aegis-desktop 0.8.29 → 0.8.31

package/lib/local/autonomous.js

@@ -97,48 +97,100 @@ function writtenPath(tool) {
 const DEFAULT_MODEL = 'nexus-brain';
 
 /**
- * THE QUEUE RUNS ON AEGIS CLOUD, AND NOTHING ELSE.
+ * THE QUEUE RUNS ON WHATEVER CLASS THE TASK NAMES — aegis, byok, or local —
+ * the same three classes engine.js's interactive turns serve (engine.js's
+ * exported `CLASSES`). This module does not `require('./engine.js')` to read
+ * that list itself (same reason queue.js stays engine-free): duplicating the
+ * three names here keeps both modules testable with no Electron, no network,
+ * and no model.
  *
- * A queued task is billed to the AEGIS pool and every turn it makes goes out
- * with `class: 'aegis'` (see runTask below) — the pool is the only backend this
- * worker can reach. So a model id here has to be one the *pool* serves. A
- * direct-provider id is not a cheaper option the queue could fall back to; it
- * is a request the pool cannot honour, or worse, a per-provider spelling
- * (`anthropic`, `groq`, …) that quietly pins one upstream instead of letting
- * the pool auto-route across whichever providers hold a live key.
+ * This used to be Aegis Cloud only, because runTask sent every turn out with
+ * a hardcoded `class: 'aegis'` — a byok or local model id would have gone out
+ * under the wrong transport and failed at the server, or worse, silently
+ * picked up the wrong provider's key. Now `class` travels with the task
+ * (`item.class`, defaulted to 'aegis' for every task that predates this field
+ * — the CLI, a hand-written queue file, the old desktop card), and runTask
+ * forwards it verbatim instead of overwriting it.
  *
- * The accept-list is therefore the pooled-brain tier family — the one entry
- * engine.js's offerableCatalog offers for the Aegis Cloud class, plus the
- * `-smart`/`-neo` tier spellings the server still serves as aliases of it. This
- * mirrors selectBrainEntry() there rather than re-deriving "anything starting
- * with nexus-": `nexus-fast` is not a tier the catalog has ever served, and
- * accepting a made-up id means a queued task that fails at the server after
- * being picked up, or runs on a tier nobody chose.
+ * Each class validates differently, because each has a different notion of
+ * "no model stated is fine":
+ *   - 'aegis' has a real default (the pooled brain), so a blank model is
+ *     accepted and resolveModel fills it in. The accept-list is the
+ *     pooled-brain tier family — the one entry engine.js's offerableCatalog
+ *     offers for the Aegis Cloud class, plus the `-smart`/`-neo` tier
+ *     spellings the server still serves as aliases of it (mirrors
+ *     selectBrainEntry() there rather than re-deriving "anything starting
+ *     with nexus-": `nexus-fast` is not a tier the catalog has ever served).
+ *   - 'byok' and 'local' have no such default: a blank byok model cannot be
+ *     "whichever provider the pool picks" (there is no pool), and a blank
+ *     local model cannot be "whichever model is pulled" when the answer
+ *     depends on what the user's own daemon happens to have. Both REQUIRE an
+ *     explicit model, refused by name instead of silently resolving to
+ *     something nobody chose.
  */
+const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+
 const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
 const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
 
-/** True when `id` names an AEGIS Cloud pooled-brain tier (the queue's only models). */
+/** True when `id` names an AEGIS Cloud pooled-brain tier. */
 function isAegisModel(id) {
   return AEGIS_MODEL_RE.test(String(id == null ? '' : id).trim());
 }
 
