aegis-desktop 0.8.28 → 0.8.31

package/README.md

@@ -61,13 +61,19 @@ with context intact:
 | **Bring your own key** | your provider key, relayed by AEGIS — see below | main process | yes — flat AEGIS handling fee |
 | **Local** | a model on your own machine or network — your Ollama daemon at `localhost:11434` by default | n/a — no key | no — free, no AEGIS account needed |
 
-The Cloud class offers **no pinnable model** in this app: its dropdown keeps the
-one *server default (auto)* entry, and the aegiscloud ids (`nexus-brain` and the
-`-smart`/`-neo` spellings the server sends as aliases of it, plus the
-per-provider ids it lists beside them) are omitted from the list. The lane is
-unchanged by that — the account key, the pooled turn, cloud memory sync and the
-BYOK handling fee billed to this account all still work; there is simply nothing
-to pin. Per-provider models are reachable through **Bring your own key** below.
+The Cloud class offers **everything the server advertises**: the pooled brain
+first, as one row (`Nexus` — the `nexus-brain`/`aegis-brain` and the
+`-smart`/`-neo` spellings the server sends as aliases of it are folded into that
+one row, because they all name the same route), then every per-provider id the
+same catalogue lists, so `deepseek`, `anthropic`, `groq`, `openai` … can be
+pinned directly. Both hosts build that list from one shared rule
+(`client/brain-catalog.js`, `offerableCatalog`), so the GUI and the terminal
+cannot show one account two different lists. A pinned per-provider id is still a
+**pooled** turn: your account key pays the pool's margin, and the plan and
+balance gates on `/api/v1/chat/completions` apply to it exactly as they do to
+the brain row. The same models are also reachable through **Bring your own
+key** below — your provider key, and a flat handling fee instead of the pool's
+margin.
 
 Get a free AEGIS key at **https://aegiscloud.org** for the Cloud and BYOK
 classes. The generic OpenAI-/Anthropic-compatible direct-dial lanes that used
@@ -108,9 +114,26 @@ traffic — BYOK stays the cheaper lane, it just is not the free one.
 handling fee has to be billed somewhere. With no AEGIS key connected the class
 shows every model but says exactly that, rather than failing opaquely.
 
-Note that a **BYOK turn is single-shot** — the relay takes no `tools` parameter,
-so the agentic tool loop below is off for these models. Use the **Aegis Cloud**
-class when you want file and shell access.
+**And the relay decides whether your bank has to be funded.** The route
+publishes its own policy on `GET /api/v1/byok/providers` (`fee.gate_mode`,
+`fee.require_account`, `fee.require_balance`) and the app reads it there rather
+than assuming one: in the `balance` mode the live deployment runs, a BYOK turn
+needs an account **with a balance**, and a zero bank answers `402 Insufficient
+balance. Top up to continue using BYOK.` — your provider key is still valid, the
+AEGIS handling fee is what ran out (see the top-up surface). In the softer
+`owner` mode a named account is enough and an unfunded fee is recorded as owed.
+An anonymous caller (no AEGIS key at all) is refused in every enforcing mode,
+which is the released clients' own gate too — this class does not serve a turn
+nobody can be billed for.
+
+**The agentic tool loop works here too.** The relay's BYOK route accepts the
+OpenAI-shaped `tools`/`tool_choice` and translates them to each provider's own
+wire format (Anthropic-backed callers get real tool calls), so file, shell and
+search access below are available on this lane — the engine sends the same tool
+schema it sends on the pooled lane. What the class does *not* get is the cloud
+drain in the **autonomous queue**, which is `Aegis Cloud`-only (see
+`desktop/lib/local/autonomous.js`) — that is the fan-out Pro buys, not the tool
+loop.
 
 ## Screenshots
 

package/lib/local/autonomous.js

@@ -97,48 +97,100 @@ function writtenPath(tool) {
 const DEFAULT_MODEL = 'nexus-brain';
 
