aegis-desktop 0.7.5 → 0.7.7

package/lib/local/engine.js

@@ -87,8 +87,28 @@ const CLASSES = [
   { class: 'ollama', label: 'Ollama (local)', kind: 'local' },
   { class: 'openai-compat', label: 'Custom OpenAI-compatible', kind: 'custom' },
   { class: 'anthropic', label: 'Anthropic-compatible', kind: 'custom' },
+  { class: 'byok', label: 'Bring your own key', kind: 'cloud' },
 ];
 
+/** Local settings namespace for one BYOK provider's key. A `byok:` prefix
+ *  keeps this out of the 'anthropic'/'openai-compat' CUSTOM_CLASSES' own
+ *  namespaces, which are a different feature (a self-hosted/compatible
+ *  endpoint's base URL + key) — same store, deliberately separate rows. */
+function byokNamespace(providerId) {
+  return `byok:${providerId}`;
+}
+
+/** Split a byok model id ("anthropic:claude-sonnet-5") into its provider and
+ *  bare model parts. `modelId` may itself contain ':' (none of today's
+ *  catalog ids do, but nothing guarantees that), so only the FIRST segment is
+ *  the provider — the rest re-joins as the model. */
+function splitByokModel(compound) {
+  const s = typeof compound === 'string' ? compound : '';
+  const i = s.indexOf(':');
+  if (i < 0) return { provider: '', model: s };
+  return { provider: s.slice(0, i), model: s.slice(i + 1) };
+}
+
 /**
  * Mirrors aegiscodex-dev's src/backend.js DEEPSEEK_REASONING_MODEL_RE +
  * EFFORT_TOKEN_BUDGET verbatim. DeepSeek's reasoning models (deepseek-flash,
@@ -657,6 +677,16 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       if (c.class === 'aegis') {
         return { ...c, configured: Boolean(aegis.apiKey) };
       }
+      if (c.class === 'byok') {
+        // Configured means "at least one provider has a locally-stored key",
+        // not a single baseURL+key pair like the CUSTOM_CLASSES below — byok
+        // holds one row per provider (byokNamespace), so customStatus's shape
+        // does not apply here.
+        const anyConfigured = (settings.list() || []).some(
+          (s) => s && typeof s.provider === 'string' && s.provider.startsWith('byok:') && s.configured
+        );
+        return { ...c, configured: anyConfigured };
+      }
       return { ...c, ...customStatus(c.class) };
     });
   }
@@ -681,6 +711,41 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       const tags = await ollama.listTags();
       return { class: cls, models: tags.map((t) => ({ id: t.id })) };
     }
+    if (cls === 'byok') {
+      // The server's catalog names every provider it accepts a key for, the
+      // models each unlocks, and whether an AEGIS account key is even needed
+      // to ask (it is not — see byokProviders' own docstring). Deliberately
+      // NOT gated on aegis.apiKey the way the pooled class above is: BYOK's
+      // whole point is a caller who brings their own credential, and the
+      // catalog itself answers to an anonymous request.
+      let providers = [];
+      try {
+        const data = await aegis.byokProviders();
+        providers = (data && data.providers) || [];
+      } catch {
+        providers = [];
+      }
+      const models = [];
+      for (const p of providers) {
+        if (!p || !p.id) continue;
+        const local = settings.get(byokNamespace(p.id)) || {};
+        const rawModels = Array.isArray(p.models) ? p.models : [];
+        for (const m of rawModels) {
+          const modelId = typeof m === 'string' ? m : m && m.id;
+          if (!modelId) continue;
+          models.push({
+            id: `${p.id}:${modelId}`,
+            label: `${p.label || p.id} — ${modelId}`,
+            provider: p.id,
+            configured: Boolean(local.configured),
+          });
+        }
+      }
+      return {
+        class: cls, models, providers,
+        needsProviderKey: models.length > 0 && !models.some((m) => m.configured),
+      };
+    }
     // Custom endpoints: the model id is the *user's* choice — a provider model
     // name, never a URL. Offering the configured base URL as an `id` meant that
     // leaving the default selection POSTed `model: "https://api.openai.com/v1"`,
@@ -867,6 +932,29 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
       });
     }
 