 /**
- * Why a STATED model id cannot be queued, or '' when it can. Blank is not a
- * refusal — "no pick" is the default model, which resolveModel supplies.
+ * Normalize a task's stated class to one this module (and engine.js) knows.
+ * Blank or absent — every task queued before this field existed — defaults to
+ * 'aegis', the only class the queue ever ran before today.
+ */
+function normalizeClass(cls) {
+  const stated = String(cls == null ? '' : cls).trim().toLowerCase();
+  return stated || 'aegis';
+}
+
+/**
+ * Whether `id` is shaped "<provider>:<model>" — the only form engine.js's
+ * byok class accepts (splitByokModel). Not re-deriving the live provider list
+ * here (that is a catalog call, `listModels('byok')`, this module has no
+ * business caching) — just enough of a shape check that a malformed id is
+ * refused at the door instead of failing splitByokModel at the server with no
+ * context.
+ */
+function looksLikeByokModel(id) {
+  const s = String(id == null ? '' : id).trim();
+  const i = s.indexOf(':');
+  return i > 0 && i < s.length - 1;
+}
+
+/**
+ * Why a STATED (model, class) pair cannot be queued, or '' when it can.
  *
- * The message names the pool, because the failure it prevents ("queued on
- * claude-sonnet-4, ran on — or was billed to — something else") is invisible
- * otherwise: `class: 'aegis'` would be sent with an id the server does not
- * serve, and the task would come back as an opaque error minutes later.
+ * `cls` defaults to 'aegis' when omitted, so every existing caller of
+ * `modelRefusal(id)` keeps its old behaviour verbatim.
  */
-function modelRefusal(id) {
+function modelRefusal(id, cls) {
   const stated = String(id == null ? '' : id).trim();
-  if (!stated || isAegisModel(stated)) return '';
-  return (
-    `the autonomous queue runs Aegis Cloud models only (${DEFAULT_MODEL}, ` +
-    `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
-  );
+  const normalized = normalizeClass(cls);
+  if (!MODEL_CLASSES.includes(normalized)) {
+    return `"${cls}" is not a model class the queue serves (${MODEL_CLASSES.join('/')})`;
+  }
+  if (normalized === 'aegis') {
+    if (!stated || isAegisModel(stated)) return '';
+    return (
+      `the autonomous queue's Aegis Cloud class runs pooled-brain models only (${DEFAULT_MODEL}, ` +
+      `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
+    );
+  }
+  if (normalized === 'byok') {
+    if (!stated) return 'a byok task needs a model, as "<provider>:<model>" (pick one from /models)';
+    if (!looksLikeByokModel(stated)) {
+      return `"${stated}" is not a byok model id — it must be "<provider>:<model>" (pick one from /models)`;
+    }
+    return '';
+  }
+  // normalized === 'local'
+  if (!stated) return 'a local task needs a model — the tag of whatever is pulled into the local daemon';
+  return '';
 }
 
 /** Phrase match for "work autonomously" in a prompt or a queued task. */
@@ -239,10 +291,14 @@ function withRoundHorizon(rounds, env, fn) {
  *     task over it would break drains for a reason that is not the task's
  *     fault; a fallback to the pooled brain keeps the drain honest and on-cloud.
  */
-function resolveModel({ model, env } = {}) {
-  const e = env || process.env;
+function resolveModel({ model, env, cls } = {}) {
   const picked = String(model || '').trim();
+  // byok/local have no cloud default to fall back to — modelRefusal already
+  // guaranteed a non-empty, shaped model at queue time, so the task's own pick
+  // is the only answer for either class.
+  if (normalizeClass(cls) !== 'aegis') return picked;
   if (picked) return picked;
+  const e = env || process.env;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
   return isAegisModel(fromEnv) ? fromEnv : DEFAULT_MODEL;
 }
@@ -255,7 +311,8 @@ function resolveModel({ model, env } = {}) {
  * it: the queue falls back to the pool, and the one place that says so is this
  * string, which runTask emits as a note and the desktop card shows.
  */
-function ignoredEnvModel({ model, env } = {}) {
+function ignoredEnvModel({ model, env, cls } = {}) {
+  if (normalizeClass(cls) !== 'aegis') return ''; // AEGIS_AUTONOMOUS_MODEL is an Aegis-only pin
   if (String(model || '').trim()) return ''; // the task's own pick is what counts
   const e = env || process.env;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
@@ -462,16 +519,23 @@ function createQueueWorker({
     // pool does not serve: billed work if it happens to be a per-provider
     // spelling, an opaque server error otherwise. Failing here names the model
     // and the allowed ones, and costs nothing.
-    const refusal = modelRefusal(item.model);
+    const cls = normalizeClass(item.class);
+    const refusal = modelRefusal(item.model, cls);
     if (refusal) {
-      const failed = { ok: false, error: refusal, model: item.model, ms: 0 };
+      const failed = { ok: false, error: refusal, model: item.model, class: cls, ms: 0 };
       emit({ type: 'finish', taskId: item.id, ok: false, result: failed });
       return failed;
     }
-    const model = resolveModel({ model: item.model, env });
-    const ignored = ignoredEnvModel({ model: item.model, env });
+    const model = resolveModel({ model: item.model, env, cls });
+    const ignored = ignoredEnvModel({ model: item.model, env, cls });
     if (ignored) emit({ type: 'note', taskId: item.id, note: ignored });
-    const fanoutAsked = resolveFanout(item, env);
+    // The pooled-brain fan-out is an Aegis Cloud mechanism (aegis1
+    // services/pool_brain.py) — engine.js itself only honours `autonomous`
+    // under `cls === 'aegis'` (engine.js:1524), so a byok/local task asking for
+    // it is forced to a plain single pass HERE rather than relying on that
+    // silent no-op, which would otherwise size the task's effort/round
+    // reporting as if a fan-out it never got had been granted.
+    const fanoutAsked = cls === 'aegis' && resolveFanout(item, env);
     // The clamp. `canFanOut()` is the entitlement answer (true everywhere
     // except a non-Pro desktop session), and it can only ever take a fan-out
     // AWAY: a task the session is not entitled to fan out runs as one plain
@@ -526,14 +590,14 @@ function createQueueWorker({
     const wantCommit = commit === undefined ? Boolean(item.commit) : Boolean(commit);
     const before = wantCommit ? safe(() => git.gitStatusSnapshot(cwd), null) : null;
 