 /**
- * THE QUEUE RUNS ON AEGIS CLOUD, AND NOTHING ELSE.
+ * THE QUEUE RUNS ON WHATEVER CLASS THE TASK NAMES — aegis, byok, or local —
+ * the same three classes engine.js's interactive turns serve (engine.js's
+ * exported `CLASSES`). This module does not `require('./engine.js')` to read
+ * that list itself (same reason queue.js stays engine-free): duplicating the
+ * three names here keeps both modules testable with no Electron, no network,
+ * and no model.
  *
- * A queued task is billed to the AEGIS pool and every turn it makes goes out
- * with `class: 'aegis'` (see runTask below) — the pool is the only backend this
- * worker can reach. So a model id here has to be one the *pool* serves. A
- * direct-provider id is not a cheaper option the queue could fall back to; it
- * is a request the pool cannot honour, or worse, a per-provider spelling
- * (`anthropic`, `groq`, …) that quietly pins one upstream instead of letting
- * the pool auto-route across whichever providers hold a live key.
+ * This used to be Aegis Cloud only, because runTask sent every turn out with
+ * a hardcoded `class: 'aegis'` — a byok or local model id would have gone out
+ * under the wrong transport and failed at the server, or worse, silently
+ * picked up the wrong provider's key. Now `class` travels with the task
+ * (`item.class`, defaulted to 'aegis' for every task that predates this field
+ * — the CLI, a hand-written queue file, the old desktop card), and runTask
+ * forwards it verbatim instead of overwriting it.
  *
- * The accept-list is therefore the pooled-brain tier family — the one entry
- * engine.js's offerableCatalog offers for the Aegis Cloud class, plus the
- * `-smart`/`-neo` tier spellings the server still serves as aliases of it. This
- * mirrors selectBrainEntry() there rather than re-deriving "anything starting
- * with nexus-": `nexus-fast` is not a tier the catalog has ever served, and
- * accepting a made-up id means a queued task that fails at the server after
- * being picked up, or runs on a tier nobody chose.
+ * Each class validates differently, because each has a different notion of
+ * "no model stated is fine":
+ *   - 'aegis' has a real default (the pooled brain), so a blank model is
+ *     accepted and resolveModel fills it in. The accept-list is the
+ *     pooled-brain tier family — the one entry engine.js's offerableCatalog
+ *     offers for the Aegis Cloud class, plus the `-smart`/`-neo` tier
+ *     spellings the server still serves as aliases of it (mirrors
+ *     selectBrainEntry() there rather than re-deriving "anything starting
+ *     with nexus-": `nexus-fast` is not a tier the catalog has ever served).
+ *   - 'byok' and 'local' have no such default: a blank byok model cannot be
+ *     "whichever provider the pool picks" (there is no pool), and a blank
+ *     local model cannot be "whichever model is pulled" when the answer
+ *     depends on what the user's own daemon happens to have. Both REQUIRE an
+ *     explicit model, refused by name instead of silently resolving to
+ *     something nobody chose.
  */
+const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+
 const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
 const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
 
-/** True when `id` names an AEGIS Cloud pooled-brain tier (the queue's only models). */
+/** True when `id` names an AEGIS Cloud pooled-brain tier. */
 function isAegisModel(id) {
   return AEGIS_MODEL_RE.test(String(id == null ? '' : id).trim());
 }
 
 /**
- * Why a STATED model id cannot be queued, or '' when it can. Blank is not a
- * refusal — "no pick" is the default model, which resolveModel supplies.
+ * Normalize a task's stated class to one this module (and engine.js) knows.
+ * Blank or absent — every task queued before this field existed — defaults to
+ * 'aegis', the only class the queue ever ran before today.
+ */
+function normalizeClass(cls) {
+  const stated = String(cls == null ? '' : cls).trim().toLowerCase();
+  return stated || 'aegis';
+}
+
+/**
+ * Whether `id` is shaped "<provider>:<model>" — the only form engine.js's
+ * byok class accepts (splitByokModel). Not re-deriving the live provider list
+ * here (that is a catalog call, `listModels('byok')`, this module has no
+ * business caching) — just enough of a shape check that a malformed id is
+ * refused at the door instead of failing splitByokModel at the server with no
+ * context.
+ */
+function looksLikeByokModel(id) {
+  const s = String(id == null ? '' : id).trim();
+  const i = s.indexOf(':');
+  return i > 0 && i < s.length - 1;
+}
+
+/**
+ * Why a STATED (model, class) pair cannot be queued, or '' when it can.
  *
- * The message names the pool, because the failure it prevents ("queued on
- * claude-sonnet-4, ran on — or was billed to — something else") is invisible
- * otherwise: `class: 'aegis'` would be sent with an id the server does not
- * serve, and the task would come back as an opaque error minutes later.
+ * `cls` defaults to 'aegis' when omitted, so every existing caller of
+ * `modelRefusal(id)` keeps its old behaviour verbatim.
  */
-function modelRefusal(id) {
+function modelRefusal(id, cls) {
   const stated = String(id == null ? '' : id).trim();
-  if (!stated || isAegisModel(stated)) return '';
-  return (
-    `the autonomous queue runs Aegis Cloud models only (${DEFAULT_MODEL}, ` +
-    `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
-  );
+  const normalized = normalizeClass(cls);
+  if (!MODEL_CLASSES.includes(normalized)) {
+    return `"${cls}" is not a model class the queue serves (${MODEL_CLASSES.join('/')})`;
+  }
+  if (normalized === 'aegis') {
+    if (!stated || isAegisModel(stated)) return '';
+    return (
+      `the autonomous queue's Aegis Cloud class runs pooled-brain models only (${DEFAULT_MODEL}, ` +
+      `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
+    );
+  }
+  if (normalized === 'byok') {
+    if (!stated) return 'a byok task needs a model, as "<provider>:<model>" (pick one from /models)';
+    if (!looksLikeByokModel(stated)) {
+      return `"${stated}" is not a byok model id — it must be "<provider>:<model>" (pick one from /models)`;
+    }
+    return '';
+  }
+  // normalized === 'local'
+  if (!stated) return 'a local task needs a model — the tag of whatever is pulled into the local daemon';
+  return '';
 }
 