+    if (cls === 'byok') {
+      // opts.model is still the compound "provider:model" id here — the
+      // relay wants them split (a `provider` field plus a bare `model`).
+      // opts.apiKey is the PROVIDER key resolved by chat() above (from the
+      // byokNamespace(provider) settings row), never the account's own AEGIS
+      // key — that one is baked into the `aegis` client already and attached
+      // automatically by byokChatCompletion() as X-AEGIS-Key so the account
+      // gets billed the handling fee; see client/aegis.js.
+      const { provider, model: bareModel } = splitByokModel(opts.model);
+      return aegis.byokChatCompletion({
+        provider,
+        model: bareModel,
+        providerKey: opts.apiKey,
+        prompt: opts.prompt,
+        system: opts.system,
+        messages: opts.messages,
+        maxTokens: opts.maxTokens,
+        stream: true,
+        onStream: opts.onDelta,
+        signal: opts.signal,
+      });
+    }
+
     const common = {
       baseURL: opts.cfg.baseURL,
       apiKey: opts.apiKey,
@@ -887,7 +975,14 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
   async function chat(payload, onDelta) {
     const cls = payload && payload.class;
     const model = payload && payload.model;
-    const maxTokens = reasoningBudget(cls, model, payload && payload.maxTokens, payload && payload.effort);
+    // byok's model id is "provider:model" (see splitByokModel) — strip the
+    // provider prefix before pattern-matching, or a DeepSeek reasoning model
+    // selected under byok ("byok" model "deepseek:deepseek-v4-flash") never
+    // matches DEEPSEEK_REASONING_MODEL_RE's anchored pattern and silently
+    // gets no stated budget, which is exactly the "hidden CoT ate the whole
+    // default and returned nothing" failure this budget exists to prevent.
+    const reasoningModelId = cls === 'byok' ? splitByokModel(model).model : model;
+    const maxTokens = reasoningBudget(cls, reasoningModelId, payload && payload.maxTokens, payload && payload.effort);
     // The caller's OWN number, kept apart from `maxTokens` above. That one
     // collapses two different facts into a single value — "the caller stated
     // 4096" and "effort implies 32768" — and the pooled path must treat them
@@ -937,8 +1032,12 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
     const signal = controller.signal;
 
     // A caller can opt out of the agent loop entirely (`tools: false`) and get
-    // the old single-shot turn back.
-    const toolsEnabled = !(payload && payload.tools === false);
+    // the old single-shot turn back. byok is ALWAYS single-shot: the
+    // stateless relay (aegis.byokChatCompletion, /api/v1/byok/chat/completions)
+    // has no tools/tool_choice parameter at all, so sending schemas here would
+    // build a prompt promising tool access the transport silently drops —
+    // the model would reason about exec/readFile and never see a result.
+    const toolsEnabled = cls !== 'byok' && !(payload && payload.tools === false);
     const wire = cls === 'anthropic' ? 'anthropic' : 'openai';
     const toolSchemas = toolsEnabled ? T.toolsFor(wire, { includeSubagent: depth < MAX_SUBAGENT_DEPTH }) : [];
     const toolChoice = (payload && payload.toolChoice) || null;
@@ -965,8 +1064,35 @@ function createLocalEngine({ aegis, settings, ollama, providers, tools, promptBu
     const turnCwd = envFor(payload).cwd;
 
