aegis-desktop 0.8.27 → 0.8.29

package/README.md

@@ -61,13 +61,19 @@ with context intact:
 | **Bring your own key** | your provider key, relayed by AEGIS — see below | main process | yes — flat AEGIS handling fee |
 | **Local** | a model on your own machine or network — your Ollama daemon at `localhost:11434` by default | n/a — no key | no — free, no AEGIS account needed |
 
-The Cloud class offers **no pinnable model** in this app: its dropdown keeps the
-one *server default (auto)* entry, and the aegiscloud ids (`nexus-brain` and the
-`-smart`/`-neo` spellings the server sends as aliases of it, plus the
-per-provider ids it lists beside them) are omitted from the list. The lane is
-unchanged by that — the account key, the pooled turn, cloud memory sync and the
-BYOK handling fee billed to this account all still work; there is simply nothing
-to pin. Per-provider models are reachable through **Bring your own key** below.
+The Cloud class offers **everything the server advertises**: the pooled brain
+first, as one row (`Nexus` — the `nexus-brain`/`aegis-brain` and the
+`-smart`/`-neo` spellings the server sends as aliases of it are folded into that
+one row, because they all name the same route), then every per-provider id the
+same catalogue lists, so `deepseek`, `anthropic`, `groq`, `openai` … can be
+pinned directly. Both hosts build that list from one shared rule
+(`client/brain-catalog.js`, `offerableCatalog`), so the GUI and the terminal
+cannot show one account two different lists. A pinned per-provider id is still a
+**pooled** turn: your account key pays the pool's margin, and the plan and
+balance gates on `/api/v1/chat/completions` apply to it exactly as they do to
+the brain row. The same models are also reachable through **Bring your own
+key** below — your provider key, and a flat handling fee instead of the pool's
+margin.
 
 Get a free AEGIS key at **https://aegiscloud.org** for the Cloud and BYOK
 classes. The generic OpenAI-/Anthropic-compatible direct-dial lanes that used
@@ -108,9 +114,26 @@ traffic — BYOK stays the cheaper lane, it just is not the free one.
 handling fee has to be billed somewhere. With no AEGIS key connected the class
 shows every model but says exactly that, rather than failing opaquely.
 
-Note that a **BYOK turn is single-shot** — the relay takes no `tools` parameter,
-so the agentic tool loop below is off for these models. Use the **Aegis Cloud**
-class when you want file and shell access.
+**And the relay decides whether your bank has to be funded.** The route
+publishes its own policy on `GET /api/v1/byok/providers` (`fee.gate_mode`,
+`fee.require_account`, `fee.require_balance`) and the app reads it there rather
+than assuming one: in the `balance` mode the live deployment runs, a BYOK turn
+needs an account **with a balance**, and a zero bank answers `402 Insufficient
+balance. Top up to continue using BYOK.` — your provider key is still valid, the
+AEGIS handling fee is what ran out (see the top-up surface). In the softer
+`owner` mode a named account is enough and an unfunded fee is recorded as owed.
+An anonymous caller (no AEGIS key at all) is refused in every enforcing mode,
+which is the released clients' own gate too — this class does not serve a turn
+nobody can be billed for.
+
+**The agentic tool loop works here too.** The relay's BYOK route accepts the
+OpenAI-shaped `tools`/`tool_choice` and translates them to each provider's own
+wire format (Anthropic-backed callers get real tool calls), so file, shell and
+search access below are available on this lane — the engine sends the same tool
+schema it sends on the pooled lane. What the class does *not* get is the cloud
+drain in the **autonomous queue**, which is `Aegis Cloud`-only (see
+`desktop/lib/local/autonomous.js`) — that is the fan-out Pro buys, not the tool
+loop.
 
 ## Screenshots
 

package/lib/local/context.js

@@ -40,17 +40,27 @@ function messageTokens(message) {
  * @param {string} [opts.system='']
  * @param {number} [opts.budgetTokens=8192]  total tokens allowed on the wire
  * @param {number} [opts.reserveTokens=0]    tokens reserved for the reply
- * @returns {{messages:Array, system:string, dropped:number, estimatedTokens:number}}
+ * @param {number} [opts.fixedTokens=0]      wire cost that is NOT a message and
+ *   cannot be dropped (the tool schemas), counted before any turn is kept
+ * @returns {{messages:Array, system:string, dropped:number, estimatedTokens:number, fixedTokens:number}}
  */
 function trimContext({
   messages = [],
   system = '',
   budgetTokens = 8192,
   reserveTokens = 0,
+  fixedTokens = 0,
 } = {}) {
   const limit = Math.max(0, budgetTokens - reserveTokens);
   const kept = [];
-  let used = 0;
+  // Tool schemas go on the wire every round and cannot be trimmed away, so they
+  // are charged against the budget FIRST. Without this the trimmer believed a
+  // 4096-token window had 4096 tokens for history when the schemas had already
+  // spent ~1971 of them (measured: 10 schemas, 7882 chars) — and the daemon,
+  // run with `--context-shift`, discarded the SYSTEM row to make room instead
+  // of erroring. Counting them here is what keeps the system row alive.
+  const fixed = Math.max(0, Number(fixedTokens) || 0);
+  let used = fixed;
 