 /** Phrase match for "work autonomously" in a prompt or a queued task. */
@@ -239,10 +291,14 @@ function withRoundHorizon(rounds, env, fn) {
  *     task over it would break drains for a reason that is not the task's
  *     fault; a fallback to the pooled brain keeps the drain honest and on-cloud.
  */
-function resolveModel({ model, env } = {}) {
-  const e = env || process.env;
+function resolveModel({ model, env, cls } = {}) {
   const picked = String(model || '').trim();
+  // byok/local have no cloud default to fall back to — modelRefusal already
+  // guaranteed a non-empty, shaped model at queue time, so the task's own pick
+  // is the only answer for either class.
+  if (normalizeClass(cls) !== 'aegis') return picked;
   if (picked) return picked;
+  const e = env || process.env;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
   return isAegisModel(fromEnv) ? fromEnv : DEFAULT_MODEL;
 }
@@ -255,7 +311,8 @@ function resolveModel({ model, env } = {}) {
  * it: the queue falls back to the pool, and the one place that says so is this
  * string, which runTask emits as a note and the desktop card shows.
  */
-function ignoredEnvModel({ model, env } = {}) {
+function ignoredEnvModel({ model, env, cls } = {}) {
+  if (normalizeClass(cls) !== 'aegis') return ''; // AEGIS_AUTONOMOUS_MODEL is an Aegis-only pin
   if (String(model || '').trim()) return ''; // the task's own pick is what counts
   const e = env || process.env;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
@@ -462,16 +519,23 @@ function createQueueWorker({
     // pool does not serve: billed work if it happens to be a per-provider
     // spelling, an opaque server error otherwise. Failing here names the model
     // and the allowed ones, and costs nothing.
-    const refusal = modelRefusal(item.model);
+    const cls = normalizeClass(item.class);
+    const refusal = modelRefusal(item.model, cls);
     if (refusal) {
-      const failed = { ok: false, error: refusal, model: item.model, ms: 0 };
+      const failed = { ok: false, error: refusal, model: item.model, class: cls, ms: 0 };
       emit({ type: 'finish', taskId: item.id, ok: false, result: failed });
       return failed;
     }
-    const model = resolveModel({ model: item.model, env });
-    const ignored = ignoredEnvModel({ model: item.model, env });
+    const model = resolveModel({ model: item.model, env, cls });
+    const ignored = ignoredEnvModel({ model: item.model, env, cls });
     if (ignored) emit({ type: 'note', taskId: item.id, note: ignored });
-    const fanoutAsked = resolveFanout(item, env);
+    // The pooled-brain fan-out is an Aegis Cloud mechanism (aegis1
+    // services/pool_brain.py) — engine.js itself only honours `autonomous`
+    // under `cls === 'aegis'` (engine.js:1524), so a byok/local task asking for
+    // it is forced to a plain single pass HERE rather than relying on that
+    // silent no-op, which would otherwise size the task's effort/round
+    // reporting as if a fan-out it never got had been granted.
+    const fanoutAsked = cls === 'aegis' && resolveFanout(item, env);
     // The clamp. `canFanOut()` is the entitlement answer (true everywhere
     // except a non-Pro desktop session), and it can only ever take a fan-out
     // AWAY: a task the session is not entitled to fan out runs as one plain
@@ -526,14 +590,14 @@ function createQueueWorker({
     const wantCommit = commit === undefined ? Boolean(item.commit) : Boolean(commit);
     const before = wantCommit ? safe(() => git.gitStatusSnapshot(cwd), null) : null;
 
