aegis-desktop 0.8.29 → 0.8.32

package/lib/local/autonomous.js

@@ -97,48 +97,100 @@ function writtenPath(tool) {
 const DEFAULT_MODEL = 'nexus-brain';
 
 /**
- * THE QUEUE RUNS ON AEGIS CLOUD, AND NOTHING ELSE.
+ * THE QUEUE RUNS ON WHATEVER CLASS THE TASK NAMES — aegis, byok, or local —
+ * the same three classes engine.js's interactive turns serve (engine.js's
+ * exported `CLASSES`). This module does not `require('./engine.js')` to read
+ * that list itself (same reason queue.js stays engine-free): duplicating the
+ * three names here keeps both modules testable with no Electron, no network,
+ * and no model.
  *
- * A queued task is billed to the AEGIS pool and every turn it makes goes out
- * with `class: 'aegis'` (see runTask below) — the pool is the only backend this
- * worker can reach. So a model id here has to be one the *pool* serves. A
- * direct-provider id is not a cheaper option the queue could fall back to; it
- * is a request the pool cannot honour, or worse, a per-provider spelling
- * (`anthropic`, `groq`, …) that quietly pins one upstream instead of letting
- * the pool auto-route across whichever providers hold a live key.
+ * This used to be Aegis Cloud only, because runTask sent every turn out with
+ * a hardcoded `class: 'aegis'` — a byok or local model id would have gone out
+ * under the wrong transport and failed at the server, or worse, silently
+ * picked up the wrong provider's key. Now `class` travels with the task
+ * (`item.class`, defaulted to 'aegis' for every task that predates this field
+ * — the CLI, a hand-written queue file, the old desktop card), and runTask
+ * forwards it verbatim instead of overwriting it.
  *
- * The accept-list is therefore the pooled-brain tier family — the one entry
- * engine.js's offerableCatalog offers for the Aegis Cloud class, plus the
- * `-smart`/`-neo` tier spellings the server still serves as aliases of it. This
- * mirrors selectBrainEntry() there rather than re-deriving "anything starting
- * with nexus-": `nexus-fast` is not a tier the catalog has ever served, and
- * accepting a made-up id means a queued task that fails at the server after
- * being picked up, or runs on a tier nobody chose.
+ * Each class validates differently, because each has a different notion of
+ * "no model stated is fine":
+ *   - 'aegis' has a real default (the pooled brain), so a blank model is
+ *     accepted and resolveModel fills it in. The accept-list is the
+ *     pooled-brain tier family — the one entry engine.js's offerableCatalog
+ *     offers for the Aegis Cloud class, plus the `-smart`/`-neo` tier
+ *     spellings the server still serves as aliases of it (mirrors
+ *     selectBrainEntry() there rather than re-deriving "anything starting
+ *     with nexus-": `nexus-fast` is not a tier the catalog has ever served).
+ *   - 'byok' and 'local' have no such default: a blank byok model cannot be
+ *     "whichever provider the pool picks" (there is no pool), and a blank
+ *     local model cannot be "whichever model is pulled" when the answer
+ *     depends on what the user's own daemon happens to have. Both REQUIRE an
+ *     explicit model, refused by name instead of silently resolving to
+ *     something nobody chose.
  */
+const MODEL_CLASSES = Object.freeze(['aegis', 'byok', 'local']);
+
 const AEGIS_MODEL_RE = /^(?:nexus|aegis)-brain(?:-(?:smart|neo))?$/;
 const AEGIS_MODEL_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
 
-/** True when `id` names an AEGIS Cloud pooled-brain tier (the queue's only models). */
+/** True when `id` names an AEGIS Cloud pooled-brain tier. */
 function isAegisModel(id) {
   return AEGIS_MODEL_RE.test(String(id == null ? '' : id).trim());
 }
 
