aegis-desktop 0.8.13 → 0.8.15

package/lib/local/entitlement.js

@@ -90,6 +90,84 @@ const LEGACY_PLAN_ALIASES = Object.freeze({
 const PRO_VALUE =
   'Pro puts the drain in the cloud, so the job keeps running after you close the laptop';
 
+/**
+ * The honesty line — Phase 3's rule, and the second half of the same claim:
+ * everything that runs on the user's own machine stays free forever, and the
+ * cloud drain is the thing being sold. Both hosts that print a paid prompt
+ * print this beside it (the desktop keeps its own literal in
+ * `desktop/renderer/app.js`; the terminal reads it from here), because the
+ * promise without the honesty line is the four-bullet feature list again.
+ *
+ * Kept byte-identical to the renderer's `FREE_HONESTY`, and asserted verbatim
+ * by both hosts' tests, so the terminal and the GUI cannot come to disagree
+ * about what is free — a disagreement that would either overcharge a promise
+ * or undercut the offer, depending on which copy a user believed.
+ */
+const FREE_HONESTY =
+  'Everything on your machine is free, permanently. The cloud drain is what you pay for.';
+
+/**
+ * The BYOK lane's price, in words — built from the SERVER's published rate.
+ *
+ * The desktop README says the byok lane is "billed a flat handling fee" and
+ * aegis1 charges exactly that (services/pricing.price_byok_call), but no client
+ * surface said so: a user who pasted their own Anthropic key into AEGIS read
+ * "your provider's cost" and never learned AEGIS adds a fee. That is the one
+ * place in this product where the bill and the pitch disagreed, and it is the
+ * copy the desktop session flagged as an unresolved honesty conflict.
+ *
+ * `fee` is aegis1's own `/api/v1/byok/providers` payload — a live payload, never
+ * a hardcoded number, for the reason the engine already states: a client that
+ * hardcodes a fee is a client that can disagree with the ledger. No published
+ * fee (old server, offline, unauthenticated read that returned nothing) returns
+ * '' and every host then says NOTHING about the price, which is the only honest
+ * alternative to inventing one.
+ *
+ * `require_account` / `anonymous_daily_calls` come from the same payload and
+ * describe enforcement, not price: with the relay requiring an AEGIS account the
+ * sentence has to say so, or the user meets a 402 the client never warned about
+ * — the exact failure tests/test_byok_fee.py::test_the_published_gate_warning_is
+ * _true_whenever_the_gate_can_402 exists to prevent.
+ */
+const BYOK_FEE_NOTE =
+  'Bring your own key is relayed through AEGIS, not dialled from here — the routing, prompt assembly and caching are billed as a flat handling fee, on top of your provider\'s own bill.';
+
+/** Per-million-token rendering of a published per-1k rate. */
+function ratePerMillion(usdPer1k) {
+  return `$${(Number(usdPer1k) * 1000).toFixed(2)}/M`;
+}
+
+function byokFeeLine(fee) {
+  const f = fee && typeof fee === 'object' ? fee : null;
+  if (!f) return '';
+  const inRate = Number(f.in_usd_per_1k);
+  const outRate = Number(f.out_usd_per_1k);
+  if (!Number.isFinite(inRate) || !Number.isFinite(outRate)) return '';
+  if (f.disabled === true) {
+    // The deployment switched the fee off; saying "free" is then the truth
+    // rather than a promise this client cannot keep.
+    return 'Bring your own key is relayed free on this deployment right now.';
+  }
+  // The price clause stands alone when the server published no enforcement
+  // detail — which is every server deployed before this change, and the
+  // default-off gate after it. Joined with ' — ' only when there IS a second
+  // clause: a sentence-ending dash with nothing after it ("…provider's bill —.")
+  // is what the first live run of this line actually printed.
+  const price = `Bring your own key: relayed through AEGIS, handled at `
+    + `${ratePerMillion(inRate)} in / ${ratePerMillion(outRate)} out, `
+    + `on top of your provider's bill`;
+  let clause = '';
+  if (f.require_account === true) {
+    clause = 'and needs an AEGIS account key (X-AEGIS-Key) for the fee to be billed';
+  } else {
+    const cap = Number(f.anonymous_daily_calls);
+    if (Number.isFinite(cap) && cap > 0) {
+      clause = `with ${cap} relayed turns/24h before an AEGIS account is required`;
+    }
+  }
+  return clause ? `${price} — ${clause}.` : `${price}.`;
+}
+
 /** Campaign id for this prompt (Phase 1's fixed ids; aegis1 keeps the slug). */
 const CAMPAIGN = 'queue_cap';
 
