aegis-desktop 0.7.7 → 0.7.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
@@ -29,7 +29,7 @@
     "icon": "node scripts/generate-icon.mjs",
     "dist": "npm run predist && electron-builder",
     "dist:dir": "npm run predist && electron-builder --dir",
-    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check lib/local/context.js && node --check lib/local/providers.js && node --check lib/local/ollama.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check bin/aegis.js",
+    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/preset-fill.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check lib/local/context.js && node --check lib/local/providers.js && node --check lib/local/ollama.js && node --check lib/local/engine.js && node --check lib/local/endpoints.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check bin/aegis.js",
     "test:shell": "node ../test/desktop-shell.mjs",
     "test:model": "node ../test/model-dispatch.mjs",
     "test:budget": "node ../test/budget.test.mjs",
@@ -43,7 +43,8 @@
     "test:preview-read": "node ../test/desktop-preview-read.test.mjs",
     "test:stream-policy": "node ../test/stream-policy.test.mjs",
     "test:renderer-dom": "node ../test/renderer-dom.test.mjs",
-    "test:renderer-wiring": "node ../test/renderer-wiring.test.mjs"
+    "test:renderer-wiring": "node ../test/renderer-wiring.test.mjs",
+    "test:preset-fill": "node ../test/preset-fill.test.mjs"
   },
   "dependencies": {
     "electron": "^33.0.0",