   if (system) used += MESSAGE_OVERHEAD + estimateTokens(system);
 
@@ -69,6 +79,7 @@ function trimContext({
     system,
     dropped: messages.length - kept.length,
     estimatedTokens: used,
+    fixedTokens: fixed,
   };
 }
 

package/lib/local/engine.js

@@ -1392,6 +1392,17 @@ function createLocalEngine({
           system: opts.system,
           messages: opts.messages,
           maxTokens: opts.maxTokens,
+          // aegis1's byok_chat_completions has read and forwarded `tools`/
+          // `tool_choice` since 926069b (2026-09-10) — this call simply never
+          // sent them, so every BYOK turn (DeepSeek, Anthropic, OpenAI alike)
+          // ran with no write/exec/editFile schema at all. A model told in its
+          // system prompt that it "writes and edits files" but never given the
+          // JSON shape to do so improvises a DeepSeek-native DSML call from
+          // prose alone when it's confident, and falls back to prose ADVICE
+          // (a shell script to run by hand) when it isn't — which is exactly
+          // the bug this line closes.
+          tools: opts.tools,
+          toolChoice: opts.toolChoice,
           // Native effort knob, field and level both from the dialect table.
           // `bareModel` is already provider-less, so it matches the dialect
           // regexes without further stripping. Only a dialect whose field is
@@ -1530,12 +1541,19 @@ function createLocalEngine({
     const signal = controller.signal;
 
     // A caller can opt out of the agent loop entirely (`tools: false`) and get
-    // the old single-shot turn back. byok is ALWAYS single-shot: the
-    // stateless relay (aegis.byokChatCompletion, /api/v1/byok/chat/completions)
-    // has no tools/tool_choice parameter at all, so sending schemas here would
-    // build a prompt promising tool access the transport silently drops —
-    // the model would reason about exec/readFile and never see a result.
-    const toolsEnabled = cls !== 'byok' && !(payload && payload.tools === false);
+    // the old single-shot turn back. byok used to be forced into that same
+    // single-shot shape unconditionally: aegis1's byok relay had no
+    // tools/tool_choice parameter at all, so sending schemas would build a
+    // prompt promising tool access the transport silently dropped — the model
+    // would reason about exec/readFile and never see a result. That stopped
+    // being true at aegis1 926069b (2026-09-10, byok_chat_completions reads
+    // and forwards both), but this carve-out was never revisited, so every
+    // BYOK turn since kept running with no tool schema at all regardless —
+    // the model told in its own system prompt that it writes and edits files,
+    // and never given the JSON shape to do so. Reported live: asked to save a
+    // file to the Desktop, DeepSeek had no write tool to call and answered
+    // with a PowerShell script for the user to run by hand instead.
+    const toolsEnabled = !(payload && payload.tools === false);
     const toolSchemas = toolsEnabled ? T.toolsFor({ includeSubagent: depth < MAX_SUBAGENT_DEPTH }) : [];
     const toolChoice = (payload && payload.toolChoice) || null;
 
@@ -2096,6 +2114,18 @@ function createLocalEngine({
     return { ok: Boolean(controller) };
   }
 
+  /**
+   * Unload every local model this engine warmed, across every daemon it
+   * talked to (local.js `unloadAll`). The desktop host calls this on its quit
+   * path so closing the app also closes the model — the local lane bills
+   * nothing precisely because it is YOUR hardware, and hardware left running
+   * a model nobody is using anymore after the app exits is the one cost that
+   * lane was supposed to never have.
+   */
+  function unloadLocalModels() {
+    return localT.unloadAll();
+  }
+
   return {
     CLASSES,
     listClasses,
@@ -2105,6 +2135,7 @@ function createLocalEngine({
     respondApproval,
     clearSessionApprovals,
     settings,
+    unloadLocalModels,
   };
 }