aegis-desktop 0.6.0 → 0.7.0

package/README.md

@@ -45,6 +45,88 @@ queue that flushes on each "Sync now" or heartbeat retry. The **remember**
 button on any assistant reply pins that message to cross-machine memory —
 queued locally if you're offline.
 
+## Autonomous queue
+
+The unattended work queue, shared with the CLI: tasks are appended to
+`~/.aegiscode/queue.jsonl` and drained later, one at a time, with tool approval
+**disabled** — there is nobody there to click an approval card. The desktop
+sidebar's queue card and `aegiscode autonomous` are two views of the same file.
+
+```bash
+aegiscode autonomous add "fix the flaky retry test" --cwd ~/repo --commit
+aegiscode autonomous list
+aegiscode autonomous run                 # drain one task, then stop
+aegiscode autonomous proceed --max 3     # drain up to three
+aegiscode autonomous reconcile --auto    # queue the next unfinished PLAN.md phase, then drain it
+aegiscode autonomous retry <id>          # put a finished task back
+aegiscode autonomous clear --all         # empty the queue
+```
+
+A task's text is stored verbatim — `add "fix --json in the parser"` is a task,
+not a flag. Drains commit only the paths that task's own tool layer wrote, so a
+drain never sweeps a peer's in-flight edits into your commit.
+
+### Aegis Cloud only
+
+A queued task runs on the pooled brain — **`nexus-brain`** (alias
+`aegis-brain`) — for the same reason the Claude Code plugin is cloud-only: the
+queue hands work to a loop with no human in it, and the pooled class is the one
+the server can route, budget, and bill on its own. A task that *states* another
+model id is refused where you can still see it, instead of failing minutes into
+a drain as an opaque server error:
+
+| Where the model was stated | What happens |
+|---|---|
+| `autonomous add --model <id>` | refused, with the reason, at add time — nothing is queued |
+| A hand-edited `queue.jsonl` | refused pre-flight by the worker (`ms: 0`), before any turn is billed |
+| `AEGIS_MODEL=<id>` in the environment | **ignored for queue runs**, and reported as a note — that variable is shared with the interactive surfaces, which *do* run direct providers |
+| nothing stated | `nexus-brain` |
+
+### What a queued task costs
+
+The queue has two shapes, and the cheap one is the default:
+
+| | Single pass (default) | Fan-out (opt in) |
+|---|---|---|
+| Provider calls | 1 | `workers` + 1 (investigation passes, then synthesis) |
+| Effort rung | `medium` | `high` |
+| How to ask for it | nothing — it is the default | `AEGIS_AUTONOMOUS_FANOUT=1` |
+
+An earlier version sent **every** queued task as a fan-out at the priciest rung:
+one queued line could become several reasoning calls plus a synthesis, all at
+`high`. Making the fan-out opt-in, and letting effort follow the shape of the
+task rather than always topping out, removes the worker multiplication and
+roughly halves the budget on a one-line task. `--effort` (or
+`AEGIS_AUTONOMOUS_EFFORT`) still wins outright, and `--workers N` is only sent
+when you are actually fanning out.
+
+> **Known gap:** there is no `--fanout` flag yet — the opt-in is the environment
+> variable or `singlePass: false` in the task record. `--single-pass` still
+> parses, but it now agrees with the default instead of overriding it.
+
+### A turn that runs out of rounds keeps its work
+
+The tool loop runs against a round horizon: 24 rounds for an interactive turn
+(`AEGIS_CHAT_MAX_ROUNDS`), 40 for a queued one
+(`AEGIS_AUTONOMOUS_MAX_ROUNDS`). A model that reached it mid-turn used to lose
+everything it had assembled, because the cap was *turn* state.
+
+The horizon is now **session state**, held in `lib/local/session-rounds.js`. When
+a turn stops at the cap the interruption is filed against the session, and the
+next message in that conversation is prefixed with a continuation preamble —
+*cut off after N tool rounds; continue, do not restart* — along with
+`max(4, ⌈horizon/4⌉)` extra rounds so re-orientation does not eat the new
+horizon. The resume is announced in the transcript, so it is visible rather
+than silent.
+
+- In-memory and **process-local** (30-minute TTL, 64 entries) — it never leaves
+  the process and never touches disk.
+- Claiming an entry **consumes** it: one resume per interruption, so a chain of
+  interruptions is a chain of deliberate asks, never an automatic loop.
+- A **stated** horizon always wins; the ledger only pads its own default.
+- A caller that mints a fresh session key every turn adopts the most recent held
+  entry (bounded to 10 minutes) instead of losing the work.
+
 ## Keyboard shortcuts
 