package/renderer/app.js

@@ -165,48 +165,53 @@ const EXPLORE_KEY = 'aegis.explore';
 // is only billable/routable through the pooled AEGIS Cloud class.
 const AUTONOMOUS_CLASS = 'aegis';
 const CUSTOM_CLASSES = new Set(['openai-compat', 'anthropic']);
+// Custom classes currently holding a base URL the engine refuses (not local).
+// Tracked so the UI can explain the dead class, and so a preset click may
+// REPLACE the refused URL — applyCustomPreset otherwise never clobbers a
+// configured endpoint, which would leave a blocked row unfixable by click.
+const blockedCustomClasses = new Set();
 // Placeholders for the typed model-id field: custom endpoints enumerate
-// nothing, so the field has to say what a valid id looks like.
+// nothing, so the field has to say what a valid id looks like. The examples
+// are local-server ids — a hosted model id here would advertise a route this
+// class no longer has (see the preset note below).
 const MODEL_ID_PLACEHOLDER = {
-  'openai-compat': 'type a model id — e.g. gpt-4o-mini',
-  anthropic: 'type a model id — e.g. claude-sonnet-4-5',
+  'openai-compat': 'type a model id — e.g. llama3.2',
+  anthropic: 'type a model id — e.g. claude-3-5-sonnet',
 };
 // Quick-fill presets for the two custom-endpoint classes — model id + the
 // base URL it actually lives at, since typing the right model string is only
-// half the problem (the wrong base URL 400s just as hard). Base URLs and
-// default model ids match aegis1 services/nexus_provider/catalog.py exactly:
-// DeepSeek is served via Anthropic-Messages transport, Gemini via
-// OpenAI-chat transport — that is why each shows up under the *other*
-// custom class from what its own name suggests.
+// half the problem (the wrong base URL 400s just as hard).
+//
+// EVERY base URL HERE IS LOCAL, AND THAT IS THE POLICY, NOT AN OMISSION.
+// These two classes are the free direct lane: aegiscode dials the base URL
+// itself, so a remote one would be a model nobody bills. desktop/lib/local/
+// endpoints.js refuses a non-local base URL for both of them, at the settings
+// store (so the row cannot be created) and again at dispatch (so a row hand
+// edited onto disk cannot be dialed). The hosted providers that used to be
+// listed here — OpenAI, Anthropic, Gemini, and DeepSeek (whose live ids,
+// served over DeepSeek's Anthropic-Messages transport, are `deepseek-flash`
+// and `deepseek-v4-pro`) — are all in the relay's BYOK catalog, so their
+// correct home is now the **Bring your own key** class, which bills the flat
+// handling fee. Adding one back here would revive a route that is refused on
+// save.
+//
+// The two transports stay distinct because wire format is not inferable from
+// a local URL: `openai-compat` posts /chat/completions, `anthropic` posts the
+// Messages API. A given local server answers one of them, so pick the class
+// that matches what it serves. A preset's model id is what gets pinned, and
+// for a local server that id is whatever *you* loaded — the ids below are the
+// servers' own conventional defaults, and the field still invites your own.
 const CUSTOM_MODEL_PRESETS = {
   'openai-compat': [
-    { label: 'OpenAI — gpt-4o-mini', baseURL: 'https://api.openai.com/v1', model: 'gpt-4o-mini' },
-    { label: 'OpenAI — gpt-4o', baseURL: 'https://api.openai.com/v1', model: 'gpt-4o' },
-    {
-      label: 'Gemini — 3.5 Flash',
-      baseURL: 'https://generativelanguage.googleapis.com/v1beta/openai/',
-      model: 'gemini-3.5-flash',
-    },
+    { label: 'Ollama (OpenAI-compatible shim)', baseURL: 'http://127.0.0.1:11434/v1', model: 'llama3.2' },
+    { label: 'LM Studio', baseURL: 'http://127.0.0.1:1234/v1', model: 'local-model' },
+    { label: 'vLLM', baseURL: 'http://127.0.0.1:8000/v1', model: 'local-model' },
+    { label: 'llama.cpp', baseURL: 'http://127.0.0.1:8080/v1', model: 'local-model' },
   ],
   anthropic: [
-    { label: 'Anthropic — Claude Sonnet 5', baseURL: 'https://api.anthropic.com/v1', model: 'claude-sonnet-5' },
-    { label: 'Anthropic — Claude Haiku 4.5', baseURL: 'https://api.anthropic.com/v1', model: 'claude-haiku-4-5' },
-    // DeepSeek's live API serves exactly two ids (verified against
-    // GET https://api.deepseek.com/v1/models): `deepseek-flash` — the current
-    // generation, which DeepSeek calls "Flash 4.1" — and the slow tier
-    // `deepseek-v4-pro`, retired 2026-09-14 and now served as 4.1 too. The
-    // preset that used to sit here, `deepseek-v4-flash`, is a *legacy alias*
-    // DeepSeek keeps alive only for configs already carrying it, so the picker
-    // was advertising a previous generation by its dead id. Ids and labels
-    // match aegiscodex-dev src/models.js; the base URL is DeepSeek's
-    // Anthropic-Messages transport (aegis1 services/nexus_provider/catalog.py
-    // DEEPSEEK_DEFAULT_BASE), which is why these two sit under this class and
-    // not the OpenAI-compatible one. Both ids are reasoning models: the token
-    // budget for them is the Effort rung, never a stated number (they bill
-    // hidden chain-of-thought against the same budget as the answer — see
-    // budget.js).
-    { label: 'DeepSeek — Flash 4.1', baseURL: 'https://api.deepseek.com/anthropic', model: 'deepseek-flash' },
-    { label: 'DeepSeek — V4 Pro (retired → 4.1)', baseURL: 'https://api.deepseek.com/anthropic', model: 'deepseek-v4-pro' },
+    // Anything local that speaks the Anthropic Messages API — a LiteLLM
+    // proxy, claude-code-router, or a gateway on your own LAN.
+    { label: 'LiteLLM proxy (Messages API)', baseURL: 'http://127.0.0.1:4000', model: 'local-model' },
   ],
 };
 // The in-app AEGIS key is stored in a reserved namespace the main process
@@ -422,12 +427,17 @@ function abortBranches() {
 // instead of only as pure math in stream-policy.js.
 
 /**
- * Set when the user asks the running turn to stop. The abort comes back as a
- * rejected IPC call, which does not preserve `err.name`, so this flag — not an
- * AbortError check — is what distinguishes a stop the user asked for from a
- * genuine failure.
+ * Turn identity, for the stop path. `turnSeq` is monotonic and never reset;
+ * `runningTurn` is the token of the turn in progress (null when idle) and
+ * `stoppedTurn` the token already asked to stop. The abort is not
+ * instantaneous, so a second Escape lands while the first turn still looks
+ * running — comparing tokens (see `stopAppliesTo`) is what keeps that second
+ * press from re-entering, and what stops a held key's repeats from reaching the
+ * *next* turn once this one has ended.
  */
-let userStopped = false;
+let turnSeq = 0;
+let runningTurn = null;
+let stoppedTurn = null;
 
