aegis-desktop 0.4.2 → 0.4.4

package/lib/local/engine.js

@@ -96,8 +96,17 @@ const EFFORT_TOKEN_BUDGET = { low: 8192, medium: 16384, high: 32768 };
  * that is a multi-thousand-token reasoning pass per worker — easily past a
  * minute. Timing out there aborts a perfectly healthy autonomous turn
  * mid-flight, after the server has already run and billed every worker.
+ *
+ * 15 minutes deliberately outlasts the server's OWN ceiling for that window
+ * (aegis1 services/pool_brain.py: NEXUS_BRAIN_WORKER_TIMEOUT, default 600s),
+ * because aborting first leaves the server running and billing a fan-out
+ * nobody will ever see. Raising that env var past ~14 minutes means raising
+ * this constant too; the shared client applies the same budget from the
+ * server's X-AEGIS-Brain response header (see client/aegis.js idleBudgetFor),
+ * which is what covers a fan-out the caller did not flag — test/
+ * autonomous-mode.test.mjs pins both halves.
  */
-const AUTONOMOUS_IDLE_TIMEOUT_MS = 5 * 60_000;
+const AUTONOMOUS_IDLE_TIMEOUT_MS = 15 * 60_000;
 
 /**
  * Only ever raises a too-low budget for a DeepSeek reasoning model — never
@@ -464,6 +473,17 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
 
   async function listModels(cls) {
     if (cls === 'aegis') {
+      // The catalog is behind the account's key: GET /api/v1/models answers
+      // `401 {"error":{"message":"No API key"}}` without one (verified against
+      // aegiscloud.org). Aegis Cloud is the *default* class, so firing the call
+      // anyway painted a raw "listModels failed: … 401" over the default model
+      // picker for every user who had just installed the app and not yet
+      // pasted a key — the one state where the UI must say what unblocks it and
+      // not what went wrong. Report the missing key as a state (`needsKey`) and
+      // let the renderer invite the user to connect; nothing else about the
+      // class changes, and the model dropdown keeps its "server default (auto)"
+      // entry so the class is usable the moment a key lands.
+      if (!aegis.apiKey) return { class: cls, models: [], needsKey: true };
       const data = await aegis.listModels();
       return { class: cls, models: filterAegisCatalog(normalizeCatalog(data && data.models)) };
     }
@@ -513,6 +533,12 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
   /** One transport round for the chosen class. */
   async function dispatch(cls, opts) {
     if (cls === 'aegis') {
+      // `undefined` = "leave the model id's own default alone" (a real user
+      // turn on the pooled class: the selected Nexus id is what decides, so
+      // today's behaviour is unchanged). `false` = an explicit single provider
+      // call, for a pass that is a continuation rather than a new
+      // investigation. `true` = the autonomous fan-out.
+      const brainFlag = opts.singlePass ? false : opts.autonomous ? true : undefined;
       return aegis.chatCompletion({
         prompt: opts.prompt,
         system: opts.system,
@@ -520,7 +546,7 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         model: opts.model,
         mode: opts.mode,
         maxTokens: opts.maxTokens,
-        stream: true,
+        stream: opts.stream !== false,
         // The pooled (Nexus) brain is streamed, and an OpenAI-compatible SSE
         // stream reports no token usage unless asked. Without this the Aegis
         // Cloud class — the desktop's default — was the one class that answered
@@ -542,13 +568,30 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         extra: {
           aegis_memory: true,
           session: opts.sessionId,
-          ...(opts.autonomous ? { brain: true } : {}),
-          // Only meaningful (and only sent) alongside `brain` — aegis1
+          // The fan-out is opt-in per dispatch. `brain` is sent EXPLICITLY
+          // whenever this dispatch is not the autonomous one, because the
+          // model id this class sends (``nexus-brain``) enables the pooled
+          // brain on its own: without the flag a continuation pass — the
+          // doubled-budget retry, or the "write up what you already found"
+          // re-dispatch — silently re-ran the whole workers+1 fan-out for a
+          // pass whose documented cost is a single request. aegis1
+          // services/pool_brain.py parse_brain_request honours the opt-out.
+          ...(brainFlag === undefined ? {} : { brain: brainFlag }),
+          // An opted-out pass is also told WHICH band to run on. A single call
+          // on a brain model id infers its band from the id and lands on
+          // "fast" (the cheapest id in the pool); "brain" is the band the
+          // workers themselves run on (cheapest model that can think). Same
+          // model as the fan-out, one sample instead of four — otherwise
+          // dropping the fan-out would have quietly changed the model too.
+          ...(brainFlag === false ? { mode: 'brain' } : {}),
+          // Only meaningful (and only sent) alongside a running fan-out — aegis1
           // services/pool_brain.py parse_brain_request reads `effort`/
           // `workers` straight off the body and clamps them itself
           // (EFFORT_LEVELS / MAX_WORKERS), so no client-side validation here.
-          ...(opts.autonomous && opts.effort ? { effort: opts.effort } : {}),
-          ...(opts.autonomous && opts.workers ? { workers: opts.workers } : {}),
+          // Keyed on the effective brain flag, not on `autonomous`: an opted-out
+          // single pass carries no fan-out tuning it cannot use.
+          ...(brainFlag === true && opts.effort ? { effort: opts.effort } : {}),
+          ...(brainFlag === true && opts.workers ? { workers: opts.workers } : {}),
           // The pool forwards `tools` to the provider and returns tool_calls
           // (aegis1 app.py:7765 → provider, pool_brain synthesis keeps them).
           ...(opts.tools.length ? { tools: opts.tools } : {}),
@@ -667,6 +710,11 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         workers: payload && payload.workers,
         onReasoning,
         idleTimeoutMs: autonomous ? AUTONOMOUS_IDLE_TIMEOUT_MS : undefined,
+        // A caller with no live streaming surface (a `--no-stream` CLI flag, a
+        // one-shot script) can ask for the buffered non-stream wire form
+        // instead. Undefined/anything but `false` keeps every existing caller
+        // (the desktop renderer never sets this) on the streamed path.
+        stream: payload && payload.stream === false ? false : true,
       };
 
