aegis-desktop 0.4.3 → 0.4.5

package/lib/local/engine.js

@@ -473,6 +473,17 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
 
   async function listModels(cls) {
     if (cls === 'aegis') {
+      // The catalog is behind the account's key: GET /api/v1/models answers
+      // `401 {"error":{"message":"No API key"}}` without one (verified against
+      // aegiscloud.org). Aegis Cloud is the *default* class, so firing the call
+      // anyway painted a raw "listModels failed: … 401" over the default model
+      // picker for every user who had just installed the app and not yet
+      // pasted a key — the one state where the UI must say what unblocks it and
+      // not what went wrong. Report the missing key as a state (`needsKey`) and
+      // let the renderer invite the user to connect; nothing else about the
+      // class changes, and the model dropdown keeps its "server default (auto)"
+      // entry so the class is usable the moment a key lands.
+      if (!aegis.apiKey) return { class: cls, models: [], needsKey: true };
       const data = await aegis.listModels();
       return { class: cls, models: filterAegisCatalog(normalizeCatalog(data && data.models)) };
     }
@@ -535,7 +546,7 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         model: opts.model,
         mode: opts.mode,
         maxTokens: opts.maxTokens,
-        stream: true,
+        stream: opts.stream !== false,
         // The pooled (Nexus) brain is streamed, and an OpenAI-compatible SSE
         // stream reports no token usage unless asked. Without this the Aegis
         // Cloud class — the desktop's default — was the one class that answered
@@ -573,13 +584,18 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
           // model as the fan-out, one sample instead of four — otherwise
           // dropping the fan-out would have quietly changed the model too.
           ...(brainFlag === false ? { mode: 'brain' } : {}),
-          // Only meaningful (and only sent) alongside a running fan-out — aegis1
-          // services/pool_brain.py parse_brain_request reads `effort`/
-          // `workers` straight off the body and clamps them itself
-          // (EFFORT_LEVELS / MAX_WORKERS), so no client-side validation here.
-          // Keyed on the effective brain flag, not on `autonomous`: an opted-out
-          // single pass carries no fan-out tuning it cannot use.
-          ...(brainFlag === true && opts.effort ? { effort: opts.effort } : {}),
+          // `effort` is the budget rung, and it is sent whenever the caller has
+          // one — not only alongside a fan-out. The fan-out is triggered by the
+          // model id (this class sends ``nexus-brain``), so a caller that never
+          // ticked "work autonomously" still ran a pooled call and had no way to
+          // say how big it should be: the server fell through to its own default
+          // rung. That is how a one-word prompt came to reserve the top of the
+          // ladder. A single-pass pass carries it too — inert on that path, but
+          // it keeps the request honest about what it asked for.
+          ...(opts.effort ? { effort: opts.effort } : {}),
+          // Only meaningful with a running fan-out — aegis1 services/pool_brain.py
+          // parse_brain_request reads `workers` straight off the body and clamps
+          // it itself (MAX_WORKERS), so no client-side validation here.
           ...(brainFlag === true && opts.workers ? { workers: opts.workers } : {}),
           // The pool forwards `tools` to the provider and returns tool_calls
           // (aegis1 app.py:7765 → provider, pool_brain synthesis keeps them).
@@ -699,6 +715,11 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         workers: payload && payload.workers,
         onReasoning,
         idleTimeoutMs: autonomous ? AUTONOMOUS_IDLE_TIMEOUT_MS : undefined,
+        // A caller with no live streaming surface (a `--no-stream` CLI flag, a
+        // one-shot script) can ask for the buffered non-stream wire form
+        // instead. Undefined/anything but `false` keeps every existing caller
+        // (the desktop renderer never sets this) on the streamed path.
+        stream: payload && payload.stream === false ? false : true,
       };
 
       // No round cap: a model that keeps calling tools keeps going for as
@@ -782,6 +803,15 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         }
         addUsage(res);
 
+        // A cancelled turn is over. Both recoveries below exist for "the model
+        // said nothing", and an aborted request resolves with exactly that —
+        // no text — so without this guard a user pressing Esc to stop a slow
+        // turn immediately issued ANOTHER billed provider call (and, because
+        // every transport concatenates the deltas it forwards, streamed the
+        // partial answer a second time onto the same bubble). Measured before
+        // the guard: one interrupted turn == two dispatches.
+        if (signal.aborted) return withTurnUsage(res);
+
         // Budget exhausted before the answer was written. Doubling it costs
         // one request and converts a dead turn into a real one; a second
         // 'length' result is accepted as-is so a hard-capped model can't