 /**
  * Transcript policy, created by init(): the reader's scroll veto, the
@@ -461,9 +471,16 @@ function rafPainter(paint) {
  */
 function stopPendingTurn() {
   if (!pendingSessionId) return false;
+  // Idempotent, and scoped to the turn that is actually running: a second press
+  // during teardown is the same intent (`stopAppliesTo` returns false and
+  // nothing is re-entered). A held key's repeats are refused earlier, by the
+  // `e.repeat` guard in transcript-view.js.
+  if (!stopAppliesTo(runningTurn, stoppedTurn)) return false;
   // Recorded before the abort lands: `send()`'s catch reads it to tell a
-  // deliberate stop from a real error.
-  userStopped = true;
+  // deliberate stop from a real error. Scoped to this one turn — a global flag
+  // could be left `true` by an earlier turn and make an unrelated transport
+  // failure look like a stop the user asked for.
+  stoppedTurn = runningTurn;
   try {
     models.cancel(pendingSessionId);
   } catch {
@@ -2319,8 +2336,11 @@ function captureDiffPreview(tool) {
  * already ran, so this is a retrospective log line, not a live spinner.
  */
 function toolActivityLabel(tool) {
-  const { name, args, ok } = tool || {};
-  const mark = ok === false ? '✗' : '✓';
+  const { name, args } = tool || {};
+  // The glyph is `toolMark`'s decision, not `ok === false ? '✗' : '✓'`: a call
+  // whose result never arrived (aborted between call and result) used to draw
+  // as ✓, claiming success for work this turn never finished.
+  const mark = toolMark(tool);
   const a = args || {};
   if (name === 'task') {
     const kind = a.subagent_type && a.subagent_type !== 'general' ? a.subagent_type : 'general';
@@ -2571,9 +2591,25 @@ async function loadModels(cls) {
     // `model: "<url>"` and 400'd upstream). `needsModelId` is what turns this
     // into an explicit "type a model id" prompt rather than an empty picker.
     let needsModelId = true;
+    // A row whose stored base URL is not local is refused by the engine — at
+    // storage, at dispatch, and here. This is the here: without the reason the
+    // class just looks armed and then fails on send, so capture it from the
+    // same call that reports `needsModelId` and show it in place of the
+    // endpoint line. It is recoverable by design — the text says how.
+    let blockedReason = '';
     try {
       const data = await models.listModels(cls);
       if (data && typeof data.needsModelId === 'boolean') needsModelId = data.needsModelId;
+      if (data && typeof data.blockedReason === 'string' && data.blockedReason) {
+        blockedReason = data.blockedReason;
+      }
+      // Track the refusal against the class itself: applyCustomPreset() reads
+      // this set to know that the row's stored endpoint is dead and may be
+      // replaced by a click. A class that lists without a reason is cleared
+      // again, so the replacement exception never widens past rows the engine
+      // is actually refusing.
+      if (blockedReason) blockedCustomClasses.add(cls);
+      else blockedCustomClasses.delete(cls);
       if (data && typeof data.baseURL === 'string' && data.baseURL) {
         cfg = { ...cfg, baseURL: data.baseURL };
       }
@@ -2622,10 +2658,12 @@ async function loadModels(cls) {
     els.modelInput.placeholder = needsModelId
       ? MODEL_ID_PLACEHOLDER[cls] || 'type a model id'
       : 'model id';
-    els.modelHint.textContent = cfg.baseURL
-      ? `endpoint: ${cfg.baseURL} · key: ${cfg.configured ? cfg.keyMask : 'not set'}` +
-        (needsModelId ? ' · type a model id above' : '')
-      : 'Set base URL + key in Provider settings, then type a model id.';
+    els.modelHint.textContent = blockedReason
+      ? blockedReason
+      : cfg.baseURL
+        ? `endpoint: ${cfg.baseURL} · key: ${cfg.configured ? cfg.keyMask : 'not set'}` +
+          (needsModelId ? ' · type a model id above' : '')
+        : 'Set base URL + key in Provider settings, then type a model id.';
     return;
   }
 