     try {
-      const cfg = cls === 'aegis' || cls === 'ollama' ? {} : settings.get(cls) || {};
-      const apiKey = cls === 'aegis' || cls === 'ollama' ? null : settings.rawKey(cls);
+      // byok's settings row lives under the provider named IN THE MODEL id
+      // ("anthropic:claude-sonnet-5" -> byokNamespace('anthropic')), never
+      // under the literal class name — one flat 'byok' row could not hold
+      // more than one provider's key at a time.
+      const byokParts = cls === 'byok' ? splitByokModel(model) : null;
+      const cfg =
+        cls === 'aegis' || cls === 'ollama' ? {}
+        : cls === 'byok' ? settings.get(byokNamespace(byokParts.provider)) || {}
+        : settings.get(cls) || {};
+      const apiKey =
+        cls === 'aegis' || cls === 'ollama' ? null
+        : cls === 'byok' ? settings.rawKey(byokNamespace(byokParts.provider))
+        : settings.rawKey(cls);
+
+      if (cls === 'byok' && (!byokParts.provider || !byokParts.model)) {
+        const err = new Error(
+          "byok: model must be \"<provider>:<model>\" (pick one from /models) — got " +
+            JSON.stringify(model || '')
+        );
+        err.status = 400;
+        throw err;
+      }
+      if (cls === 'byok' && !apiKey) {
+        const err = new Error(
+          `byok: no key saved for "${byokParts.provider}" — add one before chatting with this model.`
+        );
+        err.status = 400;
+        throw err;
+      }
 
       // Custom classes carry no enumerable model list (see listModels), so a
       // blank id here means the user never typed one. Fail loudly in-process

package/lib/sync/sessions.js

@@ -8,7 +8,7 @@
  * `sessions.json`, while the terminal host kept `~/.aegiscode/history.jsonl`
  * and the MCP plugin could see neither — three hosts, one account, three
  * disjoint views of the conversation. The implementation now lives in
- * `client/session-store.js`, which is the tree all three hosts already bundle,
+ * `client/session-store.js`, which is the tree every host already bundles,
  * and every call here forwards to it.
  *
  * Two things that matter are deliberately unchanged:

package/main.js

@@ -39,7 +39,7 @@ const { createClient } = sharedClient;
 // The shared credential store (`client/credentials.js`) — the same 0600 file
 // the terminal host writes with `aegiscode login` and the MCP plugin reads. The
 // app resolves its own account key through it, so signing in once serves all
-// three hosts; see resolveStartupKey() and persistApiKey() below.
+// four hosts; see resolveStartupKey() and persistApiKey() below.
 let credentials;
 try {
   credentials = require('../client/credentials.js');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -296,6 +296,11 @@ function renderRollMeter(sessionId, live) {
     roll = rollTurn(roll || emptyRoll(), undefined, {
       prompt: live.prompt,
       reply: live.reply,
+      // The thinking trace is billed output too — see `estimatedBuckets`. Left
+      // out, this preview measured only the visible answer, so on a reasoning
+      // model the meter sat on one number for the whole (longest, priciest)
+      // phase of the turn and looked dead while the AI was demonstrably working.
+      reasoning: live.reasoning,
     });
   }
   const line = roll ? fmtRoll(roll) : '';
@@ -331,6 +336,7 @@ function ledgerFields(usage, model, turn, text) {
     calls: text && text.calls,
     prompt: text && text.prompt,
     reply: text && text.reply,
+    reasoning: text && text.reasoning,
   });
   const fields = row ? Object.assign({}, row) : {};
   if (model) fields.model = model;
@@ -2652,6 +2658,12 @@ async function loadModels(cls) {
       hint = null; // carries a link, built below
     } else if (!list.length) {
       hint = cls === 'ollama' ? 'Ollama not running or no models pulled.' : 'No models listed.';
+    } else if (cls === 'byok' && data && data.needsProviderKey) {
+      // Unlike the pooled 'aegis' class, byok still shows every model here —
+      // the catalog answers with no key at all — but none of them are
+      // usable until a provider key is saved in Provider settings below.
+      hint = `${list.length} model${list.length === 1 ? '' : 's'} available — ` +
+        'add a provider key in Provider settings below to use one.';
     } else {
       hint = `${list.length} model${list.length === 1 ? '' : 's'} available.`;
     }
@@ -2712,6 +2724,71 @@ function applyCustomPreset(cls, modelId) {
 