 ### In the main window
@@ -124,6 +206,9 @@ main.js              Electron main process — window + IPC shell only
 preload.js           Context-isolated IPC bridge exposed to the renderer
 renderer/            UI (vanilla JS, no framework)
 lib/local/           Model classes, providers, agentic tool loop, prompt
+lib/local/queue.js   The shared work queue (~/.aegiscode/queue.jsonl)
+lib/local/autonomous.js  The unattended worker — directive, digest, commits
+lib/local/session-rounds.js  Session-scoped tool-round ledger (in-memory)
 lib/sync/            Local session/memory persistence + sync queue
 vendor/aegis.js      The AEGIS transport client (thin — no engine logic)
 bin/aegis.js         `aegis` CLI entry point for the global npm install

package/lib/local/autonomous.js

@@ -55,6 +55,15 @@ const gitScope = require('./git-scope.js');
 /** Default tool-round horizon for an unattended turn (matches the engine's). */
 const DEFAULT_ROUNDS = 40;
 
+/**
+ * Consecutive tool-round-horizon stops a queued task gets before runOne gives
+ * up on it as unable to converge and settles it 'error' instead of 'pending'.
+ * Without this bound a task that never finishes would keep proceed()'s drain
+ * loop picking it back up forever — proceed() defaults to no --max at all, so
+ * nothing else would ever stop it.
+ */
+const MAX_ROUND_STOPS = 3;
+
 /**
  * The engine tools that report the file they write, and the argument holding
  * it. This set is the attribution record for a task's commit: `exec` is absent
@@ -73,13 +82,65 @@ function writtenPath(tool) {
 
 /**
  * The default AEGIS Cloud model for autonomous work: the pooled brain, which
- * is the tier the server fans out to multiple reasoning workers and
- * synthesises. Autonomous tasks are exactly the ones worth that spend, and
- * `nexus-brain` is the canonical id the catalog itself prefers (the other tier
- * spellings are aliases of it — see filterAegisCatalog in engine.js).
+ * is the tier the server can fan out to multiple reasoning workers and
+ * synthesise. `nexus-brain` is the canonical id the catalog itself prefers
+ * (the other tier spellings are aliases of it — see filterAegisCatalog in
+ * engine.js).
+ *
+ * The model id is only the tier. It is NOT what makes an autonomous task
+ * expensive — the fan-out is, and the fan-out is opt-in per task (see
+ * resolveFanout below). This used to be documented the other way round ("the
+ * pooled brain ... autonomous tasks are exactly the ones worth that spend"),
+ * and the worker sent `autonomous: true` on every queued task, so the most
+ * expensive shape of the most expensive tier ran on one-line tasks too.
  */
 const DEFAULT_MODEL = 'nexus-brain';
 
