aegis-desktop 0.4.4 → 0.5.0

package/lib/local/engine.js

@@ -584,13 +584,18 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
           // model as the fan-out, one sample instead of four — otherwise
           // dropping the fan-out would have quietly changed the model too.
           ...(brainFlag === false ? { mode: 'brain' } : {}),
-          // Only meaningful (and only sent) alongside a running fan-out — aegis1
-          // services/pool_brain.py parse_brain_request reads `effort`/
-          // `workers` straight off the body and clamps them itself
-          // (EFFORT_LEVELS / MAX_WORKERS), so no client-side validation here.
-          // Keyed on the effective brain flag, not on `autonomous`: an opted-out
-          // single pass carries no fan-out tuning it cannot use.
-          ...(brainFlag === true && opts.effort ? { effort: opts.effort } : {}),
+          // `effort` is the budget rung, and it is sent whenever the caller has
+          // one — not only alongside a fan-out. The fan-out is triggered by the
+          // model id (this class sends ``nexus-brain``), so a caller that never
+          // ticked "work autonomously" still ran a pooled call and had no way to
+          // say how big it should be: the server fell through to its own default
+          // rung. That is how a one-word prompt came to reserve the top of the
+          // ladder. A single-pass pass carries it too — inert on that path, but
+          // it keeps the request honest about what it asked for.
+          ...(opts.effort ? { effort: opts.effort } : {}),
+          // Only meaningful with a running fan-out — aegis1 services/pool_brain.py
+          // parse_brain_request reads `workers` straight off the body and clamps
+          // it itself (MAX_WORKERS), so no client-side validation here.
           ...(brainFlag === true && opts.workers ? { workers: opts.workers } : {}),
           // The pool forwards `tools` to the provider and returns tool_calls
           // (aegis1 app.py:7765 → provider, pool_brain synthesis keeps them).

package/lib/settings.js

@@ -186,11 +186,25 @@ function createSettingsStore({ dir, safeStorage } = {}) {
     return decrypt(cfg.key);
   }
 
+  /**
+   * When this host last wrote its own AEGIS key (ISO string, or null).
+   *
+   * The shared credential file records the same thing, and startup compares the
+   * two so the most recently saved key wins. Without a stamp the app cannot tell
+   * "I saved this last week" from "the user ran `aegiscode login` a minute ago
+   * with a rotated key", and would silently keep presenting the stale one.
+   */
+  function aegisKeySavedAt() {
+    const cfg = load()[AEGIS_KEY_NAMESPACE] || {};
+    return cfg.savedAt || null;
+  }
+
   function setAegisKey(key) {
     const data = load();
     data[AEGIS_KEY_NAMESPACE] = {
       ...(data[AEGIS_KEY_NAMESPACE] || {}),
       key: key ? encrypt(key) : null,
+      savedAt: key ? new Date().toISOString() : null,
     };
     save(data);
     return aegisKey();
@@ -278,6 +292,7 @@ function createSettingsStore({ dir, safeStorage } = {}) {
     maskKey,
     aegisKey,
     aegisRawKey,
+    aegisKeySavedAt,
     setAegisKey,
     migrateLegacyAegisKey,
     quickLauncherConfig,

package/lib/sync/sessions.js

@@ -1,219 +1,93 @@
 'use strict';
 