       // No round cap: a model that keeps calling tools keeps going for as
@@ -750,6 +798,15 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         }
         addUsage(res);
 
+        // A cancelled turn is over. Both recoveries below exist for "the model
+        // said nothing", and an aborted request resolves with exactly that —
+        // no text — so without this guard a user pressing Esc to stop a slow
+        // turn immediately issued ANOTHER billed provider call (and, because
+        // every transport concatenates the deltas it forwards, streamed the
+        // partial answer a second time onto the same bubble). Measured before
+        // the guard: one interrupted turn == two dispatches.
+        if (signal.aborted) return withTurnUsage(res);
+
         // Budget exhausted before the answer was written. Doubling it costs
         // one request and converts a dead turn into a real one; a second
         // 'length' result is accepted as-is so a hard-capped model can't
@@ -763,7 +820,16 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         // would stream it a second time onto the same bubble.
         if (!truncationRetried && !assistantText(res) && isTruncated(res)) {
           truncationRetried = true;
-          res = await dispatch(cls, { ...opts, maxTokens: doubledBudget(opts.maxTokens) });
+          // singlePass: this retry buys *budget*, not a second investigation.
+          // The fan-out's workers would re-run the whole task from scratch for
+          // it — 3 extra reasoning passes + a synthesis — which is the opposite
+          // of what "one doubled request" means (and what the note above
+          // promises). The pass itself is unchanged apart from that.
+          res = await dispatch(cls, {
+            ...opts,
+            singlePass: true,
+            maxTokens: doubledBudget(opts.maxTokens),
+          });
           addUsage(res);
         }
 