+/**
+ * THE QUEUE RUNS ON AEGIS CLOUD, AND NOTHING ELSE.
+ *
+ * A queued task is billed to the AEGIS pool and every turn it makes goes out
+ * with `class: 'aegis'` (see runTask below) — the pool is the only backend this
+ * worker can reach. So a model id here has to be one the *pool* serves. A
+ * direct-provider id is not a cheaper option the queue could fall back to; it
+ * is a request the pool cannot honour, or worse, a per-provider spelling
+ * (`anthropic`, `groq`, …) that quietly pins one upstream instead of letting
+ * the pool auto-route across whichever providers hold a live key.
+ *
+ * The accept-list is therefore the pooled-brain tier family — the one entry
+ * engine.js's filterAegisCatalog offers for the Aegis Cloud class, plus the
+ * `-smart`/`-neo` tier spellings the server still serves as aliases of it. This
+ * mirrors selectBrainEntry() there rather than re-deriving "anything starting
+ * with nexus-": `nexus-fast` is not a tier the catalog has ever served, and
+ * accepting a made-up id means a queued task that fails at the server after
+ * being picked up, or runs on a tier nobody chose.
+ */
+const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
+const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
+
+/** True when `id` names an AEGIS Cloud pooled-brain tier (the queue's only models). */
+function isAegisModel(id) {
+  return AEGIS_MODEL_RE.test(String(id == null ? '' : id).trim());
+}
+
+/**
+ * Why a STATED model id cannot be queued, or '' when it can. Blank is not a
+ * refusal — "no pick" is the default model, which resolveModel supplies.
+ *
+ * The message names the pool, because the failure it prevents ("queued on
+ * claude-sonnet-4, ran on — or was billed to — something else") is invisible
+ * otherwise: `class: 'aegis'` would be sent with an id the server does not
+ * serve, and the task would come back as an opaque error minutes later.
+ */
+function modelRefusal(id) {
+  const stated = String(id == null ? '' : id).trim();
+  if (!stated || isAegisModel(stated)) return '';
+  return (
+    `the autonomous queue runs Aegis Cloud models only (${DEFAULT_MODEL}, ` +
+    `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
+  );
+}
+
 /** Phrase match for "work autonomously" in a prompt or a queued task. */
 const AUTONOMOUS_REQUEST_RE =
   /\bautonomously\b|\bon your own\b|\bwithout asking\b|\bend[- ]to[- ]end\b|\bno (?:more )?questions\b|\bfully autonomous\b|\bqueue it\b/i;
@@ -160,23 +221,92 @@ function withRoundHorizon(rounds, env, fn) {
 }
 
 /**
- * The model an autonomous task runs on: an explicit pick wins, then the
- * environment (so a systemd timer can pin a cheap tier), then the pooled
- * brain. Never the interactive session's model — a queue survives the session
- * that queued it, so it cannot inherit that session's choice.
+ * The model an autonomous task runs on: an explicit pick wins, then an AEGIS
+ * Cloud pin in the environment (so a systemd timer can choose a tier), then the
+ * pooled brain. Never the interactive session's model — a queue survives the
+ * session that queued it, so it cannot inherit that session's choice.
+ *
+ * TWO DIFFERENT TREATMENTS FOR TWO DIFFERENT SOURCES, on purpose:
+ *
+ *   - a pick that came from the TASK is returned verbatim, even when it is
+ *     wrong. Substituting a correct model for a stated one is how a queue
+ *     "runs on nexus-brain" while the file says otherwise; the caller refuses
+ *     it out loud instead (modelRefusal, queue.addTask, and the pre-flight in
+ *     runTask).
+ *   - a non-Aegis value in the ENVIRONMENT is skipped, because AEGIS_MODEL is
+ *     shared with the interactive surfaces (which run direct providers), so a
+ *     stray value there is not a statement about the queue. Refusing every
+ *     task over it would break drains for a reason that is not the task's
+ *     fault; a fallback to the pooled brain keeps the drain honest and on-cloud.
  */
 function resolveModel({ model, env } = {}) {
   const e = env || process.env;
   const picked = String(model || '').trim();
   if (picked) return picked;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
-  return fromEnv || DEFAULT_MODEL;
+  return isAegisModel(fromEnv) ? fromEnv : DEFAULT_MODEL;
 }
 