 /**
- * sessions.js — local conversation persistence (plan P1 §5.1 / P3 §7).
- * Every session (any model class) persists to <dir>/sessions.json on each
- * message with a crash-safe temp-file rename. Pure Node + injectable dir,
- * so it unit-tests without Electron.
+ * sessions.js — the desktop's session store, now a thin binding over the
+ * SHARED store in `client/session-store.js`.
+ *
+ * This file used to be the implementation. It was the desktop's private
+ * `sessions.json`, while the terminal host kept `~/.aegiscode/history.jsonl`
+ * and the MCP plugin could see neither — three hosts, one account, three
+ * disjoint views of the conversation. The implementation now lives in
+ * `client/session-store.js`, which is the tree all three hosts already bundle,
+ * and every call here forwards to it.
+ *
+ * Two things that matter are deliberately unchanged:
+ *
+ *   * the public API and its argument order (`(dir, …)` first) — `main.js`, the
+ *     sync dispatch and `test/sync-sessions.test.mjs` call it by those names;
+ *   * the record shape — `pending`, `seq`, `updatedAt`, `remoteId`,
+ *     `lastSyncedAt`, `__seq` all keep their meaning, because cloud sync and
+ *     the renderer's session list read them.
+ *
+ * The only real change is *where* `dir` points: main.js now passes the shared
+ * data dir (see `resolveStoreDir`), so a session typed in the terminal appears
+ * in the desktop's list without a network round trip.
+ *
+ * Resolution mirrors main.js's own pattern for the shared client: `client/` in
+ * a source checkout, `vendor/` in the packaged app (electron-builder cannot
+ * reach outside the app dir, so predist.mjs stages the file).
  */
 
-const fs = require('node:fs');
-const path = require('node:path');
-
-function sessionsFile(dir) {
-  return path.join(dir, 'sessions.json');
-}
-
-function load(dir) {
+const shared = (() => {
   try {
-    return JSON.parse(fs.readFileSync(sessionsFile(dir), 'utf8')) || {};
+    return require('../../../client/session-store.js');
   } catch {
-    return {};
+    return require('../../vendor/session-store.js');
   }
-}
-
-/**
- * Monotonic write counter stored in the file's `__seq` field. Every mutation
- * bumps it, so sessions written in the same millisecond still order
- * deterministically (listSessions sorts by updatedAt, then by seq).
- */
-function nextSeq(sessions) {
-  const seq = (typeof sessions.__seq === 'number' ? sessions.__seq : 0) + 1;
-  sessions.__seq = seq;
-  return seq;
-}
+})();
 
-/**
- * Normalize a remote `updated_at`/`updatedAt` to epoch milliseconds. The cloud
- * returns an ISO-8601 string (e.g. "2026-07-16T14:20:00"); the local store
- * uses `Date.now()` epoch-ms numbers. Comparing the two directly coerces the
- * string to NaN, which breaks last-write-wins ordering. ISO strings are
- * parsed; epoch-ms numbers pass through; anything else becomes 0.
- */
-function toEpochMs(value) {
-  if (typeof value === 'number' && Number.isFinite(value)) return value;
-  if (typeof value === 'string' && value.trim()) {
-    const ms = Date.parse(value);
-    if (Number.isFinite(ms)) return ms;
+const credentials = (() => {
+  try {
+    return require('../../../client/credentials.js');
+  } catch {
+    return require('../../vendor/credentials.js');
   }
-  return 0;
-}
-
-function atomicWrite(file, data) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const tmp = `${file}.tmp-${process.pid}`;
-  fs.writeFileSync(tmp, JSON.stringify(data, null, 2));
-  fs.renameSync(tmp, file);
-}
-
-function save(dir, sessions) {
-  atomicWrite(sessionsFile(dir), sessions);
-}
-
-/**
- * Create or merge a full session record. Any local write (`upsertSession` /
- * `appendMessage`) marks the session `pending: true` — it has local content
- * the cloud hasn't seen yet. Only `markSynced()` clears the flag, so a push
- * that fails (offline/no key) never silently drops the session from the
- * retry queue.
- */
-function upsertSession(dir, session) {
-  const id = session && session.id;
-  if (!id) throw new Error('session.id is required');
-  const sessions = load(dir);
-  const prev = sessions[id] || { messages: [] };
-  sessions[id] = { ...prev, ...session, id, pending: true };
-  if (!sessions[id].updatedAt) sessions[id].updatedAt = Date.now();
-  sessions[id].seq = nextSeq(sessions);
-  save(dir, sessions);
-  return sessions[id];
-}
-
-/** Append one message to a session (crash-safe). */
-function appendMessage(dir, sessionId, message) {
-  if (!sessionId) throw new Error('sessionId is required');
-  const sessions = load(dir);
-  const session = sessions[sessionId] || { id: sessionId, messages: [] };
-  const messages = Array.isArray(session.messages) ? session.messages : [];
-  session.messages = messages.concat(message);
-  session.updatedAt = Date.now();
-  session.pending = true;
-  session.seq = nextSeq(sessions);
-  sessions[sessionId] = session;
-  save(dir, sessions);
-  return session;
-}
-
-function listSessions(dir) {
-  const sessions = load(dir);
-  return Object.values(sessions)
-    .filter((s) => s && s.id)
-    .sort(
-      (a, b) =>
-        (b.updatedAt || 0) - (a.updatedAt || 0) ||
-        (b.seq || 0) - (a.seq || 0)
-    );
-}
-
-function getSession(dir, id) {
-  return load(dir)[id] || null;
-}
-
-function deleteSession(dir, id) {
-  const sessions = load(dir);
-  delete sessions[id];
-  save(dir, sessions);
-  return { ok: true };
-}
-
-/** Clear the pending flag after a successful cloud push. `remote.remoteId`,
- *  when the server assigns its own conversation id, is stashed alongside. */
-function markSynced(dir, id, remote) {
-  const sessions = load(dir);
-  const session = sessions[id];
-  if (!session) return null;
-  session.pending = false;
-  session.lastSyncedAt = Date.now();
-  if (remote && remote.remoteId) session.remoteId = remote.remoteId;
-  session.seq = nextSeq(sessions);
-  sessions[id] = session;
-  save(dir, sessions);
-  return session;
-}
-
-/** Force a session back into the retry queue (e.g. a push that partially failed). */
-function markPending(dir, id) {
-  const sessions = load(dir);
-  const session = sessions[id];
-  if (!session) return null;
-  session.pending = true;
-  session.seq = nextSeq(sessions);
-  sessions[id] = session;
-  save(dir, sessions);
-  return session;
-}
-
-/** Sessions with local content the cloud hasn't confirmed yet (including
- *  sessions predating this field, which default to pending). */
-function listPending(dir) {
-  return listSessions(dir).filter((s) => s.pending !== false);
-}
+})();
 
