aegis-desktop 0.7.4 → 0.7.6

package/lib/sync/sessions.js

@@ -8,7 +8,7 @@
  * `sessions.json`, while the terminal host kept `~/.aegiscode/history.jsonl`
  * and the MCP plugin could see neither — three hosts, one account, three
  * disjoint views of the conversation. The implementation now lives in
- * `client/session-store.js`, which is the tree all three hosts already bundle,
+ * `client/session-store.js`, which is the tree every host already bundles,
  * and every call here forwards to it.
  *
  * Two things that matter are deliberately unchanged:

package/main.js

@@ -39,7 +39,7 @@ const { createClient } = sharedClient;
 // The shared credential store (`client/credentials.js`) — the same 0600 file
 // the terminal host writes with `aegiscode login` and the MCP plugin reads. The
 // app resolves its own account key through it, so signing in once serves all
-// three hosts; see resolveStartupKey() and persistApiKey() below.
+// four hosts; see resolveStartupKey() and persistApiKey() below.
 let credentials;
 try {
   credentials = require('../client/credentials.js');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -274,12 +274,36 @@ function foldRoll(sessionId, usage, opts = {}) {
  * Paint the topbar meter. Hidden while a session has accounted for nothing —
  * an unused thread must not display a `0 tok` it never measured — and shown
  * the moment a turn is folded in.
+ *
+ * `live`, when given, previews the in-flight turn on top of the session's
+ * already-folded total — text estimated the same way `foldRoll` estimates a
+ * turn the wire never reported on — WITHOUT folding it: the preview roll
+ * returned by `rollTurn` here is thrown away every frame and `rollsBySession`
+ * is never written to, so the real `foldRoll` at completion still starts from
+ * the untouched persisted total and cannot double-count this turn. (`turns`/
+ * `calls` are left at their default +1 rather than forced to 0 — `fmtRoll`
+ * treats a roll with both at 0 as "nothing counted yet" and blanks the line,
+ * which hid the preview entirely.) Before this, the meter held the previous
+ * turn's total frozen for the whole reply and only jumped at the end, which
+ * read as "the counter is dead while the AI works".
  */
-function renderRollMeter(sessionId) {
+function renderRollMeter(sessionId, live) {
   const el = els.sessionMeter;
   if (!el) return;
-  const roll = rollsBySession.get(sessionId || '');
-  const line = roll && currentSessionId === sessionId ? fmtRoll(roll) : '';
+  if (currentSessionId !== sessionId) { el.hidden = true; return; }
+  let roll = rollsBySession.get(sessionId || '');
+  if (live) {
+    roll = rollTurn(roll || emptyRoll(), undefined, {
+      prompt: live.prompt,
+      reply: live.reply,
+      // The thinking trace is billed output too — see `estimatedBuckets`. Left
+      // out, this preview measured only the visible answer, so on a reasoning
+      // model the meter sat on one number for the whole (longest, priciest)
+      // phase of the turn and looked dead while the AI was demonstrably working.
+      reasoning: live.reasoning,
+    });
+  }
+  const line = roll ? fmtRoll(roll) : '';
   el.textContent = line;
   el.hidden = !line;
   if (line) el.title = 'This session, counted the way the CLI counts it — every turn rolled into one running total';
@@ -312,6 +336,7 @@ function ledgerFields(usage, model, turn, text) {
     calls: text && text.calls,
     prompt: text && text.prompt,
     reply: text && text.reply,
+    reasoning: text && text.reasoning,
   });
   const fields = row ? Object.assign({}, row) : {};
   if (model) fields.model = model;
@@ -3146,6 +3171,10 @@ async function send() {
     }
     const bodyEl = pendingEl.querySelector('.body');
     if (bodyEl && bodyEl.textContent !== streamedText) bodyEl.textContent = streamedText;
+    // Live estimate so the topbar meter keeps moving while the reply streams
+    // in, instead of sitting frozen on the previous turn's total until this
+    // one resolves — see renderRollMeter's `live` param.
+    renderRollMeter(sessionId, { prompt, reply: streamedText, reasoning: reasoningText });
     stickToBottom();
   });
 