@@ -2658,6 +2696,16 @@ async function loadModels(cls) {
       hint = null; // carries a link, built below
     } else if (!list.length) {
       hint = cls === 'ollama' ? 'Ollama not running or no models pulled.' : 'No models listed.';
+    } else if (cls === 'byok' && data && data.needsAegisKey) {
+      // Enforced by this CLIENT, not by the server, so it no longer waits on
+      // the server's fee.require_balance flag (off by default): the shared
+      // local engine refuses a keyless BYOK send outright (401), because an
+      // unattributed turn is served and billed to nobody — the fee lands on
+      // user 0 as uncollected. Saying "required" here is now literal, not a
+      // nudge. Checked BEFORE needsProviderKey because the account key is the
+      // blocker and the provider key is not yet the question.
+      hint = `${list.length} model${list.length === 1 ? '' : 's'} available — ` +
+        'an AEGIS account key is required: the BYOK handling fee is billed there.';
     } else if (cls === 'byok' && data && data.needsProviderKey) {
       // Unlike the pooled 'aegis' class, byok still shows every model here —
       // the catalog answers with no key at all — but none of them are
@@ -2699,6 +2747,12 @@ async function loadModels(cls) {
  * already-configured base URL is left alone (never silently overwritten) —
  * if it doesn't match what the preset expects, the hint says so instead, so
  * the user's own custom endpoint can't be clobbered by a stray click.
+ *
+ * The one exception is a BLOCKED row: when the engine refuses the stored
+ * endpoint (non-local — see blockedCustomClasses), there is nothing left to
+ * preserve, so the preset URL overwrites the field unconditionally. Without
+ * that, the local-only policy would leave the row unfixable by click; the
+ * hint then tells the user to Save so the replacement is actually stored.
  */
 function applyCustomPreset(cls, modelId) {
   const preset = (CUSTOM_MODEL_PRESETS[cls] || []).find((p) => p.model === modelId);
@@ -2712,14 +2766,17 @@ function applyCustomPreset(cls, modelId) {
   const row = els.settingsList.querySelector(`.setting-row[data-provider="${cls}"]`);
   const baseInput = row && row.querySelector('.setting-base');
   if (!baseInput) return;
-  const current = baseInput.value.trim();
-  if (!current) {
-    baseInput.value = preset.baseURL;
-    els.modelHint.textContent = `filled in — click Save in Provider settings below to store the ${preset.label} endpoint.`;
-  } else if (current !== preset.baseURL) {
-    els.modelHint.textContent =
-      `${preset.label} needs base URL ${preset.baseURL} — Provider settings below has ${current}. Update it there too.`;
-  }
+
+  // Which branch applies (fill / refuse-to-clobber / repair a blocked row) is
+  // preset-fill.js's decision, unit-tested there. This function only writes
+  // what it returns — `null` on either field means leave it as it is.
+  const plan = planPresetFill({
+    preset,
+    current: baseInput.value.trim(),
+    blocked: blockedCustomClasses.has(cls),
+  });
+  if (plan.baseURL !== null) baseInput.value = plan.baseURL;
+  if (plan.hint !== null) els.modelHint.textContent = plan.hint;
 }
 
 // -------------------------------------------------------------- settings pane
@@ -2843,6 +2900,29 @@ async function loadSettings() {
         onRemove: () => removeSetting(provider),
       }));
     }
+    // What AEGIS charges for relaying the turn, stated outright. The figure is
+    // the server's own (`fee` on GET /api/v1/byok/providers); nothing is shown
+    // when it publishes none, because a hardcoded client-side fee is one that
+    // can drift from the ledger that actually bills. Until this line existed
+    // the only place the fee was ever disclosed was the CLI's `/class byok`
+    // output — a desktop user's per-turn cost figure was the vendor's rate with
+    // no mention that AEGIS also collects.
+    const fee = byokData && byokData.fee;
+    if (fee && !fee.disabled &&
+        (Number(fee.in_usd_per_1k) > 0 || Number(fee.out_usd_per_1k) > 0)) {
+      const note = document.createElement('div');
+      note.className = 'setting-row';
+      note.id = 'byok-fee-note';
+      const text = document.createElement('div');
+      text.className = 'setting-name';
+      const per1k = (n) => `${Number(n).toFixed(4)}`;
+      text.textContent =
+        `BYOK handling fee: ${per1k(fee.in_usd_per_1k)} / 1k in, ` +
+        `${per1k(fee.out_usd_per_1k)} / 1k out — billed to your AEGIS account ` +
+        'on top of your own provider bill.';
+      note.appendChild(text);
+      els.settingsList.appendChild(note);
+    }
   } catch {
     /* catalog unreachable (offline, server down) — the two custom rows above still work */
   }
@@ -2854,6 +2934,10 @@ async function saveSetting(provider, baseURL, key) {
     const cfg = { baseURL };
     if (key) cfg.key = key;
     await models.settings.set(provider, cfg);
+    // Stored: whatever the engine refused is gone, so drop the blocked mark
+    // and let loadModels() below re-establish it from the fresh refusal (if
+    // any). Replacing a refused endpoint is exactly what unblocks the row.
+    blockedCustomClasses.delete(provider);
     els.settingsHint.textContent = 'saved.';
     await loadSettings();
     await loadModels(els.classSelect.value);
@@ -2867,6 +2951,8 @@ async function removeSetting(provider) {
   els.settingsHint.textContent = 'removing…';
   try {
     await models.settings.remove(provider);
+    // Nothing stored means nothing to refuse; clear the blocked mark too.
+    blockedCustomClasses.delete(provider);
     els.settingsHint.textContent = 'removed.';
     await loadSettings();
     await loadModels(els.classSelect.value);
@@ -3102,6 +3188,11 @@ function newChat() {
   els.sessionsHint.textContent = '';
   pendingEl = null;
   pendingSessionId = null;
+  // A new thread owns no turn: dropping the running token here means any
+  // in-flight `send()` whose teardown has not run yet can no longer match
+  // itself (see the `finally` guard) and cannot clear this thread's state.
+  runningTurn = null;
+  stoppedTurn = null;
   currentSessionId = null;
   threadMessages = [];
   flowCount = 0;
@@ -3155,9 +3246,12 @@ async function send() {
   }
 