-/** Effort rung for an unattended turn: high unless the caller/environment says otherwise. */
-function resolveEffort({ effort, env } = {}) {
+/**
+ * The environment pin the queue had to ignore, or '' when there was none.
+ *
+ * Reported (not silent) because an operator who exported
+ * AEGIS_AUTONOMOUS_MODEL=deepseek-v4-flash asked for a model and is not getting
+ * it: the queue falls back to the pool, and the one place that says so is this
+ * string, which runTask emits as a note and the desktop card shows.
+ */
+function ignoredEnvModel({ model, env } = {}) {
+  if (String(model || '').trim()) return ''; // the task's own pick is what counts
+  const e = env || process.env;
+  const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
+  if (!fromEnv || isAegisModel(fromEnv)) return '';
+  const which = String(e.AEGIS_AUTONOMOUS_MODEL || '').trim() ? 'AEGIS_AUTONOMOUS_MODEL' : 'AEGIS_MODEL';
+  return `${which}="${fromEnv}" is not an Aegis Cloud model — running on ${DEFAULT_MODEL} instead`;
+}
+
+/**
+ * Whether a queued task runs the pooled-brain worker fan-out (aegis1
+ * services/pool_brain.py) or one plain turn on the same tier.
+ *
+ * COST IS THE REASON THIS IS OPT-IN. The fan-out is the single biggest
+ * multiplier this app can put on a bill: pool_brain spawns up to `workers`
+ * reasoning workers plus a synthesis pass, re-sends the task context to every
+ * one of them, and sizes each from the same effort ladder. A 3-worker
+ * high-effort task is therefore roughly four full reasoning calls against a
+ * 65536-token ladder, where the identical task single-pass is one call on the
+ * medium rung. The fan-out earns that on genuinely open-ended investigation
+ * ("why did X regress across this repo"); it is pure waste on a task that
+ * already names the file to edit.
+ *
+ * Precedence: the task's own `autonomous: true` (or `singlePass: false`, the
+ * explicit "fan me out") wins, then AEGIS_AUTONOMOUS_FANOUT=1 in the
+ * environment, else single pass.
+ */
+function resolveFanout(item = {}, env = process.env) {
+  const it = item || {};
+  if (it.autonomous === true || it.singlePass === false) return true;
   const e = env || process.env;
-  return String(effort || e.AEGIS_AUTONOMOUS_EFFORT || 'high');
+  return /^(1|true|yes|on)$/i.test(String(e.AEGIS_AUTONOMOUS_FANOUT || '').trim());
+}
+
+/**
+ * Effort rung for an unattended turn.
+ *
+ * The rung is a spend knob, not a quality slider: the pooled class sizes its
+ * whole budget ladder from it (aegis1 services/pool_brain.py pass_budgets:
+ * low/medium/high -> 16384/32768/65536 tokens TOTAL across the fan-out), and
+ * the engine uses it for any model that reasons against its own output budget.
+ * `high` is the right rung for a fan-out — it is what buys a synthesis pass
+ * worth reading — but on a single pass it is a 2x over medium for budget
+ * nobody reads, so the default follows the shape of the task rather than
+ * always being the most expensive rung. An explicit pick (item.effort) or
+ * AEGIS_AUTONOMOUS_EFFORT still wins outright.
+ */
+function resolveEffort({ effort, env, fanout } = {}) {
+  const e = env || process.env;
+  const stated = String(effort || e.AEGIS_AUTONOMOUS_EFFORT || '').trim();
+  if (stated) return stated;
+  return fanout ? 'high' : 'medium';
 }
 