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -69,7 +69,10 @@ const ELEMENT_IDS = {
   modelPreset: 'model-preset',
   modelInput: 'model-input',
   maxTokens: 'max-tokens',
+  maxTokensLabel: 'max-tokens-label',
+  maxTokensRow: 'max-tokens-row',
   maxTokensAdaptive: 'max-tokens-adaptive',
+  effortRow: 'effort-row',
   autonomousToggle: 'autonomous-toggle',
   autonomousToggleWrap: 'autonomous-toggle-wrap',
   autonomousControls: 'autonomous-controls',
@@ -171,6 +174,11 @@ const CUSTOM_MODEL_PRESETS = {
 // already filters out of settings.list(); never render it as a provider row
 // even if a stale store still surfaces it (defect #1).
 const RESERVED_PROVIDERS = new Set(['__aegis', 'aegis']);
+// Where a user without a key gets one. The class picker defaults to Aegis Cloud
+// and the catalog is key-gated, so this is the first thing a new install needs;
+// it lives here rather than inline so the Model hint and any future "connect"
+// affordance cannot drift to two different pages.
+const GET_AEGIS_KEY_URL = 'https://aegiscloud.org';
 
 let pendingEl = null;
 let pendingSessionId = null;
@@ -346,6 +354,35 @@ function updateAutonomousControlsVisibility() {
   els.autonomousControls.hidden = !(wrapVisible && autonomousEnabled());
 }
 
+/**
+ * Which budget control applies to the selected class.
+ *
+ * Aegis Cloud is sized server-side from `effort`; the other three classes take
+ * a per-call token ceiling from the dropdown. Showing both at once is what made
+ * the token cap untrustworthy on the pooled class — the dropdown was displayed,
+ * read on every send, and then raised by the server's effort ladder, so the
+ * number beside it was never the budget the call ran on. Exactly one control is
+ * on offer now, and it is the one the request actually travels with.
+ */
+function updateBudgetControls(cls) {
+  const pooled = cls === AUTONOMOUS_CLASS;
+  if (els.effortRow) els.effortRow.hidden = !pooled;
+  if (els.maxTokensRow) els.maxTokensRow.hidden = pooled;
+  if (els.maxTokensLabel) els.maxTokensLabel.hidden = pooled;
+}
+
+/**
+ * The effort to send, or undefined for the classes the server does not size
+ * from it. `auto` means "let the server infer it from the ask" — the same thing
+ * the server already does for a request that names no effort, and a deliberate
+ * choice rather than the old silent fall-through to the top rung.
+ */
+function effortFor(cls) {
+  if (cls !== AUTONOMOUS_CLASS) return undefined;
+  const value = els.autonomousEffort && els.autonomousEffort.value;
+  return value && value !== 'auto' ? value : undefined;
+}
+
 // ---------------------------------------------------------------- UI helpers
 
 function setConn(ok, text) {
@@ -1764,6 +1801,7 @@ async function loadModels(cls) {
     els.autonomousToggleWrap.hidden = cls !== AUTONOMOUS_CLASS;
   }
   updateAutonomousControlsVisibility();
+  updateBudgetControls(cls);
 
   const custom = CUSTOM_CLASSES.has(cls);
   els.modelSelect.hidden = custom;
@@ -1858,6 +1896,11 @@ async function loadModels(cls) {
   try {
     const data = await models.listModels(cls);
     const list = Array.isArray(data && data.models) ? data.models : [];
+    // No key on the default class: the engine reports the missing credential as
+    // a state instead of letting the catalog call 401 (see engine.listModels).
+    // The hint is where a user finds out they can connect at all — a raw
+    // "listModels failed" told them only that something was broken.
+    const needsKey = Boolean(data && data.needsKey);
     for (const m of list) {
       modelMeta.set(m.id, m);
       const opt = document.createElement('option');
@@ -1866,12 +1909,28 @@ async function loadModels(cls) {
       els.modelSelect.appendChild(opt);
     }
     let hint;
-    if (!list.length) {
+    if (needsKey) {
+      hint = null; // carries a link, built below
+    } else if (!list.length) {
       hint = cls === 'ollama' ? 'Ollama not running or no models pulled.' : 'No models listed.';
     } else {
       hint = `${list.length} model${list.length === 1 ? '' : 's'} available.`;
     }
     const ceiling = applyMaxTokensClamp(els.modelSelect.value);
+    if (needsKey) {
+      // The hint elements are bare <p>s, so the link has to be a real child
+      // node — a text assignment would wipe it (same shape as capNotice).
+      els.modelHint.textContent =
+        'Connect Aegis Cloud to load its models: paste your AEGIS API key in the Status card above (';
+      const a = document.createElement('a');
+      a.href = GET_AEGIS_KEY_URL;
+      a.target = '_blank';
+      a.rel = 'noreferrer noopener';
+      a.textContent = 'free key at aegiscloud.org';
+      els.modelHint.appendChild(a);
+      els.modelHint.appendChild(document.createTextNode('), then Save.'));
+      return;
+    }
     els.modelHint.textContent =
       ceiling < FLAT_CEILING ? `${hint} · max output: ${ceiling.toLocaleString()}` : hint;
   } catch (err) {
@@ -2248,12 +2307,21 @@ async function send() {
   addMessage('user', prompt);
 