 /**
- * Merge remote conversation-sync records into the local store (pull half of
- * sync). Last-write-wins by `updatedAt`, but a local session with unsynced
- * edits (`pending`) always wins over the remote copy — it will overwrite the
- * remote copy on the next push instead.
+ * The directory the shared store lives in: `$AEGISCODE_HOME` or `~/.aegiscode`.
+ * `legacyDir` (Electron's userData) is only used to adopt a pre-unification
+ * store, never to read sessions from afterwards.
  */
-function mergeRemoteSessions(dir, remoteSessions) {
-  const list = Array.isArray(remoteSessions) ? remoteSessions : [];
-  const sessions = load(dir);
-  let merged = 0;
-  for (const remote of list) {
-    const id = remote && (remote.session_id || remote.id);
-    if (!id) continue;
-    const local = sessions[id];
-    const remoteUpdatedAt = toEpochMs(remote.updated_at ?? remote.updatedAt);
-    if (local && (local.pending || (local.updatedAt || 0) >= remoteUpdatedAt)) {
-      continue;
-    }
-    sessions[id] = {
-      id,
-      title: remote.title || (local && local.title) || '',
-      messages: Array.isArray(remote.messages) ? remote.messages : [],
-      updatedAt: remoteUpdatedAt || Date.now(),
-      pending: false,
-      lastSyncedAt: Date.now(),
-      remoteId: remote.session_id || remote.id,
-    };
-    sessions[id].seq = nextSeq(sessions);
-    merged += 1;
-  }
-  if (merged) save(dir, sessions);
-  return merged;
+function resolveStoreDir(legacyDir) {
+  const dir = credentials.aegisHome();
+  if (legacyDir && legacyDir !== dir) adopt(dir, legacyDir);
+  return dir;
 }
 