 // -------------------------------------------------------------- settings pane
 
+/**
+ * One provider-settings row: name, an optional base-URL field, a key input,
+ * a status label and Save/Remove buttons wired to the generic
+ * `models.settings.*` surface. Shared by the two custom endpoints (which
+ * need a base URL) and the byok providers (which do not — the server
+ * dictates the endpoint; only the key is theirs to set).
+ */
+function buildSettingRow({ provider, name, cfg, showBaseURL, onSave, onRemove }) {
+  const row = document.createElement('div');
+  row.className = 'setting-row';
+  // Targeted by applyCustomPreset() so picking a Model-card preset can
+  // quick-fill the matching base URL here without a full loadSettings()
+  // round trip.
+  row.dataset.provider = provider;
+
+  const label = document.createElement('div');
+  label.className = 'setting-name';
+  label.textContent = name;
+  row.appendChild(label);
+
+  let baseInput = null;
+  if (showBaseURL) {
+    baseInput = document.createElement('input');
+    baseInput.type = 'text';
+    baseInput.className = 'setting-input setting-base';
+    baseInput.placeholder = 'base URL';
+    baseInput.value = cfg.baseURL || '';
+    row.appendChild(baseInput);
+  }
+
+  const keyInput = document.createElement('input');
+  keyInput.type = 'password';
+  keyInput.className = 'setting-input';
+  keyInput.placeholder = cfg.configured
+    ? `key ${cfg.keyMask} (blank = keep)`
+    : 'API key';
+  row.appendChild(keyInput);
+
+  const status = document.createElement('div');
+  status.className = 'setting-status';
+  status.textContent = cfg.configured ? `configured (${cfg.keyMask})` : 'no key';
+  row.appendChild(status);
+
+  const actions = document.createElement('div');
+  actions.className = 'setting-actions';
+
+  const saveBtn = document.createElement('button');
+  saveBtn.type = 'button';
+  saveBtn.className = 'ghost-btn';
+  saveBtn.textContent = 'Save';
+  saveBtn.addEventListener('click', () => onSave(baseInput ? baseInput.value.trim() : '', keyInput.value));
+  actions.appendChild(saveBtn);
+
+  const removeBtn = document.createElement('button');
+  removeBtn.type = 'button';
+  removeBtn.className = 'ghost-btn danger';
+  removeBtn.textContent = 'Remove';
+  removeBtn.disabled = !cfg.configured;
+  removeBtn.addEventListener('click', onRemove);
+  actions.appendChild(removeBtn);
+
+  row.appendChild(actions);
+  return row;
+}
+
 async function loadSettings() {
   els.settingsList.innerHTML = '';
   let settings = [];
@@ -2736,61 +2813,38 @@ async function loadSettings() {
       configured: false,
       keyMask: null,
     };
-
-    const row = document.createElement('div');
-    row.className = 'setting-row';
-    // Targeted by applyCustomPreset() so picking a Model-card preset can
-    // quick-fill the matching base URL here without a full loadSettings()
-    // round trip.
-    row.dataset.provider = provider;
-
-    const label = document.createElement('div');
-    label.className = 'setting-name';
-    label.textContent = name;
-    row.appendChild(label);
-
-    const baseInput = document.createElement('input');