   const ceiling = applyMaxTokensClamp(model);
-  const maxTokens = maxTokensAdaptive() ? ceiling : parseInt(els.maxTokens.value, 10) || 4096;
+  // Aegis Cloud takes no token cap from here at all: the server sizes the call
+  // from `effort`, and a number in this position is a per-pass ceiling *over*
+  // that ladder (aegis1 services/pool_brain.py pass_budgets). Sending the
+  // dropdown's value anyway is what made "Max tokens: 4k" beside a turn a
+  // figure the turn never ran on. The row is hidden for this class as well, so
+  // the two controls can never disagree.
+  const maxTokens = cls === AUTONOMOUS_CLASS
+    ? undefined
+    : maxTokensAdaptive() ? ceiling : parseInt(els.maxTokens.value, 10) || 4096;
   const autonomous = cls === AUTONOMOUS_CLASS && autonomousEnabled();
-  // Only meaningful (and only sent) alongside `autonomous` — see
-  // aegis1 services/pool_brain.py parse_brain_request for the effort/workers
-  // clamping this feeds.
-  const effort = autonomous ? els.autonomousEffort.value : undefined;
+  // Sent for the pooled class whether or not the fan-out is ticked: the fan-out
+  // is enabled by the model id this class sends, so a turn that never entered
+  // autonomous mode still ran pooled and had no way to say how big it should
+  // be. `undefined` = "auto" = the server infers it from the ask.
+  const effort = effortFor(cls);
   const workers = autonomous ? parseInt(els.autonomousWorkers.value, 10) || undefined : undefined;
   // Reuse the open thread's session id (minted once, on its first message)
   // instead of a fresh one per send — a new id every turn is what made both
@@ -2352,7 +2420,11 @@ async function send() {
     if (data && data.model) bits.push(`model: ${data.model}`);
     else if (model) bits.push(`model: ${model}`);
     bits.push(classLabel(cls));
-    if (autonomous) bits.push(`autonomous (${effort}, ${workers || 3}w)`);
+    if (autonomous) bits.push(`autonomous (${effort || 'auto'}, ${workers || 'auto'}w)`);
+    // The budget rung is worth showing even without the fan-out: on the pooled
+    // class it is what sized the call, and a user cannot tell a 16k turn from a
+    // 64k one by looking at the answer.
+    else if (effort) bits.push(`effort: ${effort}`);
     const turnTokens = usageTokens(data && data.usage);
     if (turnTokens != null) bits.push(`tokens: ${turnTokens}`);
     addMessage('assistant', text, bits.join(' · ') || undefined, sessionId, toolLog);
@@ -2433,14 +2505,23 @@ async function init() {
     updateAutonomousControlsVisibility();
   });
 
-  // Effort/worker count for the pool_brain fan-out (aegis1
-  // services/pool_brain.py parse_brain_request reads `effort`/`workers` off
-  // the request body) — opt-in per machine, remembered across restarts.
+  // Budget control for the pooled class: which rung of the server's effort
+  // ladder sizes the call, or "auto" to let the server infer it from the ask
+  // (aegis1 services/pool_brain.py parse_brain_request). Opt-in per machine,
+  // remembered across restarts; a stored value from a build whose list was
+  // short (low/medium/high, no "auto") falls through to the markup's default
+  // rather than assigning an option that no longer exists.
   const savedEffort = localStorage.getItem(AUTONOMOUS_EFFORT_KEY);
-  if (savedEffort) els.autonomousEffort.value = savedEffort;
+  if (savedEffort && Array.from(els.autonomousEffort.options).some((o) => o.value === savedEffort)) {
+    els.autonomousEffort.value = savedEffort;
+  }
   els.autonomousEffort.addEventListener('change', () => {
     localStorage.setItem(AUTONOMOUS_EFFORT_KEY, els.autonomousEffort.value);
   });
+  // Worker count for the fan-out. Left empty by default on purpose: an empty
+  // field is what tells the server to size the fan-out from the ask
+  // (parse_brain_request's auto path) instead of the old client-side default of
+  // 3, which made every turn a 4-pass fan-out.
   const savedWorkers = localStorage.getItem(AUTONOMOUS_WORKERS_KEY);
   if (savedWorkers) els.autonomousWorkers.value = savedWorkers;
   els.autonomousWorkers.addEventListener('change', () => {
@@ -2458,6 +2539,11 @@ async function init() {
 