-    emit({ type: 'start', taskId: item.id, model, cwd, rounds, fanout, effort });
+    emit({ type: 'start', taskId: item.id, model, class: cls, cwd, rounds, fanout, effort });
     const started = now();
     let result;
     try {
       const res = await withRoundHorizon(rounds, env, () =>
         engine.chat(
           {
-            class: 'aegis',
+            class: cls,
             model,
             prompt: taskPrompt(item, { carry, rounds }),
             // The pooled-brain fan-out ("fan out this turn" in the GUI chat
@@ -831,8 +895,11 @@ module.exports = {
   DEFAULT_MODEL,
   DEFAULT_ROUNDS,
   MAX_ROUND_STOPS,
+  MODEL_CLASSES,
   AEGIS_MODEL_IDS,
   isAegisModel,
+  normalizeClass,
+  looksLikeByokModel,
   modelRefusal,
   WRITE_TOOLS,
   writtenPath,

package/lib/local/engine.js

@@ -968,6 +968,19 @@ function createLocalEngine({
     // reverse its verdict. An approval that could waive Λ2 would be the exact
     // capture K3 describes. To change what is permitted, the covenant text
     // itself has to be re-sealed — which no runtime input can do.
+    //
+    // DO NOT MOVE THIS BELOW A SHORT-CIRCUIT. It sits above every `return` of
+    // the confirmation gate on purpose (ON8/D8 rule 2): `gatedExecuteTool`
+    // short-circuits on `!confirmModeEnabled()`, on a remembered session
+    // "allow", and on a `/permissions` skip — and since ON8 the confirm-mode
+    // preference is the SHARED store's, i.e. the same value the terminal face
+    // reads, and `--dangerously-skip-permissions` can arrive in that store as
+    // well. A refactor that hoists this below any of those three would make
+    // the covenant waivable by a setting a user can write, which is the one
+    // thing D8 rule 2 forbids outright. The frozen classes
+    // (`write`/`shell`/`network`/`offDevice`, always `'ask'`; see
+    // lib/avatar/level.js `LEVEL_INDEPENDENT_APPROVALS`) have the same floor
+    // and are asserted beside this one by one/test/permissions.test.mjs.
     const cv = covenant.preActionAssert({ tool: name, args: args || {} });
     if (!cv.allowed) {
       // Non-silent (never a quiet no-op) and bound for Λ4 accountability.

package/lib/local/queue.js

@@ -176,34 +176,38 @@ function upsert(items, entry) {
 
 /**
  * Queue a task. `cwd` is where the work happens (the worker runs the turn
- * with it as the tool loop's working directory), `model` is the AEGIS Cloud
- * model id to run it on, and `commit` asks the worker to commit what the task
- * changed (scoped — see autonomous.js).
+ * with it as the tool loop's working directory), `class` + `model` are the
+ * same pair engine.js's interactive turns use ('aegis'/'byok'/'local' and the
+ * model id that class expects), and `commit` asks the worker to commit what
+ * the task changed (scoped — see autonomous.js).
  *
- * AEGIS CLOUD ONLY, REFUSED AT THE DOOR. The worker sends every task out as
- * `class: 'aegis'`, so a model the pool does not serve cannot run here at all —
- * it is a task that fails minutes into a drain, after being picked up, with an
- * opaque server error. `model: null` stays legal: that is "no pick", and
- * autonomous.resolveModel fills in the pooled brain. Anything else has to pass
- * that module's own accept-list, so the CLI (`aegiscode autonomous add
- * --model`), the desktop card and a hand-written queue file are all held to the
- * same rule. Required lazily: queue.js is a dependency of autonomous.js, and
- * this check must not turn that into a load-order cycle.
+ * REFUSED AT THE DOOR, not three stages into a drain. `class` defaults to
+ * 'aegis' (every task queued before this field existed), and the (model,
+ * class) pair has to pass autonomous.js's own accept-list — the CLI
+ * (`aegiscode autonomous add --model`), the desktop card and a hand-written
+ * queue file are all held to the same rule, so a bad row fails here with a
+ * reason instead of coming back as an opaque server error after being picked
+ * up. `model: null` stays legal for the 'aegis' class only: that is "no
+ * pick", and autonomous.resolveModel fills in the pooled brain. 'byok' and
+ * 'local' have no such default and are refused if blank — see
+ * autonomous.modelRefusal. Required lazily: queue.js is a dependency of
+ * autonomous.js, and this check must not turn that into a load-order cycle.
  */
 function addTask(env, opts = {}) {
   const task = String(opts.task == null ? '' : opts.task).trim();
   if (!task) throw new Error('queue: a task needs text');
+  const autonomousMod = require('./autonomous.js');
+  const cls = autonomousMod.normalizeClass(opts.class);
   const statedModel = String(opts.model == null ? '' : opts.model).trim();
-  if (statedModel) {
-    const refusal = require('./autonomous.js').modelRefusal(statedModel);
-    if (refusal) throw new Error(`queue: ${refusal}`);
-  }
+  const refusal = autonomousMod.modelRefusal(statedModel, cls);
+  if (refusal) throw new Error(`queue: ${refusal}`);
   const items = loadQueue(env);
   const now = opts.now || Date.now();
   const entry = {
     id: nextId(items),
     task,
     cwd: opts.cwd || process.cwd(),
+    class: cls,
     model: statedModel || null,
     effort: opts.effort || null,
     workers: Number.isInteger(opts.workers) ? opts.workers : null,