-    baseInput.type = 'text';
-    baseInput.className = 'setting-input setting-base';
-    baseInput.placeholder = 'base URL';
-    baseInput.value = cfg.baseURL || '';
-    row.appendChild(baseInput);
-
-    const keyInput = document.createElement('input');
-    keyInput.type = 'password';
-    keyInput.className = 'setting-input';
-    keyInput.placeholder = cfg.configured
-      ? `key ${cfg.keyMask} (blank = keep)`
-      : 'API key';
-    row.appendChild(keyInput);
-
-    const status = document.createElement('div');
-    status.className = 'setting-status';
-    status.textContent = cfg.configured ? `configured (${cfg.keyMask})` : 'no key';
-    row.appendChild(status);
-
-    const actions = document.createElement('div');
-    actions.className = 'setting-actions';
-
-    const saveBtn = document.createElement('button');
-    saveBtn.type = 'button';
-    saveBtn.className = 'ghost-btn';
-    saveBtn.textContent = 'Save';
-    saveBtn.addEventListener('click', () =>
-      saveSetting(provider, baseInput.value.trim(), keyInput.value)
-    );
-    actions.appendChild(saveBtn);
-
-    const removeBtn = document.createElement('button');
-    removeBtn.type = 'button';
-    removeBtn.className = 'ghost-btn danger';
-    removeBtn.textContent = 'Remove';
-    removeBtn.disabled = !cfg.configured;
-    removeBtn.addEventListener('click', () => removeSetting(provider));
-    actions.appendChild(removeBtn);
-
-    row.appendChild(actions);
-    els.settingsList.appendChild(row);
+    els.settingsList.appendChild(buildSettingRow({
+      provider, name, cfg, showBaseURL: true,
+      onSave: (baseURL, key) => saveSetting(provider, baseURL, key),
+      onRemove: () => removeSetting(provider),
+    }));
+  }
+
+  // byok: one row per provider the server's catalog names (GET
+  // /api/v1/byok/providers via the engine's listModels('byok')), not a fixed
+  // pair like the two custom endpoints above — the catalog is the source of
+  // truth so a provider added server-side shows up here with no client
+  // release. No base-URL field: byok always talks to AEGIS's own relay
+  // (/api/v1/byok/chat/completions), which is what attaches the AEGIS key
+  // and makes the call billable — the provider key typed here authenticates
+  // to the UPSTREAM provider only.
+  try {
+    const byokData = await models.listModels('byok');
+    const byokProviders = Array.isArray(byokData && byokData.providers) ? byokData.providers : [];
+    for (const p of byokProviders) {
+      if (!p || !p.id) continue;
+      const provider = `byok:${p.id}`;
+      const local = settings.find((s) => s.provider === provider) || {
+        provider, baseURL: '', configured: false, keyMask: null,
+      };
+      els.settingsList.appendChild(buildSettingRow({
+        provider, name: `BYOK: ${p.label || p.id}`, cfg: local, showBaseURL: false,
+        onSave: (_baseURL, key) => saveSetting(provider, '', key),
+        onRemove: () => removeSetting(provider),
+      }));
+    }
+  } catch {
+    /* catalog unreachable (offline, server down) — the two custom rows above still work */
   }
 }
 