@@ -478,6 +556,9 @@ module.exports = {
   BALANCE_CAMPAIGN,
   BALANCE_URL,
   PRO_VALUE,
+  FREE_HONESTY,
+  BYOK_FEE_NOTE,
+  byokFeeLine,
   DEFAULT_TTL_MS,
   // Phase 7: the host seam + the builder the CLI binds itself to.
   SIGNUP_SOURCES,

package/lib/local/local.js

@@ -58,6 +58,45 @@ function baseOf(baseURL) {
   return String(baseURL || DEFAULT_BASE).replace(/\/+$/, '');
 }
 
+/**
+ * DeepSeek's chat template (also the one a locally-pulled `deepseek-*` Ollama
+ * model uses) wraps tool calls and turn boundaries in special tokens —
+ * fullwidth pipe (U+FF5C) delimiting an identifier that uses ▁ (U+2581) as its
+ * word separator, e.g. ｜tool▁calls▁begin｜, ｜tool▁call▁end｜, ｜Assistant｜,
+ * ｜begin▁of▁sentence｜. These are chat-template internals, never user-facing
+ * text; when the local daemon's tool-call path leaks them into `delta.content`
+ * they used to reach the screen verbatim — reported as the pasted
+ * "｜｜DSML｜｜" envelope. Returns a per-turn stripper closure with a short
+ * lookback buffer so a token split across two SSE chunks isn't half-rendered
+ * before its closing pipe arrives.
+ */
+const DEEPSEEK_ENVELOPE_RE = /｜[A-Za-z][A-Za-z0-9]*(?:▁[A-Za-z0-9]+)*｜/g;
+function makeDeepSeekEnvelopeStripper() {
+  let buf = '';
+  const strip = (chunk) => {
+    buf += chunk;
+    buf = buf.replace(DEEPSEEK_ENVELOPE_RE, '');
+    const openIdx = buf.lastIndexOf('｜');
+    if (openIdx !== -1) {
+      const tail = buf.slice(openIdx);
+      if (tail.length <= 60 && /^｜[A-Za-z0-9▁]*$/.test(tail)) {
+        const out = buf.slice(0, openIdx);
+        buf = tail;
+        return out;
+      }
+    }
+    const out = buf;
+    buf = '';
+    return out;
+  };
+  strip.flush = () => {
+    const out = buf;
+    buf = '';
+    return out;
+  };
+  return strip;
+}
+
 /**
  * Whether a base URL addresses hardware on this machine (or on this private
  * network) — the gate that decides whether the free lane exists at all.
@@ -369,6 +408,7 @@ async function chat({
   let usage = null;
   const toolCalls = [];
   const byIndex = new Map();
+  const stripEnvelope = makeDeepSeekEnvelopeStripper();
 
   await readSSE(
     res,
@@ -378,8 +418,11 @@ async function chat({
       if (!choice) return;
       const delta = choice.delta || {};
       if (typeof delta.content === 'string' && delta.content) {
-        content += delta.content;
-        if (typeof onDelta === 'function') onDelta({ text: delta.content });
+        const clean = stripEnvelope(delta.content);
+        if (clean) {
+          content += clean;
+          if (typeof onDelta === 'function') onDelta({ text: clean });
+        }
       }
       const frags = delta.tool_calls || [];
       for (const f of frags) {
@@ -399,6 +442,15 @@ async function chat({
     { idleTimeoutMs: SSE_IDLE_TIMEOUT_MS }
   );
 