 /**
@@ -205,7 +335,8 @@ function autonomousDirective(rounds = DEFAULT_ROUNDS) {
  */
 function digestLine(item, result) {
   const task = String(item.task || '').replace(/\s+/g, ' ').trim().slice(0, 120);
-  const mark = result && result.ok ? '✓' : '✗';
+  const paused = Boolean(result && result.ok && result.stoppedOnRounds);
+  const mark = paused ? '⏸' : result && result.ok ? '✓' : '✗';
   const files = (result && Array.isArray(result.files) && result.files.slice(0, 6)) || [];
   const where = files.length ? ` — touched: ${files.join(', ')}${result.files.length > files.length ? ', …' : ''}` : '';
   const why = !result || result.ok ? '' : ` — ${String((result && result.error) || 'failed').slice(0, 120)}`;
@@ -290,8 +421,24 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
    */
   async function runTask(item, { carry = '', commit } = {}) {
     const cwd = item.cwd || process.cwd();
+    // Aegis Cloud or nothing — checked BEFORE the turn, not at the server. An
+    // item whose model is not a pooled tier (a hand-edited queue file, a
+    // `--model` the CLI accepted before this rule existed, another host's
+    // older build) would otherwise go out as `class: 'aegis'` with an id the
+    // pool does not serve: billed work if it happens to be a per-provider
+    // spelling, an opaque server error otherwise. Failing here names the model
+    // and the allowed ones, and costs nothing.
+    const refusal = modelRefusal(item.model);
+    if (refusal) {
+      const failed = { ok: false, error: refusal, model: item.model, ms: 0 };
+      emit({ type: 'finish', taskId: item.id, ok: false, result: failed });
+      return failed;
+    }
     const model = resolveModel({ model: item.model, env });
-    const effort = resolveEffort({ effort: item.effort, env });
+    const ignored = ignoredEnvModel({ model: item.model, env });
+    if (ignored) emit({ type: 'note', taskId: item.id, note: ignored });
+    const fanout = resolveFanout(item, env);
+    const effort = resolveEffort({ effort: item.effort, env, fanout });
     const rounds = maxRounds(env, item.maxRounds);
     // Approval requests have no one to answer them here; see the header.
     let approvalAsked = null;
@@ -331,7 +478,7 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
     const wantCommit = commit === undefined ? Boolean(item.commit) : Boolean(commit);
     const before = wantCommit ? safe(() => git.gitStatusSnapshot(cwd), null) : null;
 
-    emit({ type: 'start', taskId: item.id, model, cwd, rounds });
+    emit({ type: 'start', taskId: item.id, model, cwd, rounds, fanout, effort });
     const started = now();
     let result;
     try {
@@ -341,13 +488,16 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
             class: 'aegis',
             model,
             prompt: taskPrompt(item, { carry, rounds }),
-            // The pooled brain ("work autonomously" in the GUI): the server fans
-            // the round out to several reasoning workers and synthesises. A
-            // `singlePass` task opts out — the retry/write-up passes in the
-            // engine send `brain: false` for exactly this reason.
-            autonomous: !item.singlePass,
+            // The pooled-brain fan-out ("fan out this turn" in the GUI chat
+            // header, and opt-in here): the server fans the round out to
+            // several reasoning workers and synthesises. It costs about
+            // workers+1 full reasoning calls, so it travels only when the task
+            // asked for it — see resolveFanout above. A `singlePass` task is
+            // the default for exactly that reason; the retry/write-up passes in
+            // the engine send `brain: false` for the same one-call reason.
+            autonomous: fanout,
             effort,
-            workers: item.workers || undefined,
+            workers: fanout ? item.workers || undefined : undefined,
             // The turn's working directory rides on `env`: engine.js reads the
             // tool loop's cwd from envFor(payload), so a top-level `cwd` field
             // is a directory the engine would ignore and every tool would run
@@ -476,13 +626,41 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
     const items = queue.loadQueue(env);
     const claimed = queue.markRunning(items, item.id, { now: now() });
     if (!claimed) return { ok: false, error: `unknown task #${item.id}`, carry };
+    const priorRoundStops = Number(claimed.roundStops) || 0;
     queue.saveQueue(env, items);
 
-    const result = await runTask(claimed, { carry, commit });
+    const raw = await runTask(claimed, { carry, commit });
+
+    // A task that hit its tool-round horizon has NOT finished — engine.js's
+    // session ledger (session-rounds.js) is holding the rest of the work
+    // under this task's stable session id (sessionIdFor(item.id)), ready to
+    // inject a continuation preamble the moment this item is dispatched
+    // again. Settling it 'done' here (the old behavior) threw that away: the
+    // queue believed the task was finished, so nothing ever sent the next
+    // turn that would have consumed the resume, and a human had to notice
+    // the output was incomplete and re-queue the whole task from scratch.
+    //
+    // Left 'pending' instead, so proceed()'s own drain loop picks it straight
+    // back up — unless it has now failed to converge MAX_ROUND_STOPS times in
+    // a row, at which point looping on it forever (an unattended proceed()
+    // with no --max has no other cap at all) is worse than a visible error.
+    const hitRoundCap = Boolean(raw.ok && raw.stoppedOnRounds);
+    const roundStops = hitRoundCap ? priorRoundStops + 1 : 0;
+    const exhausted = hitRoundCap && roundStops > MAX_ROUND_STOPS;
+    const result = exhausted
+      ? {
+          ...raw,
+          ok: false,
+          error:
+            `stopped at its tool-round horizon ${roundStops} times in a row without finishing — ` +
+            'raise AEGIS_AUTONOMOUS_MAX_ROUNDS or split the task into smaller ones',
+        }
+      : raw;
+    const status = exhausted ? 'error' : hitRoundCap ? 'pending' : result.ok ? 'done' : 'error';
 
