:
+            status_code = int(match.group(1))
+
+    if "no api key" in text or "missing credential" in text or "no llm" in text:
+        title = "No LLM connected"
+        hint = "Run /login grok, /login gemini, /login codex, or /proxy token then /proxy on."
+    elif status_code in (401, 403) or any(term in text for term in ("invalid api key", "incorrect api key", "unauthorized", "authentication", "permission denied", "forbidden")):
+        title = "LLM authentication failed"
+        hint = "Run /logout for that provider, then /login again with a valid key."
+    elif status_code == 402 or any(term in text for term in ("insufficient_quota", "insufficient quota", "no credit", "no credits", "billing", "quota exceeded", "balance")):
+        title = "LLM account has no available credit"
+        hint = "Add credits or billing with the provider, or switch provider with /login or /proxy."
+    elif status_code == 429 or any(term in text for term in ("rate limit", "rate_limit", "too many requests", "429")):
+        title = "LLM rate limit hit"
+        hint = "Wait and retry, lower concurrency, switch provider, or enable /proxy if direct access is blocked."
+    elif any(term in text for term in ("connection", "timeout", "timed out", "network", "proxy", "tls", "ssl", "dns")):
+        title = "LLM network/proxy error"
+        hint = "Check connectivity, provider availability, proxy URL/token, or try /proxy off/on."
+    else:
+        title = "LLM provider error"
+        hint = "Check /status, run /doctor, or switch/re-login with /login."
+
+    code = f" HTTP {status_code}" if status_code else ""
+    return f"[red]{title}{code}.[/red]\n[dim]{escape(raw[:800])}[/dim]\n[yellow]{hint}[/yellow]"
+
+
+def _render_event(event: object, status: Status, console: Console) -> bool:
     """Render one AgentEvent to the terminal while the spinner is live."""
     from gdmcode.agent.loop import EventType  # lazy
 
@@ -146,12 +182,16 @@ def _render_event(event: object, status: Status, console: Console) -> None:
             console.print(str(ev.content or ""))  # type: ignore[union-attr]
         case EventType.ERROR:
             status.stop()
-            console.print(f"[red]Error: {ev.content}[/red]")  # type: ignore[union-attr]
+            console.print(_format_llm_error(ev.content))  # type: ignore[union-attr]
+            return True
+        case EventType.WARNING:
+            console.print(f"[yellow]{escape(str(ev.content or 'Warning'))}[/yellow]")  # type: ignore[union-attr]
         case EventType.COST_UPDATE:
             console.print(f"[dim]  [${ev.cost_usd:.5f} | turn {ev.turn}][/dim]")  # type: ignore[union-attr]
         case EventType.DONE:
             status.stop()
             console.print("[green]Done[/green]")
+    return False
 
 
 # ---------------------------------------------------------------------------
@@ -175,12 +215,18 @@ def _run_agent_turn(
     verb = _pick_spinner_verb(db, session_id)
     status = Status(f"[cyan]{verb}...[/cyan]", console=console, spinner="dots")
     status.start()
+    error_seen = False
     try:
         for event in loop.run(user_message):  # type: ignore[union-attr]
-            _render_event(event, status, console)
+            from gdmcode.agent.loop import EventType
+            if error_seen and getattr(event, "type", None) == EventType.DONE:
+                status.stop()
+                console.print("[yellow]Stopped after model error.[/yellow]")
+                continue
+            error_seen = _render_event(event, status, console) or error_seen
     except Exception as exc:  # noqa: BLE001
         status.stop()
-        console.print(f"[red]Agent error: {exc}[/red]")
+        console.print(_format_llm_error(exc))
         log.exception("Agent turn failed")
     finally:
         status.stop()
@@ -278,6 +324,17 @@ def start_repl(cfg: "GdmConfig", db: "GdmDatabase", *, yes: bool = False, model_
     loop: object = None
     permissions: object = None
 