-/**
- * Markdown export (session export, plan: Save as.../Export session). Each
- * message becomes a `## Role` heading followed by its content verbatim —
- * content is never re-escaped or re-wrapped, so any code fences a message
- * already contains (assistant replies routinely have them) survive untouched
- * instead of being nested inside an outer fence.
- */
-function toMarkdown(session) {
-  const title = (session && (session.title || session.id)) || 'session';
-  const messages = (session && Array.isArray(session.messages)) ? session.messages : [];
-  const lines = [`# ${title}`, ''];
-  for (const message of messages) {
-    const role = (message && message.role) || 'unknown';
-    const heading = role.charAt(0).toUpperCase() + role.slice(1);
-    const content = (message && (message.content || message.text)) || '';
-    lines.push(`## ${heading}`, '', content, '');
-  }
-  return lines.join('\n');
-}
+const {
+  storeFile,
+  load,
+  save,
+  upsertSession,
+  appendMessage,
+  recordExchange,
+  listSessions,
+  getSession,
+  deleteSession,
+  markSynced,
+  markPending,
+  listPending,
+  mergeRemoteSessions,
+  listSummaries,
+  readTranscript,
+  adopt,
+  toMarkdown,
+  toJson,
+} = shared;
 
-/** JSON export: the session record as stored, pretty-printed. */
-function toJson(session) {
-  return JSON.stringify(session, null, 2);
-}
+/** Kept under its old name — main.js and the tests call `sessionsFile`. */
+const sessionsFile = storeFile;
 
 module.exports = {
   sessionsFile,
+  storeFile,
+  resolveStoreDir,
   load,
   save,
   upsertSession,
   appendMessage,
+  recordExchange,
   listSessions,
   getSession,
   deleteSession,
@@ -221,6 +95,9 @@ module.exports = {
   markPending,
   listPending,
   mergeRemoteSessions,
+  listSummaries,
+  readTranscript,
+  adopt,
   toMarkdown,
   toJson,
 };

package/main.js

@@ -36,6 +36,17 @@ try {
 }
 const { createClient } = sharedClient;
 
+// The shared credential store (`client/credentials.js`) — the same 0600 file
+// the terminal host writes with `aegiscode login` and the MCP plugin reads. The
+// app resolves its own account key through it, so signing in once serves all
+// three hosts; see resolveStartupKey() and persistApiKey() below.
+let credentials;
+try {
+  credentials = require('../client/credentials.js');
+} catch {
+  credentials = require('./vendor/credentials.js');
+}
+
 let electron = null;
 try {
   // In plain Node (CI smoke test, `node --check`) this either throws
@@ -666,14 +677,24 @@ function resolveUserDataDir(app) {
  * Wire the real LocalEngine registry: settings store + ollama/providers
  * transports + the shared cloud client. Transport-only — no brain logic.
  */
-function createEngine(aegis, { app, safeStorage, dir: dirOverride } = {}) {
-  const dir = dirOverride || resolveUserDataDir(app);
-  const settings = createSettingsStore({ dir, safeStorage });
+function createEngine(aegis, { app, safeStorage, dir: dirOverride, sessionsDir: sessionsOverride } = {}) {
+  // Settings (the safeStorage-encrypted key, window state, provider entries)
+  // stay in Electron's userData: they are this host's own, and the key is only
+  // readable by this process.
+  const settingsDir = dirOverride || resolveUserDataDir(app);
+  const settings = createSettingsStore({ dir: settingsDir, safeStorage });
   // Relocate a pre-fix `settings['aegis']` key into the reserved namespace so
   // it stops showing up as a provider. Ciphertext-level, so safe pre-'ready'.
   settings.migrateLegacyAegisKey();
   const engine = createLocalEngine({ aegis, settings, ollama, providers });
-  return { engine, sessionsDir: dir, settings };
+  // Sessions/memory live in the SHARED data dir ($AEGISCODE_HOME or
+  // ~/.aegiscode) — the same file the terminal host and the MCP plugin read —
+  // so a thread started in either shows up in the other without cloud sync and
+  // without a key. resolveStoreDir() also adopts a pre-unification
+  // userData/sessions.json, once, when the shared store is still empty, so an
+  // upgrade does not look like every conversation was deleted.
+  const sessionsDir = sessionsOverride || sessionStore.resolveStoreDir(settingsDir);
+  return { engine, sessionsDir, settingsDir, settings };
 }
 