 /**
- * Why a STATED model id cannot be queued, or '' when it can. Blank is not a
- * refusal — "no pick" is the default model, which resolveModel supplies.
+ * Normalize a task's stated class to one this module (and engine.js) knows.
+ * Blank or absent — every task queued before this field existed — defaults to
+ * 'aegis', the only class the queue ever ran before today.
+ */
+function normalizeClass(cls) {
+  const stated = String(cls == null ? '' : cls).trim().toLowerCase();
+  return stated || 'aegis';
+}
+
+/**
+ * Whether `id` is shaped "<provider>:<model>" — the only form engine.js's
+ * byok class accepts (splitByokModel). Not re-deriving the live provider list
+ * here (that is a catalog call, `listModels('byok')`, this module has no
+ * business caching) — just enough of a shape check that a malformed id is
+ * refused at the door instead of failing splitByokModel at the server with no
+ * context.
+ */
+function looksLikeByokModel(id) {
+  const s = String(id == null ? '' : id).trim();
+  const i = s.indexOf(':');
+  return i > 0 && i < s.length - 1;
+}
+
+/**
+ * Why a STATED (model, class) pair cannot be queued, or '' when it can.
  *
- * The message names the pool, because the failure it prevents ("queued on
- * claude-sonnet-4, ran on — or was billed to — something else") is invisible
- * otherwise: `class: 'aegis'` would be sent with an id the server does not
- * serve, and the task would come back as an opaque error minutes later.
+ * `cls` defaults to 'aegis' when omitted, so every existing caller of
+ * `modelRefusal(id)` keeps its old behaviour verbatim.
  */
-function modelRefusal(id) {
+function modelRefusal(id, cls) {
   const stated = String(id == null ? '' : id).trim();
-  if (!stated || isAegisModel(stated)) return '';
-  return (
-    `the autonomous queue runs Aegis Cloud models only (${DEFAULT_MODEL}, ` +
-    `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
-  );
+  const normalized = normalizeClass(cls);
+  if (!MODEL_CLASSES.includes(normalized)) {
+    return `"${cls}" is not a model class the queue serves (${MODEL_CLASSES.join('/')})`;
+  }
+  if (normalized === 'aegis') {
+    if (!stated || isAegisModel(stated)) return '';
+    return (
+      `the autonomous queue's Aegis Cloud class runs pooled-brain models only (${DEFAULT_MODEL}, ` +
+      `${AEGIS_MODEL_IDS.join('/')} aliases); "${stated}" is not one`
+    );
+  }
+  if (normalized === 'byok') {
+    if (!stated) return 'a byok task needs a model, as "<provider>:<model>" (pick one from /models)';
+    if (!looksLikeByokModel(stated)) {
+      return `"${stated}" is not a byok model id — it must be "<provider>:<model>" (pick one from /models)`;
+    }
+    return '';
+  }
+  // normalized === 'local'
+  if (!stated) return 'a local task needs a model — the tag of whatever is pulled into the local daemon';
+  return '';
 }
 
 /** Phrase match for "work autonomously" in a prompt or a queued task. */
@@ -239,10 +291,14 @@ function withRoundHorizon(rounds, env, fn) {
  *     task over it would break drains for a reason that is not the task's
  *     fault; a fallback to the pooled brain keeps the drain honest and on-cloud.
  */
-function resolveModel({ model, env } = {}) {
-  const e = env || process.env;
+function resolveModel({ model, env, cls } = {}) {
   const picked = String(model || '').trim();
+  // byok/local have no cloud default to fall back to — modelRefusal already
+  // guaranteed a non-empty, shaped model at queue time, so the task's own pick
+  // is the only answer for either class.
+  if (normalizeClass(cls) !== 'aegis') return picked;
   if (picked) return picked;
+  const e = env || process.env;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
   return isAegisModel(fromEnv) ? fromEnv : DEFAULT_MODEL;
 }
@@ -255,7 +311,8 @@ function resolveModel({ model, env } = {}) {
  * it: the queue falls back to the pool, and the one place that says so is this
  * string, which runTask emits as a note and the desktop card shows.
  */
-function ignoredEnvModel({ model, env } = {}) {
+function ignoredEnvModel({ model, env, cls } = {}) {
+  if (normalizeClass(cls) !== 'aegis') return ''; // AEGIS_AUTONOMOUS_MODEL is an Aegis-only pin
   if (String(model || '').trim()) return ''; // the task's own pick is what counts
   const e = env || process.env;
   const fromEnv = String(e.AEGIS_AUTONOMOUS_MODEL || e.AEGIS_MODEL || '').trim();
@@ -462,16 +519,23 @@ function createQueueWorker({
     // pool does not serve: billed work if it happens to be a per-provider
     // spelling, an opaque server error otherwise. Failing here names the model
     // and the allowed ones, and costs nothing.
-    const refusal = modelRefusal(item.model);
+    const cls = normalizeClass(item.class);
+    const refusal = modelRefusal(item.model, cls);
     if (refusal) {
-      const failed = { ok: false, error: refusal, model: item.model, ms: 0 };
+      const failed = { ok: false, error: refusal, model: item.model, class: cls, ms: 0 };
       emit({ type: 'finish', taskId: item.id, ok: false, result: failed });
       return failed;
     }
-    const model = resolveModel({ model: item.model, env });
-    const ignored = ignoredEnvModel({ model: item.model, env });
+    const model = resolveModel({ model: item.model, env, cls });
+    const ignored = ignoredEnvModel({ model: item.model, env, cls });
     if (ignored) emit({ type: 'note', taskId: item.id, note: ignored });
-    const fanoutAsked = resolveFanout(item, env);
+    // The pooled-brain fan-out is an Aegis Cloud mechanism (aegis1
+    // services/pool_brain.py) — engine.js itself only honours `autonomous`
+    // under `cls === 'aegis'` (engine.js:1524), so a byok/local task asking for
+    // it is forced to a plain single pass HERE rather than relying on that
+    // silent no-op, which would otherwise size the task's effort/round
+    // reporting as if a fan-out it never got had been granted.
+    const fanoutAsked = cls === 'aegis' && resolveFanout(item, env);
     // The clamp. `canFanOut()` is the entitlement answer (true everywhere
     // except a non-Pro desktop session), and it can only ever take a fan-out
     // AWAY: a task the session is not entitled to fan out runs as one plain
@@ -526,14 +590,14 @@ function createQueueWorker({
     const wantCommit = commit === undefined ? Boolean(item.commit) : Boolean(commit);
     const before = wantCommit ? safe(() => git.gitStatusSnapshot(cwd), null) : null;
 