package/lib/settings.js

@@ -270,6 +270,15 @@ function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
     try {
       return prefs.adopt({ dir: sharedDir, legacyDir: dir });
     } catch (err) {
+      // Best-effort, but NOT silent (AEGISONE ON8). Swallowing this throw is how
+      // `prefs.adopt()`'s refusal to write its own ledger went unnoticed — the
+      // migration failed for every install that had something to adopt, and the
+      // store reported a healthy `adopted: false`. A failed migration is a
+      // preference a user set that this launch did not honor, so it is reported
+      // where a developer will see it; a store must still open either way.
+      if (process.env.AEGISCODE_DEBUG || process.env.AEGIS_HIST_DEBUG) {
+        process.stderr.write(`aegis-desktop: shared-preference adoption failed: ${err.message}\n`);
+      }
       return { adopted: false, keys: [], reason: `adoption failed: ${err.message}` };
     }
   })();
@@ -525,26 +534,50 @@ function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
     return quickLauncherConfig();
   }
 
-  // --- Confirm mode: reserved namespace, plain (unencrypted) preference ----
-  // "Confirm before running tools" — the ON/OFF switch for the renderer's
-  // tool-call approval gate (desktop/lib/local/engine.js gatedExecuteTool).
-  // ON (default, and the behaviour shipped so far) means every mutating tool
-  // call — exec / writeFile / editFile — is previewed and approved by the user
-  // first. OFF means the engine runs them straight through, like a tool the
-  // session already allowed. Nothing secret is stored here, so no encryption.
+  // --- Confirm mode: SHARED preference (AEGISONE ON8, decision D8 rule 1) --
+  // "Confirm before running tools" — the switch for the renderer's tool-call
+  // approval gate (desktop/lib/local/engine.js gatedExecuteTool). ON (default,
+  // and the behaviour shipped so far) means every mutating tool call — exec /
+  // writeFile / editFile — is previewed and approved by the user first. OFF
+  // means the engine runs them straight through, like a tool the session
+  // already allowed. Nothing secret is stored here, so no encryption.
+  //
+  // This preference MOVED to the shared store (`confirmMode`) because D8 rule 1
+  // is "one posture, two faces": a rule set in the window has to be the rule the
+  // shell honors. The pre-ON8 `__confirmMode` namespace in `<userData>` is
+  // adopted once (client/prefs.js `extractNonSecretHalf`) and still read as a
+  // fallback, never written — a second writer is the split-brain this replaced.
+  // The gate's polarity is unchanged: ON when unset, in both places, so an
+  // install that never touched the switch keeps the gate exactly as it was.
+
+  function confirmModeState() {
+    const shared = loadShared();
+    if (typeof shared.confirmMode === 'boolean') {
+      return { enabled: shared.confirmMode, source: 'config' };
+    }
+    const cfg = load()[CONFIRM_MODE_NAMESPACE] || {};
+    if (cfg.enabled === undefined) return { enabled: true, source: 'default' };
+    return { enabled: Boolean(cfg.enabled), source: 'config' };
+  }
 
   function getConfirmMode() {
-    const cfg = load()[CONFIRM_MODE_NAMESPACE] || {};
-    // Unset === true: an existing install that never touched the toggle keeps
-    // the gate exactly as it was.
-    return cfg.enabled === undefined ? true : Boolean(cfg.enabled);
+    return confirmModeState().enabled;
   }
 
   function setConfirmMode(enabled) {
+    prefs.set({ confirmMode: Boolean(enabled) }, { dir: sharedDir });
+    // One-way: retire the legacy copy in the same breath, so the posture exists
+    // in exactly one place from here on (the same retirement the memory-persist
+    // preference below does).
     const data = load();
-    data[CONFIRM_MODE_NAMESPACE] = { enabled: Boolean(enabled) };
-    save(data);
-    return getConfirmMode();
+    if (data[CONFIRM_MODE_NAMESPACE] !== undefined) {
+      delete data[CONFIRM_MODE_NAMESPACE];
+      save(data);
+    }
+    // The boolean, not the state record: main.js's IPC reply is `{ enabled }`
+    // and it wraps the return value itself, so widening this would have put an
+    // object inside an object on the wire.
+    return confirmModeState().enabled;
   }
 