     const after = queue.loadQueue(env);
     queue.settle(after, claimed.id, {
-      status: result.ok ? 'done' : 'error',
+      status,
       result: {
         ok: result.ok,
         output: result.output || '',
@@ -494,13 +672,15 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
       error: result.ok ? null : result.error,
       now: now(),
     });
+    const settled = queue.findTask(after, claimed.id);
+    if (settled) settled.roundStops = roundStops;
     queue.saveQueue(env, after);
     queue.appendRun(env, {
       id: claimed.id,
       task: claimed.task,
       cwd: claimed.cwd,
       model: resolveModel({ model: claimed.model, env }),
-      status: result.ok ? 'done' : 'error',
+      status: status === 'pending' ? 'stopped' : status,
       at: new Date(now()).toISOString(),
       ms: result.ms,
       usage: result.usage || null,
@@ -582,13 +762,19 @@ function commitMessage(item) {
 module.exports = {
   DEFAULT_MODEL,
   DEFAULT_ROUNDS,
+  MAX_ROUND_STOPS,
+  AEGIS_MODEL_IDS,
+  isAegisModel,
+  modelRefusal,
   WRITE_TOOLS,
   writtenPath,
   isAutonomousRequest,
   maxRounds,
   withRoundHorizon,
   resolveModel,
+  ignoredEnvModel,
   resolveEffort,
+  resolveFanout,
   autonomousDirective,
   taskPrompt,
   appendDigest,

package/lib/local/engine.js

@@ -383,7 +383,14 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
    *  settings store's own accessor; then the safe default — ON, i.e. the gate
    *  stays up, so a store that predates the toggle can never silently
    *  disable it. */
+  // Session-scoped round accounting (lib/local/session-rounds.js): the
+  // tool-round cap is held against the *session* rather than the single turn,
+  // so a turn that reaches its horizon is resumed by the next turn in the same
+  // conversation instead of being cut off with the work lost. Module-level
+  // state, so it survives `send()` and even a fresh engine instance.
+  const sessionRounds = require('./session-rounds.js');
   const confirmModeEnabled = () => {
+
     if (typeof getConfirmMode === 'function') return getConfirmMode() !== false;
     if (settings && typeof settings.getConfirmMode === 'function') {
       const value = settings.getConfirmMode();
@@ -938,6 +945,11 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
 
     const system = (payload && payload.system) || buildSystemPrompt(envFor(payload));
     const history = Array.isArray(payload && payload.messages) ? payload.messages.filter(Boolean).slice() : [];
+    // Index into `history` of everything THIS turn added as opposed to what the
+    // caller brought with it. Reset after the resume rehydration below, so a
+    // restored transcript is never re-recorded as if this turn had produced it
+    // (which would double it on every interruption in a chain).
+    let historyStart = history.length;
     let prompt = (payload && payload.prompt) || '';
 