@@ -778,7 +844,19 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
           synthesisDone = true;
           foldPromptIntoHistory();
           history.push({ role: 'user', content: EMPTY_TURN_NUDGE });
-          res = await dispatch(cls, { ...opts, messages: history, prompt: '', tools: [] });
+          // singlePass: same reasoning as the truncation retry above, and it is
+          // the same comment's literal promise ("force the summary out of the
+          // context it already holds"). Escalating a write-up back into the
+          // worker fan-out asked three fresh workers to redo an investigation
+          // whose findings are already in `history`, at 4x the cost, to produce
+          // a paragraph the model had all the material for.
+          res = await dispatch(cls, {
+            ...opts,
+            singlePass: true,
+            messages: history,
+            prompt: '',
+            tools: [],
+          });
           addUsage(res);
           if (!assistantText(res)) {
             throw emptyTurnError({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -171,6 +171,11 @@ const CUSTOM_MODEL_PRESETS = {
 // already filters out of settings.list(); never render it as a provider row
 // even if a stale store still surfaces it (defect #1).
 const RESERVED_PROVIDERS = new Set(['__aegis', 'aegis']);
+// Where a user without a key gets one. The class picker defaults to Aegis Cloud
+// and the catalog is key-gated, so this is the first thing a new install needs;
+// it lives here rather than inline so the Model hint and any future "connect"
+// affordance cannot drift to two different pages.
+const GET_AEGIS_KEY_URL = 'https://aegiscloud.org';
 
 let pendingEl = null;
 let pendingSessionId = null;
@@ -1858,6 +1863,11 @@ async function loadModels(cls) {
   try {
     const data = await models.listModels(cls);
     const list = Array.isArray(data && data.models) ? data.models : [];
+    // No key on the default class: the engine reports the missing credential as
+    // a state instead of letting the catalog call 401 (see engine.listModels).
+    // The hint is where a user finds out they can connect at all — a raw
+    // "listModels failed" told them only that something was broken.
+    const needsKey = Boolean(data && data.needsKey);
     for (const m of list) {
       modelMeta.set(m.id, m);
       const opt = document.createElement('option');
@@ -1866,12 +1876,28 @@ async function loadModels(cls) {
       els.modelSelect.appendChild(opt);
     }
     let hint;
-    if (!list.length) {
+    if (needsKey) {
+      hint = null; // carries a link, built below
+    } else if (!list.length) {
       hint = cls === 'ollama' ? 'Ollama not running or no models pulled.' : 'No models listed.';
     } else {
       hint = `${list.length} model${list.length === 1 ? '' : 's'} available.`;
     }
     const ceiling = applyMaxTokensClamp(els.modelSelect.value);
+    if (needsKey) {
+      // The hint elements are bare <p>s, so the link has to be a real child
+      // node — a text assignment would wipe it (same shape as capNotice).
+      els.modelHint.textContent =
+        'Connect Aegis Cloud to load its models: paste your AEGIS API key in the Status card above (';
+      const a = document.createElement('a');
+      a.href = GET_AEGIS_KEY_URL;
+      a.target = '_blank';
+      a.rel = 'noreferrer noopener';
+      a.textContent = 'free key at aegiscloud.org';
+      els.modelHint.appendChild(a);
+      els.modelHint.appendChild(document.createTextNode('), then Save.'));
+      return;
+    }
     els.modelHint.textContent =
       ceiling < FLAT_CEILING ? `${hint} · max output: ${ceiling.toLocaleString()}` : hint;
   } catch (err) {