   els.prompt.value = '';
-  // Clear the stop flag a previous turn may have left set, so a stale `true`
-  // can never make an unrelated failure look like a deliberate stop.
-  userStopped = false;
+  // This turn's identity. Claiming it here — and clearing `stoppedTurn` —
+  // replaces the old global "userStopped" flag, which any previous turn could
+  // leave set and which this send could only hope to clear in time.
+  const myTurn = ++turnSeq;
+  runningTurn = myTurn;
+  stoppedTurn = null;
   addMessage('user', prompt);
 
   // What this request travels with, resolved from ONE authority by budgetFor:
@@ -3306,6 +3400,15 @@ async function send() {
       if (est) bits.push(`~${est.input + est.output} tokens`);
     }
     if (turn.cost != null) bits.push(fmtCost(turn.cost, turn.real));
+    // …and on the byok class, whose money that figure is. The relay never
+    // returns a settled charge (nothing on that route emits one), so this is
+    // always the rate table's estimate of the caller's OWN provider bill — and
+    // AEGIS additionally collects a handling fee on the same turn, which this
+    // response cannot price. One bit, and the number stops reading as the whole
+    // cost of a BYOK turn.
+    if (cls === 'byok' && turn.cost != null) {
+      bits.push('your provider bill (est.) + AEGIS handling fee');
+    }
     // …AND the running session total beside it, which is the number the CLI
     // prints. The per-turn figure answers "what did that call cost"; only the
     // rolling one answers "what has this conversation cost", and it was the
@@ -3366,8 +3469,13 @@ async function send() {
     // everything already streamed and answer with a red "aborted" error,
     // destroying the partial reply at the exact moment the user asked to keep
     // it. Salvage the partial turn and label it honestly instead.
-    if (isCancellation(err, { userStopped })) {
-      const text = streamedText || reasoningText || '(stopped before any output)';
+    if (isCancellation(err, { userStopped: stoppedTurn === myTurn })) {
+      // Which of the three outcomes this is — answer text, deliberation only,
+      // or nothing — is `salvageTurn`'s decision, so the labelling cannot
+      // drift from the salvage.
+      const salvage = salvageTurn({ streamedText, reasoningText });
+      const text = salvage.text;
+      const salvageReasoning = salvage.reasoning;
       threadMessages.push({ role: 'assistant', content: text });
       // A stopped turn is a real exchange and the CLI records one: its
       // `appendHistory` writes a `status: 'stopped'` entry for every stopped
@@ -3382,12 +3490,13 @@ async function send() {
         model,
         prompt,
         reply: text,
-        reasoning: text === reasoningText ? '' : reasoningText,
+        reasoning: salvageReasoning,
       });
       const stopBits = ['stopped by you'];
+      if (salvage.kind === 'reasoning-only') stopBits.push('reasoning only');
       if (turn.tokens != null) stopBits.push(`tokens: ${turn.tokens}`);
       else {
-        const est = estimatedBuckets(prompt, text, text === reasoningText ? '' : reasoningText);
+        const est = estimatedBuckets(prompt, text, salvageReasoning);
         if (est) stopBits.push(`~${est.input + est.output} tokens`);
       }
       const stopRollLine = fmtRoll(roll);
@@ -3400,7 +3509,7 @@ async function send() {
           ...ledgerFields(undefined, model, turn, {
             prompt,
             reply: text,
-            reasoning: text === reasoningText ? '' : reasoningText,
+            reasoning: salvageReasoning,
           }),
         });
       } catch {
@@ -3419,7 +3528,14 @@ async function send() {
     }
   } finally {
     setBusy(false);
-    pendingSessionId = null;
+    // Only this turn may clear the pending state, and only if it is still the
+    // running one. Unconditionally nulling it here is what let an outgoing
+    // turn's teardown disarm its successor — after which Escape during that
+    // successor did nothing at all.
+    if (runningTurn === myTurn) {
+      runningTurn = null;
+      pendingSessionId = null;
+    }
     loadSessions();
   }
 }