+  // A trailing '｜…' that never closed (stream ended right after it, or it
+  // was real prose all along) is real content, not an unfinished envelope
+  // token — release it rather than dropping it silently.
+  const strayTail = stripEnvelope.flush();
+  if (strayTail) {
+    content += strayTail;
+    if (typeof onDelta === 'function') onDelta({ text: strayTail });
+  }
+
   for (const [i, acc] of [...byIndex.entries()].sort((a, b) => a[0] - b[0])) {
     if (!acc.function.name && !acc.function.arguments) continue;
     // Ollama does not always mint an id; the engine's tool loop keys results

package/lib/local/tools.js

@@ -42,6 +42,7 @@ const { spawn } = require('node:child_process');
 const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
+const { pathToFileURL } = require('node:url');
 const { agentRoles } = require('./agents.js');
 
 const OUTPUT_CAP = 30_000; // chars fed back to the model per tool result
@@ -770,9 +771,121 @@ function isTool(name) {
  * all land on the error branch rather than rejecting. `ctx` carries per-turn
  * state (getShell, signal); omit it and exec falls back to a one-shot spawn.
  */
+/**
+ * `tools/agent-gate.mjs` is ESM and this module is CJS, so it is imported
+ * dynamically and once. The candidates are tried in order; the first that
+ * resolves wins:
+ *
+ *   1. `../../../tools/agent-gate.mjs` — the repo checkout (dev / CI). This is
+ *      the SAME file the git hooks execute, so "what is allowed" is computed
+ *      once, by one implementation.
+ *   2. `<process.resourcesPath>/tools/agent-gate.mjs` — where electron-builder's
+ *      `extraResources` puts it in a packaged build, as a real file OUTSIDE the
+ *      asar. That placement is load-bearing, not cosmetic: the gate is loaded
+ *      with dynamic `import()`, and Node's ESM loader does not go through
+ *      Electron's asar-aware fs patch (electron/asar#249), so a copy living only
+ *      inside the archive can fail to resolve — leaving the packaged app with no
+ *      gate at all. This is the app's only dynamic ESM import, so nothing else
+ *      here exercises that path. Conveniently this is also what candidate (1)
+ *      resolves to from `resources/app.asar/lib/local/`, so dev and packaged
+ *      builds agree on one file.
+ *   3. `../../vendor/agent-gate.mjs` — the staged copy inside the app dir, kept
+ *      as the last resort for a build that is not archived (`asar: false`) or an
+ *      npm-installed tree. It is the candidate that fails inside an asar, hence
+ *      third and not first.
+ *
+ * Before (2) existed a packaged build had no gate at all: the manifest is found
+ * by climbing from the working directory, so the packaged app would open a
+ * guarded tree and every write through it succeeded while the same call through
+ * the repo copy was refused.
+ *
+ * If nothing resolves, that is a broken gate rather than a permissive one, and
+ * executeTool refuses mutating calls into a tree that declares a manifest.
+ */
+let agentGatePromise;
+
+function agentGateCandidates({ resourcesPath = process.resourcesPath, dirname = __dirname } = {}) {
+  const candidates = ['../../../tools/agent-gate.mjs'];
+  // process.resourcesPath is an Electron-provided value and is absent under
+  // plain node, so this is guarded rather than assumed. An absolute path must
+  // be a file URL to be imported.
+  if (typeof resourcesPath === 'string' && resourcesPath) {