   // --- Telemetry: reserved namespace, plain preference, DEFAULT OFF --------
@@ -771,6 +804,7 @@ function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
     setQuickLauncherConfig,
     getConfirmMode,
     setConfirmMode,
+    confirmModeState,
     getTelemetryOptIn,
     setTelemetryOptIn,
     getMemoryPersist,

package/main.js

@@ -1972,8 +1972,10 @@ function createQueueDispatch({
       draining,
       stopping: stopRequested,
       defaultCwd: process.cwd(),
-      // What a task with no model of its own actually runs on. The queue is
-      // Aegis Cloud only, so this is a pooled tier id — and the card prints it,
+      // What a task with no model of its own, on the Aegis Cloud class, actually
+      // runs on — a pooled tier id. byok and local tasks always carry an
+      // explicit model (see autonomous.js modelRefusal), so there is no
+      // equivalent default to report for those classes. The card prints this
       // because "which model is this drain spending on" was previously
       // unanswerable from the UI.
       defaultModel: autonomous.resolveModel({ env }),
@@ -2008,19 +2010,20 @@ function createQueueDispatch({
     if (!path.isAbsolute(cwd)) return { error: 'the working directory must be an absolute path' };
     if (!isExistingDir(cwd)) return { error: `not a directory: ${cwd}` };
 
+    const cls = autonomous.normalizeClass(p.class);
     const model = String(p.model == null ? '' : p.model).trim().slice(0, 120) || null;
-    // Aegis Cloud only (autonomous.js modelRefusal): the worker's requests go
-    // out as `class: 'aegis'`, so a model the pool does not serve is a task that
-    // fails inside a drain. Refused HERE so the card gets the reason at the
-    // moment of queueing instead of a red row later. queue.addTask enforces the
-    // same rule for the CLI and for hand-written queue files.
-    const modelRefusal = model ? autonomous.modelRefusal(model) : '';
+    // Refused HERE so the card gets the reason at the moment of queueing
+    // instead of a red row later. queue.addTask enforces the same (model,
+    // class) rule for the CLI and for hand-written queue files — see
+    // autonomous.js modelRefusal for what each class requires.
+    const modelRefusal = autonomous.modelRefusal(model, cls);
     if (modelRefusal) return { error: modelRefusal };
     const effortRaw = String(p.effort == null ? '' : p.effort).trim().toLowerCase();
     return {
       opts: {
         task,
         cwd,
+        class: cls,
         model,
         effort: QUEUE_EFFORTS.has(effortRaw) ? effortRaw : null,
         workers: clampInt(p.workers, 1, QUEUE_MAX_WORKERS),
@@ -2029,7 +2032,12 @@ function createQueueDispatch({
         // it costs about workers+1 full reasoning calls on one task, so the
         // card has to ask for it per task. queue.addTask stores the inverse
         // (`singlePass`), which is also the field a hand-written queue file
-        // or the CLI uses.
+        // or the CLI uses. Fan-out is an Aegis Cloud mechanism only — a
+        // byok/local task that somehow carried `fanout: true` is NOT honoured
+        // as a fan-out here (autonomous.js's runTask forces it off for any
+        // non-aegis class regardless of this flag), but it is still recorded
+        // as the task's own ask rather than silently rewritten, matching
+        // resolveFanout's "a wrong pick is reported, not rewritten" rule.
         singlePass: !(p.fanout === true || p.autonomous === true),
         commit: Boolean(p.commit),
         source: 'desktop',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.29",
+  "version": "0.8.31",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/preload.js