package/renderer/index.html

@@ -444,6 +444,7 @@
   <script src="usage.js"></script>
   <script src="stream-policy.js"></script>
   <script src="transcript-view.js"></script>
+  <script src="preset-fill.js"></script>
   <script src="diff.js"></script>
   <script src="diffview.js"></script>
   <script src="vendor/marked.umd.js"></script>

package/renderer/preset-fill.js

@@ -0,0 +1,79 @@
+'use strict';
+
+/**
+ * The decision behind clicking a Model-card preset: what to type into the
+ * model-id field, whether to touch the base-URL field, and what the hint
+ * should say. Kept out of app.js — like stream-policy.js and budget.js — so
+ * the rule is testable from plain Node without the Electron host. app.js only
+ * calls into this and performs the DOM writes.
+ *
+ * Why it exists: after the local-only endpoint policy, one branch here is
+ * load-bearing rather than cosmetic. A row whose stored endpoint the engine
+ * REFUSES (non-local — see lib/local/endpoints.js) must be repairable by
+ * click. The general rule is "never silently overwrite a configured base URL":
+ * the user's own custom endpoint must not be clobbered by a stray preset
+ * click, so when the field disagrees with the preset the hint says so instead
+ * of writing. That rule would leave a refused row unfixable forever — there is
+ * nothing left to preserve in a URL the engine will not dial — so `blocked`
+ * is the one exception and overwrites outright.
+ *
+ * The return value is a plan, not a mutation: `baseURL: null` and `hint: null`
+ * both mean "leave that alone", which keeps a caller from being able to write
+ * an unintended value by ignoring a field.
+ */
+
+/** What the hint says when the preset's endpoint replaces a refused one. */
+function blockedFillHint(baseURL) {
+  return (
+    `stored endpoint refused — replaced with ${baseURL}; ` +
+    'click Save in Provider settings to replace the refused endpoint.'
+  );
+}
+
+/**
+ * Plan one preset click.
+ *
+ * @param {object}   input
+ * @param {object}   input.preset   a CUSTOM_MODEL_PRESETS entry ({model,baseURL,label})
+ * @param {string}   input.current  the base-URL field's current value, trimmed
+ * @param {boolean}  input.blocked  the engine refused this class's stored endpoint
+ * @returns {{model: string, baseURL: string|null, hint: string|null}|null}
+ *          null when there is no preset to apply (the caller does nothing).
+ */
+function planPresetFill(input) {
+  const args = input || {};
+  const preset = args.preset;
+  // No preset means no click to act on. Guarded on the model id specifically:
+  // the model field is what every branch is required to write.
+  if (!preset || !preset.model) return null;
+  const current = typeof args.current === 'string' ? args.current : '';
+
+  // The one case that overwrites a configured endpoint. Checked first so it
+  // cannot be shadowed by the !current / mismatch branches below.
+  if (args.blocked) {
+    return { model: preset.model, baseURL: preset.baseURL, hint: blockedFillHint(preset.baseURL) };
+  }
+  if (!current) {
+    return {
+      model: preset.model,
+      baseURL: preset.baseURL,
+      hint: `filled in — click Save in Provider settings below to store the ${preset.label} endpoint.`,
+    };
+  }
+  if (current !== preset.baseURL) {
+    return {
+      model: preset.model,
+      baseURL: null, // never clobber a configured endpoint
+      hint: `${preset.label} needs base URL ${preset.baseURL} — Provider settings below has ${current}. Update it there too.`,
+    };
+  }
+  // Already pointing at the preset's endpoint: nothing to write and nothing to
+  // say. `hint: null` rather than '' — the hint element also carries the
+  // endpoint/key line and the max-output suffix, so this branch must not clear
+  // text it did not set.
+  return { model: preset.model, baseURL: null, hint: null };
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = { planPresetFill, blockedFillHint };
+}

package/renderer/stream-policy.js

@@ -83,6 +83,70 @@ function isCancellation(err, opts) {
   return ABORT_SIGNATURES.some((re) => re.test(msg));
 }
 