+    candidates.push(pathToFileURL(path.join(resourcesPath, 'tools', 'agent-gate.mjs')).href);
+  }
+  candidates.push('../../vendor/agent-gate.mjs');
+  return candidates;
+}
+
+function loadAgentGate() {
+  if (!agentGatePromise) {
+    const candidates = agentGateCandidates();
+    const tryNext = (i) => (i >= candidates.length
+      ? null
+      : import(candidates[i]).catch(() => tryNext(i + 1)));
+    agentGatePromise = tryNext(0);
+  }
+  return agentGatePromise;
+}
+
+/**
+ * The nearest `.aegis/guard.json` at or above `start`, or null. The identical
+ * climb as findManifest() in tools/agent-gate.mjs and src/repoguard.js. It is
+ * used ONLY to decide whether a call that could not load the gate module is
+ * unsafe; when the module loads it is the sole authority.
+ */
+function nearestManifest(start) {
+  let dir = path.resolve(start || process.cwd());
+  try { if (fs.statSync(dir).isFile()) dir = path.dirname(dir); } catch { /* keep as-is */ }
+  for (;;) {
+    const candidate = path.join(dir, '.aegis', 'guard.json');
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
 async function executeTool(name, args, ctx) {
   if (!isTool(name)) return fail(`unknown tool "${name}" (known: ${toolNames().join(', ')})`);
   const input = args && typeof args === 'object' ? args : {};
+  // ── agent-key gate (tools/agent-gate.mjs) ──────────────────────────────
+  // The in-process half of the lock whose other half is .githooks/. A tree
+  // that declares .aegis/guard.json must not be mutated through this app
+  // without the key, exactly as it cannot be mutated by the engine or
+  // committed by git. Reads are never gated. Refused — not warned — when the
+  // key is absent, the manifest is unreadable, or the key file is
+  // world-readable; AEGIS_GATE_SKIP=1 is the one bypass, and it is refused in
+  // an unattended run. The module is required lazily so a packaged app whose
+  // tree has no tools/ directory still starts and simply has no gate.
+  let gate = null;
+  try {
+    gate = await loadAgentGate();
+  } catch { /* not running from the repo: no manifest to honour */ }
+  if (gate) {
+    const verdict = gate.guardTool({
+      tool: name, args: input, cwd: (ctx && ctx.cwd) || process.cwd(),
+      env: process.env, unattended: Boolean(ctx && ctx.autonomous),
+    });
+    if (!verdict.allowed) return fail(gate.refusalText(verdict));
+    if (verdict.code === 'skipped') {
+      const res = await EXECUTORS[name](input, ctx || {});
+      return res && typeof res === 'object' ? { ...res, output: `⚠ ${verdict.reason}\n${res.output || ''}` } : res;
+    }
+  } else if (MUTATING_TOOLS.has(name)) {
+    // Neither the repo copy nor the staged one loaded. A broken gate must
+    // never silently allow (the hooks exit 4 for exactly this reason), so a
+    // mutating call into a tree that declares a manifest is refused with the
+    // path of the manifest that could not be honoured.
+    const man = nearestManifest((ctx && ctx.cwd) || process.cwd());
+    if (man) {
+      return fail(
+        `error: refused — ${man} declares an agent-gated tree, but the agent-key gate module could not be loaded `
+        + '(tried tools/agent-gate.mjs beside the app and vendor/agent-gate.mjs inside it), so this '
+        + `${name} cannot be authorised. A build that missed the staged copy is the usual cause: `
+        + 'run scripts/predist.mjs before packaging.',
+      );
+    }
+  }
   try {
     return await EXECUTORS[name](input, ctx || {});
   } catch (e) {