@@ -423,8 +423,8 @@ const quickLauncher = {
 //      a real checkout, so that switch is persisted and visible rather than
 //      implied — but it is also not hidden from this file's users any more.
 const queue = {
-  // Queue one task. `payload` is { task, cwd, model, effort, workers, maxRounds,
-  // commit }; main.js range-checks every field and answers
+  // Queue one task. `payload` is { task, cwd, class, model, effort, workers,
+  // maxRounds, commit }; main.js range-checks every field and answers
   // { ok, item, items, pending, running, runs, … } or { ok: false, reason }.
   enqueue: (payload) => invokeQueue('enqueue', queueTaskFields(payload)),
   // Full state: { items, pending, running, draining, runs, defaultCwd, … }.
@@ -531,6 +531,11 @@ function queueTaskFields(payload) {
   return {
     task: String(p.task == null ? '' : p.task),
     cwd: String(p.cwd == null ? '' : p.cwd),
+    // 'aegis' | 'byok' | 'local' — same three classes the main composer uses
+    // (window.models.listClasses()). main.js defaults a blank/missing value to
+    // 'aegis' (autonomous.normalizeClass), so an older renderer build that
+    // never sends this field keeps behaving exactly as it did before.
+    class: p.class == null ? null : String(p.class),
     model: p.model == null ? null : String(p.model),
     effort: p.effort == null ? null : String(p.effort),
     workers: p.workers == null ? null : Number(p.workers),

package/renderer/app.js

@@ -145,6 +145,10 @@ const ELEMENT_IDS = {
   send: 'send',
   exploreToggle: 'explore-toggle',
   queueTask: 'queue-task',
+  queueClassSelect: 'queue-class-select',
+  queueModelSelect: 'queue-model-select',
+  queueModelInput: 'queue-model-input',
+  queueModelHint: 'queue-model-hint',
   queueCwd: 'queue-cwd',
   queueCommit: 'queue-commit',
   queueEnqueue: 'queue-enqueue',
@@ -186,6 +190,11 @@ for (const [prop, id] of Object.entries(ELEMENT_IDS)) {
 }
 
 const CLASS_KEY = 'aegis.class';
+// The queue card's own class pick, kept separate from the chat composer's
+// (CLASS_KEY) — a queued task's backend and the interactive chat's are
+// independent choices, so picking "local" for one must not silently flip
+// the other the next time either picker loads.
+const QUEUE_CLASS_KEY = 'aegis.queueClass';
 const AUTONOMOUS_KEY = 'aegis.autonomous';
 // The budget rung. Applies to every class now that the Max tokens dropdown is
 // gone, so it is no longer stored under the autonomous-mode namespace; the old
@@ -1463,6 +1472,8 @@ async function enqueueQueueTask() {
     const res = await queueApi.enqueue({
       task,
       cwd: els.queueCwd ? els.queueCwd.value.trim() : '',
+      class: els.queueClassSelect ? els.queueClassSelect.value : undefined,
+      model: queueSelectedModel(),
       commit: els.queueCommit ? els.queueCommit.checked : false,
     });
     if (res && res.ok) {
@@ -1702,11 +1713,17 @@ function formatAutoInterval(ms) {
   return Number.isInteger(min) ? `every ${min} min` : `every ${min.toFixed(1)} min`;
 }
 
-/** Paint both automation states from main's answer (`auto.status()`). */
+/**
+ * Paint the auto-drain half of main's answer (`auto.status()`). The mint
+ * (auto-seal) half is NOT painted here: that control lives on the φ(α) panel,
+ * not the queue card, and desktop/renderer/fingerprint.js's own mount() reads
+ * and repaints it independently (loadAutoMint() -> renderAutoMint(), a
+ * closure local to that module, not a global this file could reach even if
+ * it wanted to).
+ */
 function renderAutoStatus(payload) {
   if (!payload || typeof payload !== 'object') return;
   if (payload.drain) renderAutoDrain(payload.drain);
-  if (typeof renderAutoMint === 'function' && payload.mint) renderAutoMint(payload.mint);
 }
 