@@ -3168,7 +3222,7 @@ async function send() {
     // Live estimate so the topbar meter keeps moving while the reply streams
     // in, instead of sitting frozen on the previous turn's total until this
     // one resolves — see renderRollMeter's `live` param.
-    renderRollMeter(sessionId, { prompt, reply: streamedText });
+    renderRollMeter(sessionId, { prompt, reply: streamedText, reasoning: reasoningText });
     stickToBottom();
   });
 
@@ -3248,7 +3302,7 @@ async function send() {
     // count is never read as a reported one. Printing nothing here while the
     // session total moved was the other half of "the counter looks dead".
     else {
-      const est = estimatedBuckets(prompt, text);
+      const est = estimatedBuckets(prompt, text, text === reasoningText ? '' : reasoningText);
       if (est) bits.push(`~${est.input + est.output} tokens`);
     }
     if (turn.cost != null) bits.push(fmtCost(turn.cost, turn.real));
@@ -3267,6 +3321,10 @@ async function send() {
       // CLI's `appendHistory` rule and the reason the total moves every turn.
       prompt,
       reply: text,
+      // The thinking trace is billed output and is not part of `text`, so it is
+      // counted here too — guarded, because the same string must never be
+      // estimated twice if a turn ever collapses the two into one.
+      reasoning: text === reasoningText ? '' : reasoningText,
     });
     const rollLine = fmtRoll(roll);
     if (rollLine) bits.push(`session: ${rollLine}`);
@@ -3282,6 +3340,10 @@ async function send() {
         ...ledgerFields(data && data.usage, model, turn, {
           prompt,
           reply: text,
+          // The thinking trace is billed output and is not part of `text`; it
+          // has to persist too, or reopening the window rebuilds a roll short
+          // by the longest part of the turn.
+          reasoning: text === reasoningText ? '' : reasoningText,
           calls: data && data.calls,
         }),
       });
@@ -3316,11 +3378,16 @@ async function send() {
       // on this path the figure is the text estimate, marked `est` — and
       // never a fabricated zero.
       const turn = turnAccounting(undefined, model, {});
-      const roll = foldRoll(sessionId, undefined, { model, prompt, reply: text });
+      const roll = foldRoll(sessionId, undefined, {
+        model,
+        prompt,
+        reply: text,
+        reasoning: text === reasoningText ? '' : reasoningText,
+      });
       const stopBits = ['stopped by you'];
       if (turn.tokens != null) stopBits.push(`tokens: ${turn.tokens}`);
       else {
-        const est = estimatedBuckets(prompt, text);
+        const est = estimatedBuckets(prompt, text, text === reasoningText ? '' : reasoningText);
         if (est) stopBits.push(`~${est.input + est.output} tokens`);
       }
       const stopRollLine = fmtRoll(roll);
@@ -3330,7 +3397,11 @@ async function send() {
         await sync.append(sessionId, {
           role: 'assistant',
           content: text,
-          ...ledgerFields(undefined, model, turn, { prompt, reply: text }),
+          ...ledgerFields(undefined, model, turn, {
+            prompt,
+            reply: text,
+            reasoning: text === reasoningText ? '' : reasoningText,
+          }),
         });
       } catch {
         /* persistence is non-fatal */