 /**
@@ -1233,7 +1254,7 @@ function bootstrap() {
     else pendingDeepLink = parsed;
   });
 
-  const aegis = createClient();
+  const aegis = createClient(credentials.clientOptions());
   const dataDir = resolveUserDataDir(app);
 
   // One settings store backs both the provider settings surface and the AEGIS
@@ -1248,7 +1269,17 @@ function bootstrap() {
   // Persist the in-app AEGIS key in its own reserved namespace, encrypted —
   // never as a provider named 'aegis' (that coupling let the Settings pane's
   // "Remove" delete the AEGIS key; defect #1).
-  const persistApiKey = (key) => settings.setAegisKey(key);
+  //
+  // Mirrored into the shared 0600 store as well, so one sign-in covers this app,
+  // `aegiscode` and the MCP plugin instead of each host needing its own. The
+  // app's copy stays the encrypted one; resolveStartupKey() compares their
+  // `savedAt` stamps so whichever host wrote last is the key in force.
+  const persistApiKey = (key) => {
+    const result = settings.setAegisKey(key);
+    if (key) credentials.saveApiKey(key);
+    else credentials.clearApiKey();
+    return result;
+  };
 
   // Native "reply ready" notification: main.js is exactly where every
   // chatCompletion/model:chat call already resolves (withReplyNotify above),
@@ -1565,8 +1596,19 @@ function bootstrap() {
     // Hydrate the client from the persisted key BEFORE the renderer issues any
     // status/model call, so class/model dropdowns populate immediately when a
     // key was saved in-app (safeStorage is usable only after app ready).
-    const persistedKey = settings.aegisRawKey();
-    if (persistedKey) aegis.setApiKey(persistedKey);
+    //
+    // `$AEGIS_API_KEY` still outranks both stores: createClient() already read
+    // it, and nothing here may shadow an explicit export.
+    const envKey = credentials.normalizeApiKey(process.env[credentials.KEY_ENV]);
+    if (!envKey) {
+      const chosen = credentials.preferNewest(settings.aegisRawKey(), settings.aegisKeySavedAt());
+      if (chosen.key) {
+        aegis.setApiKey(chosen.key);
+        // The shared store is the newer write: bring this host's encrypted copy
+        // up to date so a CLI rotation does not have to be redone in Settings.
+        if (chosen.source === 'shared') settings.setAegisKey(chosen.key);
+      }
+    }
     // Apply whatever was last saved (or the default): ship the shortcut only
     // when app.isPackaged || the settings flag is on — see
     // shouldEnableGlobalShortcut — so a plain `electron .` dev run never

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -69,7 +69,10 @@ const ELEMENT_IDS = {
   modelPreset: 'model-preset',
   modelInput: 'model-input',
   maxTokens: 'max-tokens',
+  maxTokensLabel: 'max-tokens-label',
+  maxTokensRow: 'max-tokens-row',
   maxTokensAdaptive: 'max-tokens-adaptive',
+  effortRow: 'effort-row',
   autonomousToggle: 'autonomous-toggle',
   autonomousToggleWrap: 'autonomous-toggle-wrap',
   autonomousControls: 'autonomous-controls',
@@ -351,6 +354,35 @@ function updateAutonomousControlsVisibility() {
   els.autonomousControls.hidden = !(wrapVisible && autonomousEnabled());
 }
 