     // Lazily start ONE shell session for this turn; the exec tool shares it so
@@ -1020,12 +1032,67 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       // The numbers match aegiscodex-dev's (src/autonomous.js) so both clients
       // behave the same: 24 rounds for a chat turn, 40 for an autonomous one.
       // Env-overridable for a deliberately long job.
-      const maxRounds = (() => {
-        const name = autonomous ? 'AEGIS_AUTONOMOUS_MAX_ROUNDS' : 'AEGIS_CHAT_MAX_ROUNDS';
-        const raw = Number.parseInt(process.env[name] || '', 10);
-        if (Number.isFinite(raw) && raw > 0) return raw;
-        return autonomous ? 40 : 24;
+      // A stated horizon (env) still wins outright — an explicit number is the
+      // user overriding the engine, not something the ledger may pad.
+      const roundEnvName = autonomous ? 'AEGIS_AUTONOMOUS_MAX_ROUNDS' : 'AEGIS_CHAT_MAX_ROUNDS';
+      const statedRounds = (() => {
+        const raw = Number.parseInt(process.env[roundEnvName] || '', 10);
+        return Number.isFinite(raw) && raw > 0 ? raw : 0;
       })();
+      const baseRounds = statedRounds || (autonomous ? 40 : 24);
+
+      // Did the previous turn in this session die at its horizon? If so, this
+      // turn is a continuation of it: same job, unfinished, and the model has
+      // to be told — a cold restart is what made the old cap lose work.
+      let roundSessionKey = sessionRounds.keyFor(payload, history);
+      let resumed = sessionRounds.take(roundSessionKey);
+      if (!resumed) {
+        // The caller minted a fresh key this turn (no stated session id and a
+        // rebuilt history array). Adopt the held work rather than dropping it,
+        // but only within the ledger's recency window.
+        const adopted = sessionRounds.adopt();
+        if (adopted) {
+          resumed = adopted.entry;
+          roundSessionKey = adopted.key;
+        }
+      }
+      if (resumed) {
+        const preamble = sessionRounds.resumePreamble(resumed);
+        // Restore the interrupted turn's transcript, because the preamble alone
+        // says HOW MUCH was done, not WHAT. The two callers need different
+        // halves of it, so `session-rounds` files both (see `record`):
+        //
+        //   · a caller who brings no conversation of its own — the queue
+        //     worker's fresh dispatch; autonomous.js never sends `messages` —
+        //     has nothing, so it gets the FULL transcript;
+        //   · an interactive chat already carries the prior turns (and the
+        //     "stopped at N rounds" note), so it gets only what THIS turn added
+        //     that the caller never saw: the tool calls and their results. Full
+        //     restore here would duplicate the caller's own text.
+        //
+        // The old `history.length === 0` guard did the first and not the second,
+        // so the resume it was written for a queue task never reached the
+        // interactive sessions this feature is actually used from.
+        if (history.length === 0) {
+          if (Array.isArray(resumed.messages) && resumed.messages.length) history.push(...resumed.messages);
+        } else if (Array.isArray(resumed.added) && resumed.added.length) {
+          history.push(...resumed.added);
+        }
+        // Round 1's ask travels as `prompt`; a follow-up dispatch (and every
+        // turn that skips the shorthand) has to receive it through history.
+        if (prompt) prompt = `${preamble}\n\n${prompt}`;
+        else history.push({ role: 'user', content: preamble });
+        if (rootOnDelta) {
+          rootOnDelta({
+            delta:
+              `\n\n[resuming work this session left unfinished at ${resumed.rounds} tool rounds` +
+              `${resumed.interruptions > 1 ? ` (cut off ${resumed.interruptions}×)` : ''}…]\n`,
+          });
+        }
+      }
+      // A resumed turn gets a small bonus on top of the base horizon so
+      // re-orientation does not consume the new budget before any work lands.
+      const maxRounds = statedRounds || baseRounds + (resumed ? sessionRounds.bonus(baseRounds) : 0);
       let round = 0;
 
       // Token accounting for the whole TURN, not just its last round. An
@@ -1075,6 +1142,11 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
         prompt = '';
       };
 