package/renderer/usage.js

@@ -99,17 +99,29 @@ function estimateTokens(text) {
  * genuinely reported nothing (no usage, no prompt, no reply) still lands in
  * `unknown` instead of being handed a fabricated zero.
  *
+ * `reasoning` is the extended-thinking trace, and it is OUTPUT: a reasoning
+ * model bills its chain of thought as output tokens, which is why the wire's
+ * own `output_tokens` already includes it. The desktop renders that trace in
+ * its own element (app.js `reasoningText`) rather than in the reply body, so
+ * the two streams had to be added back together here — an estimate measured off
+ * the visible answer alone sat still for the entire think phase, which on a
+ * reasoning model is both the longest and the most expensive part of the turn.
+ *
  * @param {string} [prompt]
  * @param {string} [reply]
+ * @param {string} [reasoning]
  * @returns {{input: number, output: number, cacheRead: number, cacheWrite: number}|null}
  */
-function estimatedBuckets(prompt, reply) {
+function estimatedBuckets(prompt, reply, reasoning) {
   const hasPrompt = typeof prompt === 'string' && prompt.length > 0;
-  const hasReply = typeof reply === 'string' && reply.length > 0;
+  const out =
+    (typeof reply === 'string' ? reply : '') +
+    (typeof reasoning === 'string' ? reasoning : '');
+  const hasReply = out.length > 0;
   if (!hasPrompt && !hasReply) return null;
   return {
     input: estimateTokens(prompt),
-    output: estimateTokens(reply),
+    output: estimateTokens(out),
     cacheRead: 0,
     cacheWrite: 0,
     real: false,
@@ -250,6 +262,8 @@ function turnAccounting(usage, model, opts = {}) {
  * back is that RUNNING TOTAL. The status bar prints `state.tokens`
  * (renderStatus), and `ctrl+t` prints the tallies in one line
  * (`tokenSummary`: `12,400 tok (10,100 in / 2,300 out) · 4 calls · €0.03`).
+ * The tallies are reproduced; that one abbreviation is not — `fmtRoll` explains
+ * why it drops the parenthetical rather than carrying the CLI's line verbatim.
  *
  * The desktop counted per turn only. Every meta row was a fresh count that
  * reset at the next call, so "what has this session spent" was answerable only
@@ -337,7 +351,7 @@ function rollTurn(roll, usage, opts = {}) {
     // estimate here is what makes the live roll and the rebuilt roll the same
     // number, and what stops the total standing still on exactly the turns the
     // pool declined to report on — the symptom this fallback exists to remove.
-    const est = estimatedBuckets(opts.prompt, opts.reply);
+    const est = estimatedBuckets(opts.prompt, opts.reply, opts.reasoning);
     if (!est) {
       // Nothing reported AND no text to estimate from. The single case that
       // stays uncounted: `unknown` names the gap, where a fabricated zero would
@@ -439,7 +453,10 @@ function ledgerRow(usage, turn, opts = {}) {
     if (calls !== undefined) row.calls = calls;
     return row;
   }
-  const est = estimatedBuckets(opts.prompt, opts.reply);
+  // `reasoning` is part of the billed output, so it is estimated with the
+  // reply — a stored row for a thinking-heavy turn must not persist a count
+  // that excludes the longest thing the model wrote.
+  const est = estimatedBuckets(opts.prompt, opts.reply, opts.reasoning);
   if (!est) return null;
   const row = { tokens: est };
   if (calls !== undefined) row.calls = calls;
@@ -471,28 +488,30 @@ function fmtTokens(n) {
  * an untouched session adds no noise to a turn's meta line.
  *
  * @param {object} [roll]
- * @returns {string} e.g. `12,400 tok (10,100 in / 2,300 out) · 4 calls · $0.0310`
+ * @returns {string} e.g. `12,400 tok · 4 calls · $0.0310` — the CLI's fields in
+ *   the CLI's order, minus the input/output parenthetical (see below).
  */
 function fmtRoll(roll) {
   const r = roll || emptyRoll();
   if (!r.turns && !r.calls) return '';
-  // The first two fields are `tokenSummary` (cli/src/app.js:1413) verbatim,
-  // separator and all: `12,400 tok (10,100 in / 2,300 out) · 4 calls`. There the
-  // parenthetical is unconditional and the call count is singular at one; both
-  // are kept, because a line that is only *sometimes* shaped like the CLI's is a
-  // lookalike rather than the same quantity. The call count is also the number
-  // that reveals a fan-out, which is why it is not hidden at 1.
+  // The fields are `tokenSummary`'s (cli/src/app.js:1413) in its order — tokens,
+  // calls, money — with one dropped: the `(10,100 in / 2,300 out)` split. `in`
+  // and `out` are a terminal status-line shorthand, legible to someone already
+  // reading that status line and to nobody else, which is what an unlabelled
+  // abbreviation in a GUI topbar turns into. The total is the figure a reader
+  // wants; `r.input`/`r.output` are still folded onto the roll (see `rollTurn`)
+  // for any surface that wants to show the split with real labels. The call
+  // count stays unconditional, because it is the number that reveals a
+  // fan-out, and it is not hidden at 1.
   const bits = [];
   // The token half only when something was actually counted. `rollTurn` counts
   // turns and calls BEFORE it looks at the token count, so a dispatch that
   // reported nothing still reaches here — and printing its empty tally would
-  // put `0 tok (0 in / 0 out)` on the topbar, a figure the meter never took,
-  // which reads as a counter that does not move. The turn count is still
-  // stated, because that much is true.
+  // put `0 tok` on the topbar, a figure the meter never took, which reads as a
+  // counter that does not move. The turn count is still stated, because that
+  // much is true.
   if (r.tokens > 0) {
-    bits.push(
-      `${fmtTokens(r.tokens)} tok (${fmtTokens(r.input)} in / ${fmtTokens(r.output)} out)`
-    );
+    bits.push(`${fmtTokens(r.tokens)} tok`);
   }
   bits.push(`${r.calls} call${r.calls === 1 ? '' : 's'}`);
   // Money is where this line departs from `tokenSummary`, deliberately: that