+/**
+ * Which budget control applies to the selected class.
+ *
+ * Aegis Cloud is sized server-side from `effort`; the other three classes take
+ * a per-call token ceiling from the dropdown. Showing both at once is what made
+ * the token cap untrustworthy on the pooled class — the dropdown was displayed,
+ * read on every send, and then raised by the server's effort ladder, so the
+ * number beside it was never the budget the call ran on. Exactly one control is
+ * on offer now, and it is the one the request actually travels with.
+ */
+function updateBudgetControls(cls) {
+  const pooled = cls === AUTONOMOUS_CLASS;
+  if (els.effortRow) els.effortRow.hidden = !pooled;
+  if (els.maxTokensRow) els.maxTokensRow.hidden = pooled;
+  if (els.maxTokensLabel) els.maxTokensLabel.hidden = pooled;
+}
+
+/**
+ * The effort to send, or undefined for the classes the server does not size
+ * from it. `auto` means "let the server infer it from the ask" — the same thing
+ * the server already does for a request that names no effort, and a deliberate
+ * choice rather than the old silent fall-through to the top rung.
+ */
+function effortFor(cls) {
+  if (cls !== AUTONOMOUS_CLASS) return undefined;
+  const value = els.autonomousEffort && els.autonomousEffort.value;
+  return value && value !== 'auto' ? value : undefined;
+}
+
 // ---------------------------------------------------------------- UI helpers
 
 function setConn(ok, text) {
@@ -1769,6 +1801,7 @@ async function loadModels(cls) {
     els.autonomousToggleWrap.hidden = cls !== AUTONOMOUS_CLASS;
   }
   updateAutonomousControlsVisibility();
+  updateBudgetControls(cls);
 
   const custom = CUSTOM_CLASSES.has(cls);
   els.modelSelect.hidden = custom;
@@ -2274,12 +2307,21 @@ async function send() {
   addMessage('user', prompt);
 
   const ceiling = applyMaxTokensClamp(model);
-  const maxTokens = maxTokensAdaptive() ? ceiling : parseInt(els.maxTokens.value, 10) || 4096;
+  // Aegis Cloud takes no token cap from here at all: the server sizes the call
+  // from `effort`, and a number in this position is a per-pass ceiling *over*
+  // that ladder (aegis1 services/pool_brain.py pass_budgets). Sending the
+  // dropdown's value anyway is what made "Max tokens: 4k" beside a turn a
+  // figure the turn never ran on. The row is hidden for this class as well, so
+  // the two controls can never disagree.
+  const maxTokens = cls === AUTONOMOUS_CLASS
+    ? undefined
+    : maxTokensAdaptive() ? ceiling : parseInt(els.maxTokens.value, 10) || 4096;
   const autonomous = cls === AUTONOMOUS_CLASS && autonomousEnabled();
-  // Only meaningful (and only sent) alongside `autonomous` — see
-  // aegis1 services/pool_brain.py parse_brain_request for the effort/workers
-  // clamping this feeds.
-  const effort = autonomous ? els.autonomousEffort.value : undefined;
+  // Sent for the pooled class whether or not the fan-out is ticked: the fan-out
+  // is enabled by the model id this class sends, so a turn that never entered
+  // autonomous mode still ran pooled and had no way to say how big it should
+  // be. `undefined` = "auto" = the server infers it from the ask.
+  const effort = effortFor(cls);
   const workers = autonomous ? parseInt(els.autonomousWorkers.value, 10) || undefined : undefined;
   // Reuse the open thread's session id (minted once, on its first message)
   // instead of a fresh one per send — a new id every turn is what made both
@@ -2378,7 +2420,11 @@ async function send() {
     if (data && data.model) bits.push(`model: ${data.model}`);
     else if (model) bits.push(`model: ${model}`);
     bits.push(classLabel(cls));
-    if (autonomous) bits.push(`autonomous (${effort}, ${workers || 3}w)`);
+    if (autonomous) bits.push(`autonomous (${effort || 'auto'}, ${workers || 'auto'}w)`);
+    // The budget rung is worth showing even without the fan-out: on the pooled
+    // class it is what sized the call, and a user cannot tell a 16k turn from a
+    // 64k one by looking at the answer.
+    else if (effort) bits.push(`effort: ${effort}`);
     const turnTokens = usageTokens(data && data.usage);
     if (turnTokens != null) bits.push(`tokens: ${turnTokens}`);
     addMessage('assistant', text, bits.join(' · ') || undefined, sessionId, toolLog);
@@ -2459,14 +2505,23 @@ async function init() {
     updateAutonomousControlsVisibility();
   });
 