+      // From here on, everything pushed into `history` is this turn's own work:
+      // the restored transcript above (if any) belongs to the turn it came from,
+      // and re-recording it would double the ledger on every interruption.
+      historyStart = history.length;
+
       for (;;) {
         // Stop and SAY so. A turn that reaches its horizon has usually done
         // real work; ending silently would paint an empty answer over it,
@@ -1084,13 +1156,34 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
           const note =
             `[stopped at ${maxRounds} tool rounds` +
             `${turnUsage.total_tokens ? `, ${turnUsage.total_tokens.toLocaleString()} tokens` : ''}` +
-            `. Ask again to continue, or raise ` +
-            `${autonomous ? 'AEGIS_AUTONOMOUS_MAX_ROUNDS' : 'AEGIS_CHAT_MAX_ROUNDS'}.]`;
+            `. This session holds the work: your next message here resumes it automatically` +
+            ` (with a continuation preamble), or raise ${roundEnvName} for a longer single turn.]`;
+          // File the interruption before returning, so the horizon is a pause
+          // in the session rather than the end of the job. `chain` carries the
+          // count forward across resumes.
+          const held = sessionRounds.record(roundSessionKey, {
+            rounds: round,
+            tokens: turnUsage.total_tokens || 0,
+            note,
+            chain: resumed ? resumed.interruptions : 0,
+            // The actual tool-call/tool-result transcript built up this turn —
+            // everything folded/pushed into `history` by completed rounds — so
+            // a resume can restore real memory of the work, not just a count
+            // of it (see the `resumed.messages` rehydration above).
+            messages: history,
+            // …and only what this turn itself added, for the caller that
+            // already has the rest of `history` in its own conversation.
+            added: history.slice(historyStart),
+          });
           if (rootOnDelta) rootOnDelta({ delta: `\n\n${note}` });
           return withTurnUsage({
             model: base.model,
             choices: [{ message: { content: note }, finish_reason: 'length' }],
             stoppedOnRounds: true,
+            heldForSession: true,
+            heldRounds: held.rounds,
+            sessionInterruptions: held.interruptions,
+            resumedFrom: roundSessionKey,
           });
         }
         round += 1;

package/lib/local/queue.js

@@ -179,17 +179,32 @@ function upsert(items, entry) {
  * with it as the tool loop's working directory), `model` is the AEGIS Cloud
  * model id to run it on, and `commit` asks the worker to commit what the task
  * changed (scoped — see autonomous.js).
+ *
+ * AEGIS CLOUD ONLY, REFUSED AT THE DOOR. The worker sends every task out as
+ * `class: 'aegis'`, so a model the pool does not serve cannot run here at all —
+ * it is a task that fails minutes into a drain, after being picked up, with an
+ * opaque server error. `model: null` stays legal: that is "no pick", and
+ * autonomous.resolveModel fills in the pooled brain. Anything else has to pass
+ * that module's own accept-list, so the CLI (`aegiscode autonomous add
+ * --model`), the desktop card and a hand-written queue file are all held to the
+ * same rule. Required lazily: queue.js is a dependency of autonomous.js, and
+ * this check must not turn that into a load-order cycle.
  */
 function addTask(env, opts = {}) {
   const task = String(opts.task == null ? '' : opts.task).trim();
   if (!task) throw new Error('queue: a task needs text');
+  const statedModel = String(opts.model == null ? '' : opts.model).trim();
+  if (statedModel) {
+    const refusal = require('./autonomous.js').modelRefusal(statedModel);
+    if (refusal) throw new Error(`queue: ${refusal}`);
+  }
   const items = loadQueue(env);
   const now = opts.now || Date.now();
   const entry = {
     id: nextId(items),
     task,
     cwd: opts.cwd || process.cwd(),
-    model: opts.model || null,
+    model: statedModel || null,
     effort: opts.effort || null,
     workers: Number.isInteger(opts.workers) ? opts.workers : null,
     singlePass: Boolean(opts.singlePass),
@@ -251,6 +266,10 @@ function retryTask(env, id, opts = {}) {
   item.updated = opts.now || Date.now();
   delete item.error;
   delete item.pid;
+  // A manual retry is a fresh deliberate ask, so it gets its own full run of
+  // MAX_ROUND_STOPS chances (autonomous.js) rather than inheriting whatever
+  // count a previous, unrelated failure left behind.
+  delete item.roundStops;
   saveQueue(env, items);
   return item;
 }