package/vendor/aegis.js

@@ -466,12 +466,15 @@ function createClient(opts = {}) {
     // close), reader.read() below waits forever and the whole desktop host
     // hangs with no way out but force-quit. Cap the gap between chunks —
     // not the whole response — so a slow-but-alive generation is untouched.
-    const SSE_IDLE_TIMEOUT_MS = 60_000;
-    // A pooled brain call may set its own, larger budget: the fan-out yields a
-    // header chunk and then stays silent until the FIRST worker pass returns,
-    // which is a full reasoning-model call and can outlast the 60s default.
-    const idleMs =
-      Number(idleTimeoutMs) > 0 ? Number(idleTimeoutMs) : SSE_IDLE_TIMEOUT_MS;
+    //
+    // The budget is per *response*, not per call site: a pooled brain call
+    // announces its worker fan-out in the X-AEGIS-Brain response header, and a
+    // fan-out is legitimately silent until its first worker returns. Keying the
+    // longer budget on a request the caller remembered to flag left the
+    // default Nexus turn (brain model id, checkbox off) dying at 60s — with
+    // the server already past its own fan-out deadline and every worker
+    // billed. See idleBudgetFor().
+    const idleMs = idleBudgetFor(res, idleTimeoutMs);
     async function readWithIdleTimeout() {
       let timer;
       const timeout = new Promise((_, reject) => {
@@ -752,7 +755,49 @@ function createClient(opts = {}) {
   };
 }
 
-const api = { createClient, envVar, randomUUID, DEFAULT_API_BASE, CLIENT_VERSION };
+/** Gap between SSE chunks that counts as "the stream is dead", in ms. */
+const SSE_IDLE_TIMEOUT_MS = 60_000;
+
+/**
+ * Gap allowed while a pooled brain call runs its worker fan-out, in ms.
+ *
+ * The fan-out yields a header chunk and then says nothing until its FIRST
+ * worker pass returns — and each worker is a full reasoning-model call at
+ * roughly 1/(workers+1) of the effort budget, so the silent window is minutes,
+ * not seconds. The server bounds that window itself
+ * (``services/pool_brain.py`` ``NEXUS_BRAIN_WORKER_TIMEOUT``, default 600s) and
+ * announces it per-response with the ``X-AEGIS-Brain`` header, so this budget
+ * has to outlast the *server's* deadline: aborting first kills a healthy turn
+ * the server is still running and billing.
+ *
+ * Raising the server's env var above ~14 minutes requires raising this too.
+ * desktop/lib/local/engine.js mirrors the same value for the explicit
+ * "work autonomously" path (AUTONOMOUS_IDLE_TIMEOUT_MS); the desktop test
+ * test/autonomous-mode.test.mjs fails if either drops below the server default.
+ */
+const BRAIN_IDLE_TIMEOUT_MS = 15 * 60_000;
+
+/**
+ * Idle budget for one SSE response: the caller's override when it asked for
+ * one, widened to the fan-out budget when the server says this response *is* a
+ * fan-out. The header is the authoritative signal — it is set by the same code
+ * that runs the fan-out, so a renamed brain id or a caller that forgot its
+ * flag cannot desynchronise the two. A response with no header (an older
+ * server, or a single-pass call) keeps the caller's budget or the 60s default.
+ */
+function idleBudgetFor(res, requestedMs) {
+  const base = Number(requestedMs) > 0 ? Number(requestedMs) : SSE_IDLE_TIMEOUT_MS;
+  let header = '';
+  try {
+    const get = res && res.headers && typeof res.headers.get === 'function' ? res.headers.get.bind(res.headers) : null;
+    header = (get && get('X-AEGIS-Brain')) || '';
+  } catch {
+    header = ''; // an exotic fetch shim without headers: keep the caller's budget
+  }
+  return header && String(header).trim() ? Math.max(base, BRAIN_IDLE_TIMEOUT_MS) : base;
+}
+
+const api = { createClient, envVar, randomUUID, DEFAULT_API_BASE, CLIENT_VERSION, idleBudgetFor, SSE_IDLE_TIMEOUT_MS, BRAIN_IDLE_TIMEOUT_MS };
 
 // Node / Electron (CommonJS): the MCP plugin and desktop shell require() this.
 if (typeof module !== 'undefined' && module.exports) {