+    def _drop_agent_loop() -> None:
+        """Flush and discard the current loop after credentials/model route changes."""
+        nonlocal loop, permissions
+        if loop is not None:
+            try:
+                loop._flush_checkpoint_sync()  # type: ignore[union-attr]
+            except Exception:  # noqa: BLE001
+                pass
+        loop = None
+        permissions = None
+
     def _ensure_loop() -> bool:
         nonlocal cfg, loop, permissions
         if loop is not None:
@@ -467,6 +524,8 @@ def start_repl(cfg: "GdmConfig", db: "GdmDatabase", *, yes: bool = False, model_
                     dispatcher._provider = getattr(cfg, "provider", dispatcher._provider)  # type: ignore[attr-defined]
                 except Exception as exc:  # noqa: BLE001
                     console.print(f"[yellow]Config reload failed:[/yellow] {exc}")
+            if isinstance(result.reset_agent, bool) and result.reset_agent:
+                _drop_agent_loop()
             if result.should_exit:
                 console.print("[dim]Bye.[/dim]")
                 break
@@ -507,7 +566,7 @@ def start_repl(cfg: "GdmConfig", db: "GdmDatabase", *, yes: bool = False, model_
             elif result.proxy_action == "disable":
                 from dataclasses import replace as _dc_replace
 
-                cfg = _dc_replace(cfg, proxy_enabled=False)
+                cfg = _dc_replace(cfg, proxy_enabled=False, proxy_token=None)
                 dispatcher._cfg = cfg  # type: ignore[attr-defined]
                 if loop is None:
                     console.print("[dim]Proxy disabled for future agent turns.[/dim]")
@@ -543,7 +602,7 @@ def _print_onboarding(console: Console, *, error: str | None = None) -> None:
     """Show the first-run path without starting model or agent machinery."""
     title = "Connect an LLM to start coding"
     if error:
-        title = "Model connection required"
+        title = "No LLM connected"
     body = [
         "[bold]Choose one setup path:[/bold]",
         "",
@@ -554,7 +613,7 @@ def _print_onboarding(console: Console, *, error: str | None = None) -> None:
         "  [cyan]/proxy token[/cyan]     Enter your provider key hidden, stored locally",
         "  [cyan]/proxy on[/cyan]        Route calls through the configured proxy",
         "",
-        "[dim]No agent or model client starts until your first non-command prompt.[/dim]",
+        "[dim]Type a normal prompt like 'hey' after connecting. No agent/model starts before then.[/dim]",
     ]
     if error:
         body.insert(0, f"[yellow]{error}[/yellow]")

{gdmcode-0.1.3 → gdmcode-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "gdmcode"
-version = "0.1.3"
+version = "0.1.4"
 description = "gdm: AI coding agent for professional developers"
 readme = "README.md"
 license = { text = "MIT" }