-    emit({ type: 'start', taskId: item.id, model, cwd, rounds, fanout, effort });
+    emit({ type: 'start', taskId: item.id, model, class: cls, cwd, rounds, fanout, effort });
     const started = now();
     let result;
     try {
       const res = await withRoundHorizon(rounds, env, () =>
         engine.chat(
           {
-            class: 'aegis',
+            class: cls,
             model,
             prompt: taskPrompt(item, { carry, rounds }),
             // The pooled-brain fan-out ("fan out this turn" in the GUI chat
@@ -831,8 +895,11 @@ module.exports = {
   DEFAULT_MODEL,
   DEFAULT_ROUNDS,
   MAX_ROUND_STOPS,
+  MODEL_CLASSES,
   AEGIS_MODEL_IDS,
   isAegisModel,
+  normalizeClass,
+  looksLikeByokModel,
   modelRefusal,
   WRITE_TOOLS,
   writtenPath,

package/lib/local/context.js

@@ -40,17 +40,27 @@ function messageTokens(message) {
  * @param {string} [opts.system='']
  * @param {number} [opts.budgetTokens=8192]  total tokens allowed on the wire
  * @param {number} [opts.reserveTokens=0]    tokens reserved for the reply
- * @returns {{messages:Array, system:string, dropped:number, estimatedTokens:number}}
+ * @param {number} [opts.fixedTokens=0]      wire cost that is NOT a message and
+ *   cannot be dropped (the tool schemas), counted before any turn is kept
+ * @returns {{messages:Array, system:string, dropped:number, estimatedTokens:number, fixedTokens:number}}
  */
 function trimContext({
   messages = [],
   system = '',
   budgetTokens = 8192,
   reserveTokens = 0,
+  fixedTokens = 0,
 } = {}) {
   const limit = Math.max(0, budgetTokens - reserveTokens);
   const kept = [];
-  let used = 0;
+  // Tool schemas go on the wire every round and cannot be trimmed away, so they
+  // are charged against the budget FIRST. Without this the trimmer believed a
+  // 4096-token window had 4096 tokens for history when the schemas had already
+  // spent ~1971 of them (measured: 10 schemas, 7882 chars) — and the daemon,
+  // run with `--context-shift`, discarded the SYSTEM row to make room instead
+  // of erroring. Counting them here is what keeps the system row alive.
+  const fixed = Math.max(0, Number(fixedTokens) || 0);
+  let used = fixed;
 
   if (system) used += MESSAGE_OVERHEAD + estimateTokens(system);
 
@@ -69,6 +79,7 @@ function trimContext({
     system,
     dropped: messages.length - kept.length,
     estimatedTokens: used,
+    fixedTokens: fixed,
   };
 }
 

package/lib/local/engine.js

@@ -968,6 +968,19 @@ function createLocalEngine({
     // reverse its verdict. An approval that could waive Λ2 would be the exact
     // capture K3 describes. To change what is permitted, the covenant text
     // itself has to be re-sealed — which no runtime input can do.
+    //
+    // DO NOT MOVE THIS BELOW A SHORT-CIRCUIT. It sits above every `return` of
+    // the confirmation gate on purpose (ON8/D8 rule 2): `gatedExecuteTool`
+    // short-circuits on `!confirmModeEnabled()`, on a remembered session
+    // "allow", and on a `/permissions` skip — and since ON8 the confirm-mode
+    // preference is the SHARED store's, i.e. the same value the terminal face
+    // reads, and `--dangerously-skip-permissions` can arrive in that store as
+    // well. A refactor that hoists this below any of those three would make
+    // the covenant waivable by a setting a user can write, which is the one
+    // thing D8 rule 2 forbids outright. The frozen classes
+    // (`write`/`shell`/`network`/`offDevice`, always `'ask'`; see
+    // lib/avatar/level.js `LEVEL_INDEPENDENT_APPROVALS`) have the same floor
+    // and are asserted beside this one by one/test/permissions.test.mjs.
     const cv = covenant.preActionAssert({ tool: name, args: args || {} });
     if (!cv.allowed) {
       // Non-silent (never a quiet no-op) and bound for Λ4 accountability.
@@ -2114,6 +2127,18 @@ function createLocalEngine({
     return { ok: Boolean(controller) };
   }
 
+  /**
+   * Unload every local model this engine warmed, across every daemon it
+   * talked to (local.js `unloadAll`). The desktop host calls this on its quit
+   * path so closing the app also closes the model — the local lane bills
+   * nothing precisely because it is YOUR hardware, and hardware left running
+   * a model nobody is using anymore after the app exits is the one cost that
+   * lane was supposed to never have.
+   */
+  function unloadLocalModels() {
+    return localT.unloadAll();
+  }
+
   return {
     CLASSES,
     listClasses,
@@ -2123,6 +2148,7 @@ function createLocalEngine({
     respondApproval,
     clearSessionApprovals,
     settings,
+    unloadLocalModels,
   };
 }