+/**
+ * Should a stop request reach the turn running right now?
+ *
+ * `runningTurn` is the token of the turn in progress (null when idle) and
+ * `stoppedTurn` is the token already asked to stop. The abort is not
+ * instantaneous — the transport has to unwind before `send()`'s catch runs — so
+ * a second press lands on a turn that is still nominally running. That second
+ * press is the *same* intent and must not re-enter.
+ *
+ * The two writers keep the pair consistent: app.js only ever assigns
+ * `stoppedTurn = runningTurn`, and claiming a new turn sets `stoppedTurn = null`
+ * alongside `runningTurn = myTurn`. So `stoppedTurn` is never some *other*
+ * turn's number, and `runningTurn !== stoppedTurn` means exactly "not already
+ * stopping". What keeps a finished turn's stop off its successor is that
+ * invariant plus the catch's `stoppedTurn === myTurn` — not a refusal here. A
+ * press on a live successor is legitimate and does reach it.
+ */
+function stopAppliesTo(runningTurn, stoppedTurn) {
+  if (runningTurn == null) return false;
+  return runningTurn !== stoppedTurn;
+}
+
+/**
+ * What a cancelled turn leaves on screen, and what it honestly is.
+ *
+ * `streamedText || reasoningText` collapsed two different outcomes into one
+ * string: a turn cut off after real answer text, and a turn cut off with
+ * deliberation but no answer. The second is not a failure and the user should
+ * keep it, but folding it in as if it were the answer loses the distinction —
+ * so the case is named here and the caller labels it. With neither, the
+ * placeholder is still returned rather than an empty bubble.
+ */
+function salvageTurn(input) {
+  const i = input || {};
+  const streamed = typeof i.streamedText === 'string' ? i.streamedText : '';
+  const reasoning = typeof i.reasoningText === 'string' ? i.reasoningText : '';
+  if (streamed) return { text: streamed, reasoning: reasoning, kind: 'answer' };
+  if (reasoning) return { text: reasoning, reasoning: '', kind: 'reasoning-only' };
+  return { text: '(stopped before any output)', reasoning: '', kind: 'empty' };
+}
+
+/**
+ * The status glyph for one tool-activity line.
+ *
+ * Only an explicit `true` is a ✓. A call with no `ok` at all is a call whose
+ * result never arrived — the tool-call-mid-abort case — and drawing it as ✓
+ * claimed success for work the turn never finished. It gets its own mark
+ * instead of ✗, because interrupted is not the same as failed.
+ */
+function toolMark(tool) {
+  const t = tool || {};
+  if (t.ok === true) return '✓';
+  if (t.ok === false) return '✗';
+  return '⊘';
+}
+
 if (typeof module !== 'undefined' && module.exports) {
-  module.exports = { nearBottom, shouldFollow, isCancellation, STICK_SLOP_PX };
+  module.exports = {
+    nearBottom,
+    shouldFollow,
+    isCancellation,
+    stopAppliesTo,
+    salvageTurn,
+    toolMark,
+    STICK_SLOP_PX,
+  };
 }

package/renderer/transcript-view.js

@@ -220,6 +220,11 @@ function bindEscapeInterrupt(deps) {
 
   function handle(e) {
     if (!e || e.key !== 'Escape') return false;
+    // A held key is one intent, not one per repeat. Without this the auto-repeat
+    // events keep arriving after the interrupted turn has already ended, and
+    // the ones that land once the user has sent the next message stop that turn
+    // instead — the keyboard twin of a stuck cancel button.
+    if (e.repeat) return false;
     if (typeof d.isOverlayOpen === 'function' && d.isOverlayOpen()) {
       if (typeof d.onOverlayEscape === 'function') d.onOverlayEscape();
       return false;