 /**
@@ -3585,6 +3602,125 @@ async function loadModels(cls) {
   }
 }
 
+// --------------------------------------------------------- queue model class
+//
+// The queue card's own class/model picker, independent of the chat
+// composer's (QUEUE_CLASS_KEY vs CLASS_KEY — see the constant above): a
+// queued task can run on a different backend than whatever the composer is
+// currently pointed at. Deliberately a trimmed copy of loadClasses/loadModels
+// rather than a shared helper — the composer's version carries budget-ceiling
+// display and the autonomous-toggle visibility it owns, neither of which
+// belongs to a task that has not run yet.
+
+/** Mirrors currentModelId() for the queue's own picker. */
+function queueSelectedModel() {
+  if (els.queueModelInput && !els.queueModelInput.hidden) {
+    const typed = els.queueModelInput.value.trim();
+    if (typed) return typed;
+  }
+  return els.queueModelSelect ? els.queueModelSelect.value : '';
+}
+
+/** Fan-out is an Aegis Cloud mechanism only (autonomous.js runTask forces it
+ *  off for any other class) — hide the control instead of leaving a checkbox
+ *  on screen that would silently do nothing, same reasoning as the composer's
+ *  autonomousToggleWrap (AUTONOMOUS_CLASS). */
+function updateQueueFanoutVisibility(cls) {
+  const wrap = els.queueFanout && els.queueFanout.closest('label');
+  if (wrap) wrap.hidden = cls !== 'aegis';
+}
+
+async function loadQueueModels(cls) {
+  if (!els.queueModelSelect) return;
+  updateQueueFanoutVisibility(cls);
+
+  els.queueModelSelect.hidden = false;
+  els.queueModelSelect.disabled = false;
+  if (els.queueModelInput) {
+    els.queueModelInput.hidden = true;
+    els.queueModelInput.value = '';
+  }
+  if (els.queueModelHint) els.queueModelHint.textContent = '';
+
+  els.queueModelSelect.innerHTML = '';
+  if (cls === 'aegis') {
+    // Only this class has a real default to fall back to (resolveModel fills
+    // in the pooled brain) — byok/local tasks must name a model, so neither
+    // gets this option.
+    const auto = document.createElement('option');
+    auto.value = '';
+    auto.textContent = 'server default (auto)';
+    els.queueModelSelect.appendChild(auto);
+  }
+
+  try {
+    const data = await models.listModels(cls);
+    const list = Array.isArray(data && data.models) ? data.models : [];
+    const needsKey = Boolean(data && data.needsKey);
+    const needsDaemon = Boolean(data && data.needsDaemon);
+    const listed = !(data && data.listed === false);
+    if (els.queueModelInput) {
+      els.queueModelInput.hidden = !(cls === 'local' && (needsDaemon || !listed));
+    }
+    for (const m of list) {
+      const opt = document.createElement('option');
+      opt.value = m.id;
+      opt.textContent = m.label || m.id;
+      els.queueModelSelect.appendChild(opt);
+    }
+    if (!els.queueModelHint) return;
+    if (needsKey) {
+      els.queueModelHint.textContent =
+        'Connect this class in the Model card above (API key / provider key), then Refresh.';
+    } else if (needsDaemon) {
+      els.queueModelHint.textContent =
+        `No local model server at ${(data && data.baseURL) || 'the configured address'} — ` +
+        'start it, then reopen this picker.';
+    } else if (cls === 'local' && !listed) {
+      els.queueModelHint.textContent =
+        'That address answered but listed no models — type the model tag above.';
+    } else if (!list.length) {
+      els.queueModelHint.textContent =
+        cls === 'local'
+          ? 'No models on this server yet — pull one first (ollama pull llama3.2).'
+          : cls === 'aegis'
+            ? "No models to pin — this runs the pooled route on the server's own default."
+            : 'No models listed.';
+    } else if (cls === 'byok' && data && data.needsProviderKey) {
+      els.queueModelHint.textContent =
+        'A provider key is required before a queued task on this model can run — add one in the Model card above.';
+    }
+  } catch (err) {
+    if (els.queueModelHint) {
+      els.queueModelHint.textContent = `listModels failed: ${err && err.message ? err.message : err}`;
+    }
+  }
+}
+
+async function loadQueueClasses() {
+  if (!els.queueClassSelect) return;
+  let classOptions = [];
+  try {
+    classOptions = (await models.listClasses()) || [];
+  } catch (err) {
+    classOptions = [];
+    if (els.queueModelHint) {
+      els.queueModelHint.textContent = `listClasses failed: ${err && err.message ? err.message : err}`;
+    }
+  }
+  els.queueClassSelect.innerHTML = '';
+  for (const c of classOptions) {
+    const opt = document.createElement('option');
+    opt.value = c.class;
+    opt.textContent = c.configured ? c.label : `${c.label} (not configured)`;
+    els.queueClassSelect.appendChild(opt);
+  }
+  const saved = localStorage.getItem(QUEUE_CLASS_KEY);
+  if (saved && classOptions.some((c) => c.class === saved)) {
+    els.queueClassSelect.value = saved;
+  }
+  await loadQueueModels(els.queueClassSelect.value);
+}
 
 // -------------------------------------------------------------- settings pane
 
@@ -4756,10 +4892,17 @@ async function init() {
     // A worker's frames are a status line, never transcript entries (that
     // separation is main.js's own progress channel, not aegis:chatDelta).
     if (typeof queueApi.onProgress === 'function') queueApi.onProgress(renderQueueProgress);
+    if (els.queueClassSelect) {
+      els.queueClassSelect.addEventListener('change', () => {
+        localStorage.setItem(QUEUE_CLASS_KEY, els.queueClassSelect.value);
+        loadQueueModels(els.queueClassSelect.value);
+      });
+    }
     // Paint the card once, from state that already exists on disk. A list, not a
     // drain: queueing a task in another window (or from the CLI) and opening
     // this one must show that task, and must not run it.
     await loadQueueState();
+    await loadQueueClasses();
   }
 