@@ -3225,7 +3254,7 @@ async function send() {
     // count is never read as a reported one. Printing nothing here while the
     // session total moved was the other half of "the counter looks dead".
     else {
-      const est = estimatedBuckets(prompt, text);
+      const est = estimatedBuckets(prompt, text, text === reasoningText ? '' : reasoningText);
       if (est) bits.push(`~${est.input + est.output} tokens`);
     }
     if (turn.cost != null) bits.push(fmtCost(turn.cost, turn.real));
@@ -3244,6 +3273,10 @@ async function send() {
       // CLI's `appendHistory` rule and the reason the total moves every turn.
       prompt,
       reply: text,
+      // The thinking trace is billed output and is not part of `text`, so it is
+      // counted here too — guarded, because the same string must never be
+      // estimated twice if a turn ever collapses the two into one.
+      reasoning: text === reasoningText ? '' : reasoningText,
     });
     const rollLine = fmtRoll(roll);
     if (rollLine) bits.push(`session: ${rollLine}`);
@@ -3259,6 +3292,10 @@ async function send() {
         ...ledgerFields(data && data.usage, model, turn, {
           prompt,
           reply: text,
+          // The thinking trace is billed output and is not part of `text`; it
+          // has to persist too, or reopening the window rebuilds a roll short
+          // by the longest part of the turn.
+          reasoning: text === reasoningText ? '' : reasoningText,
           calls: data && data.calls,
         }),
       });
@@ -3293,11 +3330,16 @@ async function send() {
       // on this path the figure is the text estimate, marked `est` — and
       // never a fabricated zero.
       const turn = turnAccounting(undefined, model, {});
-      const roll = foldRoll(sessionId, undefined, { model, prompt, reply: text });
+      const roll = foldRoll(sessionId, undefined, {
+        model,
+        prompt,
+        reply: text,
+        reasoning: text === reasoningText ? '' : reasoningText,
+      });
       const stopBits = ['stopped by you'];
       if (turn.tokens != null) stopBits.push(`tokens: ${turn.tokens}`);
       else {
-        const est = estimatedBuckets(prompt, text);
+        const est = estimatedBuckets(prompt, text, text === reasoningText ? '' : reasoningText);
         if (est) stopBits.push(`~${est.input + est.output} tokens`);
       }
       const stopRollLine = fmtRoll(roll);
@@ -3307,7 +3349,11 @@ async function send() {
         await sync.append(sessionId, {
           role: 'assistant',
           content: text,
-          ...ledgerFields(undefined, model, turn, { prompt, reply: text }),
+          ...ledgerFields(undefined, model, turn, {
+            prompt,
+            reply: text,
+            reasoning: text === reasoningText ? '' : reasoningText,
+          }),
         });
       } catch {
         /* persistence is non-fatal */