package/vendor/aegis.js

@@ -7,10 +7,13 @@
  * orchestration, routing, or tier logic. All of that lives in the private
  * ae-guix product and behind aegiscloud.org.
  *
- * Runs unchanged under three hosts:
+ * Runs unchanged under four hosts:
  *   - mcp/server.js   (Claude Code MCP plugin)         — CommonJS require
  *   - desktop/        (thin Electron shell)            — CommonJS require
  *                     (vendored byte-identical copy at desktop/vendor/aegis.js)
+ *   - cli/            (aegiscode terminal host)        — CommonJS require
+ *                     (vendored byte-identical copy at
+ *                      cli/vendor/client/aegis.js)
  *   - aegis-online    (browser SPA, vendored copy)     — <script> tag →
  *                     window.AegisClient
  *
@@ -348,6 +351,12 @@ function createClient(opts = {}) {
    * provider key never touches AEGIS storage — it is forwarded straight to the
    * provider for this request only. Mirrors chatCompletion()'s streaming /
    * fallback semantics exactly.
+   *
+   * The caller's *AEGIS* key is sent alongside the provider key as X-AEGIS-Key.
+   * Two credentials, two headers, on purpose: the provider key authenticates the
+   * upstream call, the AEGIS key says whose bank pays the handling fee. With no
+   * AEGIS key configured the header is omitted and the call stays anonymous —
+   * allowed, just unbilled (see _byok_identify_user on the server).
    */
   async function byokChatCompletion({
     provider = 'openai',
@@ -373,6 +382,10 @@ function createClient(opts = {}) {
       'X-AEGIS-Version': clientVersion,
       'X-Provider-Key': key,
     };
+    // Identify the payer. Absent key => anonymous call, which the server
+    // accepts but cannot bill; sending it is what turns a BYOK turn into
+    // billable traffic instead of a free ride.
+    if (apiKey) headers['X-AEGIS-Key'] = apiKey;
     if (!stream || typeof onStream !== 'function') {
       return apiPost('/api/v1/byok/chat/completions', { ...body, stream: false }, headers);
     }
@@ -683,6 +696,15 @@ function createClient(opts = {}) {
     return apiGet('/api/user/api-keys');
   }
 
+  /** The server's BYOK provider catalog: which providers accept a key, which
+   *  models each unlocks, where to get the key, and the prefix a valid key
+   *  starts with. Deliberately NOT key-gated — "which key do I go get, and
+   *  what will it unlock?" is the question asked *before* an AEGIS key exists.
+   *  An AEGIS key, if present, only adds the `configured` column. */
+  async function byokProviders() {
+    return apiGet('/api/v1/byok/providers');
+  }
+
   async function byokSet(provider, providerApiKey) {
     return apiPost('/api/user/api-keys', {
       provider,
@@ -809,6 +831,7 @@ function createClient(opts = {}) {
     tokenBankTopup,
     billingCheckout,
     byokStatus,
+    byokProviders,
     byokSet,
     getMemoryToken,
     memorySearch,

package/vendor/credentials.js

@@ -4,13 +4,13 @@
  * credentials.js — the ONE AEGIS account credential store, shared by every
  * host in this repo (terminal `aegiscode`, the MCP plugin, the desktop app).
  *
- * Why it lives in `client/`: this directory is the only tree all three hosts
- * already bundle. The MCP plugin ships `mcp/` + `client/` and nothing else, so
+ * Why it lives in `client/`: this directory is the only tree every host
+ * already bundles. The MCP plugin ships `mcp/` + `client/` and nothing else, so
  * a reader placed here needs no cross-package dependency — which is what the
  * alternative (the MCP host requiring `cli/src/credentials.js`) would have
  * forced, and why that host used to read `AEGIS_API_KEY` from the environment
- * alone while the CLI could save a key to disk. One login, one file, three
- * hosts: that is the point of this module.
+ * alone while the CLI could save a key to disk. One login, one file, all
+ * four hosts: that is the point of this module.
  *
  * Zero dependencies, no host imports. The data dir is resolved here
  * (`aegisHome()`) rather than imported from the CLI's config.js, so this file