package/main.js

@@ -682,11 +682,28 @@ function providerRouteConfigured(engine) {
  * import to stay unit-testable.
  */
 function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured, avatar) {
-  // One service for the window's lifetime, bound to the app's data dir. It is
-  // created lazily inside its handlers rather than here, so a broken shared
-  // module surfaces as an error in the fingerprint panel instead of preventing
-  // the window from opening at all.
-  const fingerprint = createFingerprintService({ dir });
+  // One service for the window's lifetime, bound to the app's data dir — but
+  // created LAZILY, which is what the comment here always claimed and what the
+  // code did not do. `createFingerprintService({ dir })` throws on a missing
+  // dir, and a test or a call site that has no userData yet (every
+  // `createIpcDispatch(client)` in `test/desktop-shell.mjs`, and any bootstrap
+  // where `resolveUserDataDir` came back empty) died at construction — taking
+  // the whole dispatch surface with it, not just the fingerprint panel. The
+  // proxy defers construction to the first fingerprint call, so a broken shared
+  // module surfaces as an error in that panel instead of preventing the window
+  // from opening at all, exactly as documented below.
+  let fingerprintService = null;
+  const fingerprint = new Proxy({}, {
+    get(_target, prop) {
+      if (!fingerprintService) fingerprintService = createFingerprintService({ dir });
+      const value = fingerprintService[prop];
+      return typeof value === 'function' ? value.bind(fingerprintService) : value;
+    },
+    has(_target, prop) {
+      if (!fingerprintService) fingerprintService = createFingerprintService({ dir });
+      return prop in fingerprintService;
+    },
+  });
   // `providerConfigured` is an injected thunk (bootstrap() passes one that reads
   // the settings store) so this module keeps its no-Electron, unit-testable
   // shape; absent in tests and older call sites, where it reads as "no".

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -664,6 +664,21 @@ function rafPainter(paint) {
   return transcript ? transcript.paint(paint) : paint;
 }
 
+/**
+ * What the last stop attempt actually achieved.
+ *
+ * `models.cancel()` travels over IPC and can be REFUSED — the engine has no
+ * AbortController for that session id (`{ ok: false }`), the channel is not
+ * registered (the promise rejects), or the call throws. The old code wrapped
+ * this in a bare `catch` and ignored the returned promise, so every one of
+ * those became silence: the button said "stopping…", the turn kept streaming,
+ * and the only visible evidence was a salvage bubble that never appeared —
+ * which reads as a salvage bug several layers away from the real one. Recorded
+ * here so the smoke run can fail on it, and the rejection is handled so it
+ * cannot vanish into an unhandled-rejection warning nobody reads.
+ */
+let lastStopOutcome = null;
+
 /**
  * Stop the turn running right now. The transport already honours the abort all
  * the way down (engine.cancel -> AbortController -> the cloud client's fetch),
@@ -682,10 +697,43 @@ function stopPendingTurn() {
   // could be left `true` by an earlier turn and make an unrelated transport
   // failure look like a stop the user asked for.
   stoppedTurn = runningTurn;
+  const stopSessionId = pendingSessionId;
+  lastStopOutcome = { sessionId: stopSessionId, at: Date.now(), state: 'requested' };
   try {
-    models.cancel(pendingSessionId);
-  } catch {
-    /* a dead controller is not an error */
+    const pending = models.cancel(stopSessionId);
+    if (pending && typeof pending.then === 'function') {
+      pending.then(
+        (r) => {
+          lastStopOutcome = {
+            sessionId: stopSessionId,
+            at: Date.now(),
+            state: 'settled',
+            // The engine reports `{ ok: Boolean(controller) }` — a false here
+            // means it had nothing to abort, i.e. the stop was refused. Not an
+            // error, but never a success either.
+            accepted: !r || r.ok !== false,
+            result: r === undefined ? null : r,
+          };
+        },
+        (e) => {
+          lastStopOutcome = {
+            sessionId: stopSessionId,
+            at: Date.now(),
+            state: 'rejected',
+            accepted: false,
+            error: (e && e.message) || String(e),
+          };
+        }
+      );
+    }
+  } catch (e) {
+    lastStopOutcome = {
+      sessionId: stopSessionId,
+      at: Date.now(),
+      state: 'threw',
+      accepted: false,
+      error: (e && e.message) || String(e),
+    };
   }
   // The abort is not instantaneous. Marking the button is all the feedback that
   // survives the trip: `setBusy(false)` deletes the entire pending bubble on
@@ -1772,7 +1820,27 @@ const memoryView = {
  *  instead. Confusing the two is how a save would read a hidden textarea. */
 function overlayOpen() {
   if (memoryOverlayOpen()) return true;
-  return !!(window.aegisFingerprint && window.aegisFingerprint.isOpen());
+  // Ask the PANEL, not the module.
+  //
+  // `window.aegisFingerprint` is desktop/renderer/fingerprint.js, whose exports
+  // are `mount` plus pure helpers — it has no `isOpen`. The thing that knows
+  // whether the sheet is up is the handle `mount()` returned, kept in `fpPanel`.
+  // Reaching for `window.aegisFingerprint.isOpen()` threw inside the Escape
+  // listener, and a listener that throws is reported as an uncaught error
+  // rather than propagated to the dispatcher — so `defaultPrevented` stayed
+  // false, Escape stopped interrupting turns, and the visible symptom was a
+  // salvage failure several layers away. A source-shape change must not be able
+  // to do that again: an unusable handle reads as "not open" here, so a broken
+  // φ(α) panel can never disarm the keyboard interrupt (the smoke run fails
+  // loudly instead, on the recorded reason).
+  if (fpPanel && typeof fpPanel.isOpen === 'function') {
+    try {
+      return !!fpPanel.isOpen();
+    } catch (e) {
+      return false;
+    }
+  }
+  return false;
 }
 