package/renderer/usage.js

@@ -99,17 +99,29 @@ function estimateTokens(text) {
  * genuinely reported nothing (no usage, no prompt, no reply) still lands in
  * `unknown` instead of being handed a fabricated zero.
  *
+ * `reasoning` is the extended-thinking trace, and it is OUTPUT: a reasoning
+ * model bills its chain of thought as output tokens, which is why the wire's
+ * own `output_tokens` already includes it. The desktop renders that trace in
+ * its own element (app.js `reasoningText`) rather than in the reply body, so
+ * the two streams had to be added back together here — an estimate measured off
+ * the visible answer alone sat still for the entire think phase, which on a
+ * reasoning model is both the longest and the most expensive part of the turn.
+ *
  * @param {string} [prompt]
  * @param {string} [reply]
+ * @param {string} [reasoning]
  * @returns {{input: number, output: number, cacheRead: number, cacheWrite: number}|null}
  */
-function estimatedBuckets(prompt, reply) {
+function estimatedBuckets(prompt, reply, reasoning) {
   const hasPrompt = typeof prompt === 'string' && prompt.length > 0;
-  const hasReply = typeof reply === 'string' && reply.length > 0;
+  const out =
+    (typeof reply === 'string' ? reply : '') +
+    (typeof reasoning === 'string' ? reasoning : '');
+  const hasReply = out.length > 0;
   if (!hasPrompt && !hasReply) return null;
   return {
     input: estimateTokens(prompt),
-    output: estimateTokens(reply),
+    output: estimateTokens(out),
     cacheRead: 0,
     cacheWrite: 0,
     real: false,
@@ -250,6 +262,8 @@ function turnAccounting(usage, model, opts = {}) {
  * back is that RUNNING TOTAL. The status bar prints `state.tokens`
  * (renderStatus), and `ctrl+t` prints the tallies in one line
  * (`tokenSummary`: `12,400 tok (10,100 in / 2,300 out) · 4 calls · €0.03`).
+ * The tallies are reproduced; that one abbreviation is not — `fmtRoll` explains
+ * why it drops the parenthetical rather than carrying the CLI's line verbatim.
  *
  * The desktop counted per turn only. Every meta row was a fresh count that
  * reset at the next call, so "what has this session spent" was answerable only
@@ -337,7 +351,7 @@ function rollTurn(roll, usage, opts = {}) {
     // estimate here is what makes the live roll and the rebuilt roll the same
     // number, and what stops the total standing still on exactly the turns the
     // pool declined to report on — the symptom this fallback exists to remove.
-    const est = estimatedBuckets(opts.prompt, opts.reply);
+    const est = estimatedBuckets(opts.prompt, opts.reply, opts.reasoning);
     if (!est) {
       // Nothing reported AND no text to estimate from. The single case that
       // stays uncounted: `unknown` names the gap, where a fabricated zero would
@@ -439,7 +453,10 @@ function ledgerRow(usage, turn, opts = {}) {
     if (calls !== undefined) row.calls = calls;
     return row;
   }
-  const est = estimatedBuckets(opts.prompt, opts.reply);
+  // `reasoning` is part of the billed output, so it is estimated with the
+  // reply — a stored row for a thinking-heavy turn must not persist a count
+  // that excludes the longest thing the model wrote.
+  const est = estimatedBuckets(opts.prompt, opts.reply, opts.reasoning);
   if (!est) return null;
   const row = { tokens: est };
   if (calls !== undefined) row.calls = calls;
@@ -471,28 +488,30 @@ function fmtTokens(n) {
  * an untouched session adds no noise to a turn's meta line.
  *
  * @param {object} [roll]
- * @returns {string} e.g. `12,400 tok (10,100 in / 2,300 out) · 4 calls · $0.0310`
+ * @returns {string} e.g. `12,400 tok · 4 calls · $0.0310` — the CLI's fields in
+ *   the CLI's order, minus the input/output parenthetical (see below).
  */
 function fmtRoll(roll) {
   const r = roll || emptyRoll();
   if (!r.turns && !r.calls) return '';
-  // The first two fields are `tokenSummary` (cli/src/app.js:1413) verbatim,
-  // separator and all: `12,400 tok (10,100 in / 2,300 out) · 4 calls`. There the
-  // parenthetical is unconditional and the call count is singular at one; both
-  // are kept, because a line that is only *sometimes* shaped like the CLI's is a
-  // lookalike rather than the same quantity. The call count is also the number
-  // that reveals a fan-out, which is why it is not hidden at 1.
+  // The fields are `tokenSummary`'s (cli/src/app.js:1413) in its order — tokens,
+  // calls, money — with one dropped: the `(10,100 in / 2,300 out)` split. `in`
+  // and `out` are a terminal status-line shorthand, legible to someone already
+  // reading that status line and to nobody else, which is what an unlabelled
+  // abbreviation in a GUI topbar turns into. The total is the figure a reader
+  // wants; `r.input`/`r.output` are still folded onto the roll (see `rollTurn`)
+  // for any surface that wants to show the split with real labels. The call
+  // count stays unconditional, because it is the number that reveals a
+  // fan-out, and it is not hidden at 1.
   const bits = [];
   // The token half only when something was actually counted. `rollTurn` counts
   // turns and calls BEFORE it looks at the token count, so a dispatch that
   // reported nothing still reaches here — and printing its empty tally would
-  // put `0 tok (0 in / 0 out)` on the topbar, a figure the meter never took,
-  // which reads as a counter that does not move. The turn count is still
-  // stated, because that much is true.
+  // put `0 tok` on the topbar, a figure the meter never took, which reads as a
+  // counter that does not move. The turn count is still stated, because that
+  // much is true.
   if (r.tokens > 0) {
-    bits.push(
-      `${fmtTokens(r.tokens)} tok (${fmtTokens(r.input)} in / ${fmtTokens(r.output)} out)`
-    );
+    bits.push(`${fmtTokens(r.tokens)} tok`);
   }
   bits.push(`${r.calls} call${r.calls === 1 ? '' : 's'}`);
   // Money is where this line departs from `tokenSummary`, deliberately: that

