aegis-desktop 0.7.7 → 0.7.8

package/renderer/usage.js

@@ -159,23 +159,54 @@ const RATES = {
   deepseek: { input: 0.14, output: 0.28, cacheRead: 0.014, cacheWrite: 0.14 },
 };
 
+/**
+ * The rate rows a model id may name as a whole word rather than as a prefix.
+ * Anthropic spells its family *inside* the id — "claude-opus-4" matches no
+ * prefix — so prefix matching alone cannot see it.
+ */
+const RATE_FAMILIES = Object.keys(RATES).filter((k) => k !== 'default');
+
 /**
  * The rate row for a model id, provider, or alias. Exact id wins, then the
- * longest matching prefix, then the Sonnet-class default.
+ * longest matching prefix, then a family named inside the id, then the
+ * Sonnet-class default.
  */
 function ratesFor(model) {
-  const id = String(model || '').toLowerCase();
-  if (!id) return RATES.default;
-  if (RATES[id]) return RATES[id];
-  let best = null;
-  let bestLen = 0;
-  for (const [prefix, rates] of Object.entries(RATES)) {
-    if (id.startsWith(prefix) && prefix.length > bestLen) {
-      best = rates;
-      bestLen = prefix.length;
+  const raw = String(model || '').toLowerCase();
+  if (!raw) return RATES.default;
+  // A byok model id carries its provider as a routing label:
+  // "anthropic:claude-opus-4", "deepseek:deepseek-v4-flash". The label is not
+  // a rate, and rating it as written fell through every prefix to
+  // RATES.default — so an Opus BYOK turn was priced at Sonnet's $3/$15 against
+  // the vendor's real $5/$25. 15x, on the one class whose figure can only ever
+  // be an estimate, because there the vendor bills the caller and AEGIS only
+  // relays. Try the whole id first, then the model behind the label.
+  const ids = [raw];
+  const tail = raw.slice(raw.lastIndexOf(':') + 1);
+  if (tail && tail !== raw) ids.push(tail);
+  for (const id of ids) {
+    if (RATES[id]) return RATES[id];
+    let best = null;
+    let bestLen = 0;
+    for (const [prefix, rates] of Object.entries(RATES)) {
+      if (id.startsWith(prefix) && prefix.length > bestLen) {
+        best = rates;
+        bestLen = prefix.length;
+      }
+    }
+    if (best) return best;
+  }
+  // Longest family-key hit wins, so an overlapping pair resolves the same way
+  // twice running rather than by object key order.
+  let family = null;
+  let familyLen = 0;
+  for (const key of RATE_FAMILIES) {
+    if (raw.includes(key) && key.length > familyLen) {
+      family = RATES[key];
+      familyLen = key.length;
     }
   }
-  return best || RATES.default;
+  return family || RATES.default;
 }
 
 /**

package/vendor/aegis.js

@@ -354,9 +354,27 @@ function createClient(opts = {}) {
    *
    * The caller's *AEGIS* key is sent alongside the provider key as X-AEGIS-Key.
    * Two credentials, two headers, on purpose: the provider key authenticates the
-   * upstream call, the AEGIS key says whose bank pays the handling fee. With no
-   * AEGIS key configured the header is omitted and the call stays anonymous —
-   * allowed, just unbilled (see _byok_identify_user on the server).
+   * upstream call, the AEGIS key says whose bank pays the handling fee —
+   * `_byok_identify_user` on the server resolves the payer from it, and nothing
+   * else. With no AEGIS key the header is omitted and the call is anonymous;
+   * THIS function still sends it, because it is a transport and the route is
+   * unauthenticated by design (aegis1 tests/test_byok_fee.py pins the anonymous
+   * path as allowed) — refusing here would break every other caller of a
+   * published endpoint.
+   *
+   * Attribution is the whole game, because an unattributed turn is the one way
+   * a BYOK call escapes the fee: the relay serves it, `charge_byok` never runs
+   * (`app.py` charges only `if _byok_user_id:`), and the call is logged against
+   * user 0 as uncollected — a free ride. So the shipped HOSTS refuse a keyless
+   * BYOK send before the relay is reached: desktop/lib/local/engine.js raises
+   * 401, and the desktop app and the CLI share that engine (the CLI stages it
+   * as cli/vendor/desktop/lib/local/engine.js), so one gate covers both. Every
+   * turn is then attributable, and therefore billable: a funded balance is
+   * debited, an unfunded one is recorded as owed — `charge_byok` clamps the
+   * debit at zero and never refuses the call, so "cannot pay" and "must not be
+   * billed" stop being the same thing. `AEGIS_BYOK_REQUIRE_BALANCE` (off by
+   * default) remains the server's own, separate 402 gate and is not what makes
+   * the fee land.
    */
   async function byokChatCompletion({
     provider = 'openai',