{gdmcode-0.1.3 → gdmcode-0.1.4}/tests/test_commands.py

@@ -93,6 +93,49 @@ class TestHelpCommand:
         assert result.handled is True
 
 
+# ---------------------------------------------------------------------------
+# /logout
+# ---------------------------------------------------------------------------
+
+class TestLogoutCommand:
+    def test_logout_provider_deletes_stored_credential(self, dispatcher):
+        store = MagicMock()
+        with patch("gdmcode.auth.CredentialStore", return_value=store):
+            result = dispatcher.handle("/logout grok")
+
+        store.delete.assert_called_once_with("grok")
+        assert result.handled is True
+        assert result.refresh_config is True
+        assert result.reset_agent is True
+        assert "Logged out" in result.output
+
+    def test_logout_all_deletes_providers_proxy_and_gemini_refresh(self, dispatcher):
+        store = MagicMock()
+        with patch("gdmcode.auth.CredentialStore", return_value=store):
+            result = dispatcher.handle("/logout all")
+
+        deleted = [call.args[0] for call in store.delete.call_args_list]
+        assert deleted == ["grok", "gemini", "gemini_refresh", "codex", "proxy"]
+        assert result.proxy_action == "disable"
+        assert dispatcher._proxy_enabled is False
+        assert dispatcher._proxy_token == ""
+
+    def test_logout_rejects_unknown_provider(self, dispatcher):
+        result = dispatcher.handle("/logout nope")
+        assert result.handled is True
+        assert "Usage" in result.output
+        assert result.refresh_config is False
+
+    def test_logout_warns_when_env_still_provides_key(self, dispatcher, monkeypatch):
+        monkeypatch.setenv("XAI_API_KEY", "still-set")
+        store = MagicMock()
+        with patch("gdmcode.auth.CredentialStore", return_value=store):
+            result = dispatcher.handle("/logout grok")
+
+        assert "XAI_API_KEY" in result.output
+        assert "cannot remove" in result.output
+
+
 # ---------------------------------------------------------------------------
 # /model
 # ---------------------------------------------------------------------------

{gdmcode-0.1.3 → gdmcode-0.1.4}/tests/test_repl_smoke.py

@@ -5,6 +5,7 @@ CommandDispatcher handles slash commands without requiring a live model.
 """
 from __future__ import annotations
 
+from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -135,10 +136,63 @@ class TestReplStartRepl:
                         start_repl(cfg, db)
 
         output = capsys.readouterr().out
-        assert "Model connection required" in output
+        assert "No LLM connected" in output
         assert "missing credentials" in output
         assert "/proxy on" in output
 
+    def test_plain_hey_without_credentials_reports_no_llm(self, tmp_path, capsys) -> None:
+        from gdmcode.repl import start_repl
+
+        cfg, db = self._make_mocks(tmp_path)
+
+        with patch("gdmcode.repl._build_input_fn") as mock_build:
+            mock_build.return_value = MagicMock(side_effect=["hey", EOFError])
+            with patch("gdmcode.config.load_config", side_effect=RuntimeError("No API key found")):
+                with patch("gdmcode.cost_tracker.CostTracker"):
+                    with patch("gdmcode.repl._ensure_session", return_value="session-123"):
+                        start_repl(cfg, db)
+
+        output = capsys.readouterr().out
+        assert "No LLM connected" in output
+        assert "/login grok" in output
+        assert "/proxy token" in output
+
+
+class TestReplErrorFormatting:
+    def test_format_llm_error_rate_limit(self) -> None:
+        from gdmcode.exceptions import ApiRateLimitError
+        from gdmcode.repl import _format_llm_error
+
+        msg = _format_llm_error(ApiRateLimitError("rate limit exceeded", status_code=429))
+        assert "rate limit" in msg.lower()
+        assert "retry" in msg.lower()
+
+    def test_format_llm_error_infers_status_from_string(self) -> None:
+        from gdmcode.repl import _format_llm_error
+
+        msg = _format_llm_error("HTTP 429 too many requests")
+        assert "rate limit" in msg.lower()
+
+    def test_format_llm_error_invalid_key(self) -> None:
+        from gdmcode.exceptions import ApiError
+        from gdmcode.repl import _format_llm_error
+
+        msg = _format_llm_error(ApiError("invalid api key", status_code=401))
+        assert "authentication" in msg.lower()
+        assert "/login" in msg
+
+    def test_render_error_suppresses_misleading_done(self, capsys) -> None:
+        from gdmcode.agent.loop import EventType
+        from gdmcode.repl import _render_event
+        from rich.console import Console
+
+        status = MagicMock()
+        console = Console()
+        event = SimpleNamespace(type=EventType.ERROR, content="insufficient quota")
+        assert _render_event(event, status, console) is True
+        output = capsys.readouterr().out
+        assert "credit" in output.lower() or "quota" in output.lower()
+
 
 class TestCommandDispatcher:
     """Smoke tests for CommandDispatcher (called by start_repl)."""

gdmcode-0.1.3/gdmcode/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.1.3"