 /** The memory inspector alone. Split out of overlayOpen() when the authorship
@@ -4483,11 +4551,20 @@ async function init() {
   // which made its veto assertion unfalsifiable. Exposes state only: no
   // setters, nothing that can drive the UI. Frozen so a stray write in a test
   // cannot fake a passing run.
+  // Bound below, read by the diagnostic just above. `defaultPrevented === false`
+  // on its own cannot say whether Escape was declined by policy or never
+  // handled at all, and that ambiguity is what makes an unwired interrupt look
+  // like a renderer regression.
+  let escapeBind = null;
   window.__aegisSmoke = Object.freeze({
     isScrolledUp: () => transcript.isScrolledUp(),
     metrics: () => transcript.metrics(),
+    escapeDecision: () => (escapeBind && typeof escapeBind.lastDecision === 'function'
+      ? escapeBind.lastDecision()
+      : null),
+    stopOutcome: () => lastStopOutcome,
   });
-  bindEscapeInterrupt({
+  escapeBind = bindEscapeInterrupt({
     doc: document,
     // The memory overlay wins: while it is open, Escape closes it rather than
     // reaching past it to cancel a turn the user may not be looking at.
@@ -4499,9 +4576,18 @@ async function init() {
     // both are somehow up.
     isOverlayOpen: overlayOpen,
     onOverlayEscape: () => {
-      if (window.aegisFingerprint && window.aegisFingerprint.isOpen()) {
-        window.aegisFingerprint.close();
-        return;
+      // Same handle, same reason as overlayOpen(): the module has no `close`,
+      // the mounted panel does. Guessed at the module here too, which threw for
+      // the same reason — and an overlay can only be closed by its own sheet's
+      // handle, so there is nothing to fall back to but the memory overlay.
+      if (fpPanel && typeof fpPanel.close === 'function') {
+        try {
+          fpPanel.close();
+          return;
+        } catch (e) {
+          // fall through to the memory overlay rather than rethrowing inside a
+          // keydown listener
+        }
       }
       closeMemoryOverlay();
     },

package/renderer/transcript-view.js

@@ -218,21 +218,85 @@ function attachScrollLift(deps) {
 function bindEscapeInterrupt(deps) {
   const d = deps || {};
 