   els.classSelect.addEventListener('change', () => {
     localStorage.setItem(CLASS_KEY, els.classSelect.value);
+    // Apply the budget-control choice immediately rather than waiting for the
+    // model list: loadModels() is async, and until it resolves the previous
+    // class's control would still be on screen — showing a token cap on a
+    // pooled turn, or hiding the effort rung it runs on.
+    updateBudgetControls(els.classSelect.value);
     loadModels(els.classSelect.value);
   });
 

package/renderer/index.html

@@ -76,8 +76,8 @@
           hidden
         />
 
-        <label for="max-tokens">Max tokens</label>
-        <div class="max-tokens-row">
+        <label for="max-tokens" id="max-tokens-label">Max tokens</label>
+        <div class="max-tokens-row" id="max-tokens-row">
           <select id="max-tokens">
             <option value="1024">1k</option>
             <option value="4096" selected>4k</option>
@@ -95,6 +95,23 @@
           </label>
         </div>
 
+        <!-- The pooled AEGIS Cloud class sizes a request's token budget
+             server-side from this ladder (effort -> low/medium/high ->
+             16384/32768/65536 total across the fan-out), so the max-tokens row
+             above is hidden for that class instead of being shown and silently
+             overridden: the server treats a body max_tokens as a ceiling, and
+             an effort rung as the budget. Shown for Ollama and custom
+             endpoints, where a per-call ceiling is the only control there is. -->
+        <div class="max-tokens-row" id="effort-row" hidden>
+          <label for="autonomous-effort">Effort</label>
+          <select id="autonomous-effort">
+            <option value="low">low</option>
+            <option value="medium">medium</option>
+            <option value="high">high</option>
+            <option value="auto" selected>auto</option>
+          </select>
+        </div>
+
         <label
           class="flow-toggle"
           for="autonomous-toggle"
@@ -106,14 +123,8 @@
           <span>work autonomously</span>
         </label>
         <div id="autonomous-controls" class="autonomous-controls" hidden>
-          <label for="autonomous-effort">Effort</label>
-          <select id="autonomous-effort">
-            <option value="low">low</option>
-            <option value="medium">medium</option>
-            <option value="high" selected>high</option>
-          </select>
           <label for="autonomous-workers">Workers</label>
-          <input type="number" id="autonomous-workers" min="1" max="8" step="1" value="3" />
+          <input type="number" id="autonomous-workers" min="1" max="8" step="1" />
         </div>
         <p class="hint" id="model-hint"></p>
       </section>

package/renderer/style.css

@@ -1142,6 +1142,17 @@ body.memory-open {
   display: none;
 }
 
+/* Same trap, one row up: `.max-tokens-row` is display: flex, so the `hidden`
+   attribute did nothing on `#max-tokens-row`/`#effort-row` — which is how the
+   budget-control swap (effort for the pooled class, a token ceiling for the
+   others) would have shown BOTH controls at once, the exact state it exists to
+   prevent. `display: none` is also what lets a `<label>` be hidden, since
+   labels are inline by default and carry no author display rule. */
+.max-tokens-row[hidden],
+label[hidden] {
+  display: none;
+}
+
 .autonomous-controls {
   display: flex;
   align-items: center;

package/vendor/aegis.js

@@ -278,6 +278,13 @@ function createClient(opts = {}) {
    *                 so a reasoning-only stream still counts as unanswered.
    *   - `idleTimeoutMs`  override the stalled-stream watchdog for this call
    *                 (a worker fan-out is legitimately silent between passes)
+   *   - `maxTokens`  output ceiling. Omitted from the body when absent so the
+   *                 server's own budget applies — on a pooled request that is
+   *                 the `effort` ladder, and a number sent from here caps it.
+   *   - `effort` / `workers`  pooled-brain budget rung and fan-out size.
+   *                 Forwarded only inside `extra`, as the server reads them off
+   *                 the body (aegis1 services/pool_brain.py parse_brain_request)
+   *                 and sizes the budget from them.
    */
   async function chatCompletion({
     prompt,
@@ -298,9 +305,17 @@ function createClient(opts = {}) {
     // model the server picks its default (no client-invented tier id). `mode`
     // is a legacy server-side shorthand — forwarded verbatim only when the
     // caller supplies it, never defaulted, never built into a model id.
+    //
+    // `max_tokens` is omitted entirely when the caller states none, rather than
+    // defaulted here. The server has its own budget ladder (`mode`/`effort` on
+    // the pooled path) and treats a body max_tokens as a *ceiling* over it, so
+    // an invented 4096 was not a harmless default: it capped every pass of a
+    // pooled-brain fan-out at 4096 and overrode the ladder the caller's effort
+    // selected. Omitting it is the documented way to say "server default" (see
+    // mcp/tools.js's max_tokens description).
     const body = {
       messages: buildMessages(messages, system, prompt),
-      max_tokens: maxTokens || 4096,
+      ...(maxTokens ? { max_tokens: maxTokens } : {}),
       ...(extra || {}),
     };
     if (model) body.model = model;