   // ── the two automation switches ──────────────────────────────────────────

package/renderer/index.html

@@ -277,6 +277,24 @@
           rows="2"
           placeholder="Queue a task to run unattended…"
         ></textarea>
+        <!-- Which backend this task runs on — the same three classes
+             (window.models.listClasses()) and the same per-class model list
+             (listModels(cls)) the chat composer's #class-select/#model-select
+             use. Aegis Cloud can leave the model on "server default"; byok and
+             local tasks must name one (autonomous.js modelRefusal refuses a
+             blank at the door for those two). -->
+        <div class="api-key-row">
+          <select id="queue-class-select" title="Which backend this task runs on."></select>
+          <select id="queue-model-select" title="The model for the picked class."></select>
+        </div>
+        <input
+          type="text"
+          id="queue-model-input"
+          placeholder="model tag — e.g. llama3.2:3b"
+          autocomplete="off"
+          hidden
+        />
+        <p class="hint" id="queue-model-hint"></p>
         <div class="api-key-row">
           <input
             type="text"

package/vendor/prefs.js

@@ -69,6 +69,11 @@ const SHARED_PREF_KEYS = Object.freeze([
   'effort',
   'vim',
   'memoryPersist',
+  // ON8 / D8 rule 1: the confirmation gate is a POSTURE, not a surface. The
+  // window's "confirm before running tools" switch and the shell's rule set
+  // answer the same question ("may this call run unattended?"), so the switch
+  // lives beside the rules that gate answers, in the one store both hosts read.
+  'confirmMode',
 ]);
 
 /**
@@ -79,6 +84,15 @@ const SHARED_PREF_KEYS = Object.freeze([
  */
 const LEGACY_MEMORY_PERSIST_NAMESPACE = '__memoryPersist';
 
+/**
+ * The second legacy namespace this store retires (ON8): the window's
+ * `__confirmMode: { enabled }` becomes the shared `confirmMode` boolean. Same
+ * rule, same reason as memory-persist above — and it is the one that closes
+ * D8's rule 1 in the direction that used to be impossible: a posture set in
+ * the window is now the posture the shell reads.
+ */
+const LEGACY_CONFIRM_MODE_NAMESPACE = '__confirmMode';
+
 /**
  * Key names that mean "secret" wherever they appear in the tree. Deliberately
  * conservative: `keyMask`-style *previews* never reach this file (they are not
@@ -233,7 +247,7 @@ function remove(key, opts) {
 /**
  * The non-secret half of a legacy `<userData>/settings.json`, in the shared
  * store's spellings. Only namespaces THIS store owns are extracted: the other
- * app-level namespaces (`__confirmMode`, `__avatar`, `__telemetry`,
+ * app-level namespaces (`__avatar`, `__telemetry`,
  * `__autoDrain`, `__autoMint`, `__quickLauncher`) stay host-local until their
  * own phase moves them, and the provider rows are never here at all because a
  * provider row is where a key lives.
@@ -244,6 +258,13 @@ function extractNonSecretHalf(legacy) {
   if (src && typeof src === 'object' && typeof src.enabled === 'boolean') {
     out.memoryPersist = src.enabled;
   }
+  // ON8: the confirmation gate adopts the same way. `enabled: true` means the
+  // gate is UP, which is the shared `confirmMode: true`; the shared key keeps
+  // the window's own polarity so an adopting install cannot flip its gate.
+  const gate = (legacy || {})[LEGACY_CONFIRM_MODE_NAMESPACE];
+  if (gate && typeof gate === 'object' && typeof gate.enabled === 'boolean') {
+    out.confirmMode = gate.enabled;
+  }
   return out;
 }
 
@@ -290,10 +311,19 @@ function adopt(opts) {
   }
   const patch = {};
   for (const k of keys) patch[k] = half[k];
+  // `names`, NOT `keys` (AEGISONE ON8): this ledger is written through `write()`
+  // below, so it is scanned like everything else — and `SECRET_KEY_RE` matches
+  // `key`/`keys` by design, because a preference named `keys` IS how key material
+  // would smuggle itself into a file the desktop and the shell both read. Spelled
+  // `keys`, this field made `assertNoSecrets` refuse the store's own write, so
+  // EVERY adoption with something to adopt threw — the whole pre-D5 migration was
+  // dead, silently (settings.js's best-effort catch turned the throw into "no
+  // adoption" and no one was told). The scanner is the control here, not the bug;
+  // a field name is free to change.
   patch.adopted = {
     from: legacyFile,
     at: new Date().toISOString(),
-    keys: keys.slice().sort(),
+    names: keys.slice().sort(),
   };
   write({ ...current, ...patch }, o);
   return { adopted: true, keys: keys.slice().sort(), from: legacyFile };