package/vendor/aegis.js

@@ -7,10 +7,13 @@
  * orchestration, routing, or tier logic. All of that lives in the private
  * ae-guix product and behind aegiscloud.org.
  *
- * Runs unchanged under three hosts:
+ * Runs unchanged under four hosts:
  *   - mcp/server.js   (Claude Code MCP plugin)         — CommonJS require
  *   - desktop/        (thin Electron shell)            — CommonJS require
  *                     (vendored byte-identical copy at desktop/vendor/aegis.js)
+ *   - cli/            (aegiscode terminal host)        — CommonJS require
+ *                     (vendored byte-identical copy at
+ *                      cli/vendor/client/aegis.js)
  *   - aegis-online    (browser SPA, vendored copy)     — <script> tag →
  *                     window.AegisClient
  *
@@ -348,6 +351,12 @@ function createClient(opts = {}) {
    * provider key never touches AEGIS storage — it is forwarded straight to the
    * provider for this request only. Mirrors chatCompletion()'s streaming /
    * fallback semantics exactly.
+   *
+   * The caller's *AEGIS* key is sent alongside the provider key as X-AEGIS-Key.
+   * Two credentials, two headers, on purpose: the provider key authenticates the
+   * upstream call, the AEGIS key says whose bank pays the handling fee. With no
+   * AEGIS key configured the header is omitted and the call stays anonymous —
+   * allowed, just unbilled (see _byok_identify_user on the server).
    */
   async function byokChatCompletion({
     provider = 'openai',
@@ -373,6 +382,10 @@ function createClient(opts = {}) {
       'X-AEGIS-Version': clientVersion,
       'X-Provider-Key': key,
     };
+    // Identify the payer. Absent key => anonymous call, which the server
+    // accepts but cannot bill; sending it is what turns a BYOK turn into
+    // billable traffic instead of a free ride.
+    if (apiKey) headers['X-AEGIS-Key'] = apiKey;
     if (!stream || typeof onStream !== 'function') {
       return apiPost('/api/v1/byok/chat/completions', { ...body, stream: false }, headers);
     }
@@ -683,6 +696,15 @@ function createClient(opts = {}) {
     return apiGet('/api/user/api-keys');
   }
 
+  /** The server's BYOK provider catalog: which providers accept a key, which
+   *  models each unlocks, where to get the key, and the prefix a valid key
+   *  starts with. Deliberately NOT key-gated — "which key do I go get, and
+   *  what will it unlock?" is the question asked *before* an AEGIS key exists.
+   *  An AEGIS key, if present, only adds the `configured` column. */
+  async function byokProviders() {
+    return apiGet('/api/v1/byok/providers');
+  }
+
   async function byokSet(provider, providerApiKey) {
     return apiPost('/api/user/api-keys', {
       provider,
@@ -809,6 +831,7 @@ function createClient(opts = {}) {
     tokenBankTopup,
     billingCheckout,
     byokStatus,
+    byokProviders,
     byokSet,
     getMemoryToken,
     memorySearch,

package/vendor/credentials.js

@@ -4,13 +4,13 @@
  * credentials.js — the ONE AEGIS account credential store, shared by every
  * host in this repo (terminal `aegiscode`, the MCP plugin, the desktop app).
  *
- * Why it lives in `client/`: this directory is the only tree all three hosts
- * already bundle. The MCP plugin ships `mcp/` + `client/` and nothing else, so
+ * Why it lives in `client/`: this directory is the only tree every host
+ * already bundles. The MCP plugin ships `mcp/` + `client/` and nothing else, so
  * a reader placed here needs no cross-package dependency — which is what the
  * alternative (the MCP host requiring `cli/src/credentials.js`) would have
  * forced, and why that host used to read `AEGIS_API_KEY` from the environment
- * alone while the CLI could save a key to disk. One login, one file, three
- * hosts: that is the point of this module.
+ * alone while the CLI could save a key to disk. One login, one file, all
+ * four hosts: that is the point of this module.
  *
  * Zero dependencies, no host imports. The data dir is resolved here
  * (`aegisHome()`) rather than imported from the CLI's config.js, so this file