+  // Why the last Escape did what it did.
+  //
+  // This exists because the only externally visible signal an ignored Escape
+  // leaves behind is `defaultPrevented === false`, and that single bit cannot
+  // tell four legitimate refusals (overlay open, no pending turn, no stopTurn,
+  // auto-repeat) apart from the one genuinely broken case: a dependency threw
+  // inside the listener, and `dispatchEvent` reported the listener error as
+  // uncaught instead of propagating it to the caller. Both look identical from
+  // outside — the turn keeps running and `defaultPrevented` is false — so a
+  // wiring fault is indistinguishable from a policy decision without this.
+  let lastDecision = null;
+
   function handle(e) {
+    const decision = {
+      at: Date.now(),
+      key: e && e.key,
+      repeat: Boolean(e && e.repeat),
+      overlayOpen: null,
+      hasPendingTurn: null,
+      consumed: false,
+      threw: null,
+    };
+    lastDecision = decision;
+
     if (!e || e.key !== 'Escape') return false;
     // A held key is one intent, not one per repeat. Without this the auto-repeat
     // events keep arriving after the interrupted turn has already ended, and
     // the ones that land once the user has sent the next message stop that turn
     // instead — the keyboard twin of a stuck cancel button.
     if (e.repeat) return false;
-    if (typeof d.isOverlayOpen === 'function' && d.isOverlayOpen()) {
-      if (typeof d.onOverlayEscape === 'function') d.onOverlayEscape();
-      return false;
+    if (typeof d.isOverlayOpen === 'function') {
+      try {
+        decision.overlayOpen = Boolean(d.isOverlayOpen());
+      } catch (err) {
+        // A probe that breaks must not disarm the interrupt: the user's only
+        // keyboard route to stopping a runaway turn is this handler, and
+        // "unknown" is not "open". The reason is recorded rather than raised,
+        // so the smoke run fails on it while the user still gets their Escape.
+        decision.threw = 'isOverlayOpen: ' + ((err && err.message) || err);
+        decision.overlayOpen = false;
+      }
+      if (decision.overlayOpen) {
+        if (typeof d.onOverlayEscape === 'function') {
+          try {
+            d.onOverlayEscape();
+          } catch (err) {
+            decision.threw = 'onOverlayEscape: ' + ((err && err.message) || err);
+          }
+        }
+        return false;
+      }
+    }
+    if (typeof d.hasPendingTurn === 'function') {
+      try {
+        decision.hasPendingTurn = Boolean(d.hasPendingTurn());
+      } catch (err) {
+        decision.threw = 'hasPendingTurn: ' + ((err && err.message) || err);
+        return false;
+      }
+      if (!decision.hasPendingTurn) return false;
     }
-    if (typeof d.hasPendingTurn === 'function' && !d.hasPendingTurn()) return false;
     if (typeof d.stopTurn !== 'function') return false;
     if (typeof e.preventDefault === 'function') e.preventDefault();
-    d.stopTurn();
+    decision.consumed = true;
+    // The key is consumed either way — the interrupt has been asked for and the
+    // turn must not survive a throw from the stop itself. What the stop
+    // ANSWERED is recorded, because a consumed key with a refused stop is the
+    // one combination that looks like success from outside while nothing has
+    // happened: `defaultPrevented` is true, the bubble never appears, and the
+    // turn runs to completion.
+    let stopResult = null;
+    try {
+      const r = d.stopTurn();
+      stopResult = r === undefined ? null : Boolean(r);
+    } catch (err) {
+      stopResult = false;
+      decision.threw = 'stopTurn: ' + ((err && err.message) || err);
+    }
+    decision.stopAccepted = stopResult;
     return true;
   }
 
@@ -242,6 +306,7 @@ function bindEscapeInterrupt(deps) {
 
   return {
     handle: handle,
+    lastDecision: () => lastDecision,
     unbind: () => {
       if (d.doc && typeof d.doc.removeEventListener === 'function') {
         d.doc.removeEventListener('keydown', handle);