-  // Effort/worker count for the pool_brain fan-out (aegis1
-  // services/pool_brain.py parse_brain_request reads `effort`/`workers` off
-  // the request body) — opt-in per machine, remembered across restarts.
+  // Budget control for the pooled class: which rung of the server's effort
+  // ladder sizes the call, or "auto" to let the server infer it from the ask
+  // (aegis1 services/pool_brain.py parse_brain_request). Opt-in per machine,
+  // remembered across restarts; a stored value from a build whose list was
+  // short (low/medium/high, no "auto") falls through to the markup's default
+  // rather than assigning an option that no longer exists.
   const savedEffort = localStorage.getItem(AUTONOMOUS_EFFORT_KEY);
-  if (savedEffort) els.autonomousEffort.value = savedEffort;
+  if (savedEffort && Array.from(els.autonomousEffort.options).some((o) => o.value === savedEffort)) {
+    els.autonomousEffort.value = savedEffort;
+  }
   els.autonomousEffort.addEventListener('change', () => {
     localStorage.setItem(AUTONOMOUS_EFFORT_KEY, els.autonomousEffort.value);
   });
+  // Worker count for the fan-out. Left empty by default on purpose: an empty
+  // field is what tells the server to size the fan-out from the ask
+  // (parse_brain_request's auto path) instead of the old client-side default of
+  // 3, which made every turn a 4-pass fan-out.
   const savedWorkers = localStorage.getItem(AUTONOMOUS_WORKERS_KEY);
   if (savedWorkers) els.autonomousWorkers.value = savedWorkers;
   els.autonomousWorkers.addEventListener('change', () => {
@@ -2484,6 +2539,11 @@ async function init() {
 
   els.classSelect.addEventListener('change', () => {
     localStorage.setItem(CLASS_KEY, els.classSelect.value);
+    // Apply the budget-control choice immediately rather than waiting for the
+    // model list: loadModels() is async, and until it resolves the previous
+    // class's control would still be on screen — showing a token cap on a
+    // pooled turn, or hiding the effort rung it runs on.
+    updateBudgetControls(els.classSelect.value);
     loadModels(els.classSelect.value);
   });
 

package/renderer/index.html

@@ -76,8 +76,8 @@
           hidden
         />
 
-        <label for="max-tokens">Max tokens</label>
-        <div class="max-tokens-row">
+        <label for="max-tokens" id="max-tokens-label">Max tokens</label>
+        <div class="max-tokens-row" id="max-tokens-row">
           <select id="max-tokens">
             <option value="1024">1k</option>
             <option value="4096" selected>4k</option>
@@ -95,6 +95,23 @@
           </label>
         </div>
 
+        <!-- The pooled AEGIS Cloud class sizes a request's token budget
+             server-side from this ladder (effort -> low/medium/high ->
+             16384/32768/65536 total across the fan-out), so the max-tokens row
+             above is hidden for that class instead of being shown and silently
+             overridden: the server treats a body max_tokens as a ceiling, and
+             an effort rung as the budget. Shown for Ollama and custom
+             endpoints, where a per-call ceiling is the only control there is. -->
+        <div class="max-tokens-row" id="effort-row" hidden>
+          <label for="autonomous-effort">Effort</label>
+          <select id="autonomous-effort">
+            <option value="low">low</option>
+            <option value="medium">medium</option>
+            <option value="high">high</option>
+            <option value="auto" selected>auto</option>
+          </select>
+        </div>
+
         <label
           class="flow-toggle"
           for="autonomous-toggle"
@@ -106,14 +123,8 @@
           <span>work autonomously</span>
         </label>
         <div id="autonomous-controls" class="autonomous-controls" hidden>
-          <label for="autonomous-effort">Effort</label>
-          <select id="autonomous-effort">
-            <option value="low">low</option>
-            <option value="medium">medium</option>
-            <option value="high" selected>high</option>
-          </select>
           <label for="autonomous-workers">Workers</label>
-          <input type="number" id="autonomous-workers" min="1" max="8" step="1" value="3" />
+          <input type="number" id="autonomous-workers" min="1" max="8" step="1" />
         </div>
         <p class="hint" id="model-hint"></p>
       </section>