-    emit({ type: 'start', taskId: item.id, model, cwd, rounds, fanout, effort });
+    emit({ type: 'start', taskId: item.id, model, class: cls, cwd, rounds, fanout, effort });
     const started = now();
     let result;
     try {
       const res = await withRoundHorizon(rounds, env, () =>
         engine.chat(
           {
-            class: 'aegis',
+            class: cls,
             model,
             prompt: taskPrompt(item, { carry, rounds }),
             // The pooled-brain fan-out ("fan out this turn" in the GUI chat
@@ -831,8 +895,11 @@ module.exports = {
   DEFAULT_MODEL,
   DEFAULT_ROUNDS,
   MAX_ROUND_STOPS,
+  MODEL_CLASSES,
   AEGIS_MODEL_IDS,
   isAegisModel,
+  normalizeClass,
+  looksLikeByokModel,
   modelRefusal,
   WRITE_TOOLS,
   writtenPath,

package/lib/local/engine.js

@@ -968,6 +968,19 @@ function createLocalEngine({
     // reverse its verdict. An approval that could waive Λ2 would be the exact
     // capture K3 describes. To change what is permitted, the covenant text
     // itself has to be re-sealed — which no runtime input can do.
+    //
+    // DO NOT MOVE THIS BELOW A SHORT-CIRCUIT. It sits above every `return` of
+    // the confirmation gate on purpose (ON8/D8 rule 2): `gatedExecuteTool`
+    // short-circuits on `!confirmModeEnabled()`, on a remembered session
+    // "allow", and on a `/permissions` skip — and since ON8 the confirm-mode
+    // preference is the SHARED store's, i.e. the same value the terminal face
+    // reads, and `--dangerously-skip-permissions` can arrive in that store as
+    // well. A refactor that hoists this below any of those three would make
+    // the covenant waivable by a setting a user can write, which is the one
+    // thing D8 rule 2 forbids outright. The frozen classes
+    // (`write`/`shell`/`network`/`offDevice`, always `'ask'`; see
+    // lib/avatar/level.js `LEVEL_INDEPENDENT_APPROVALS`) have the same floor
+    // and are asserted beside this one by one/test/permissions.test.mjs.
     const cv = covenant.preActionAssert({ tool: name, args: args || {} });
     if (!cv.allowed) {
       // Non-silent (never a quiet no-op) and bound for Λ4 accountability.

package/lib/local/entitlement.js

@@ -28,17 +28,37 @@
  * THE SIGNAL (see the report / the module's `probe`): main injects a probe that
  * calls `aegis.verifyApiKey()` — aegis1 `/api/verify-api-key`, which its own
  * docstring describes as "Verify a shared api_key and return plan/email/
- * memory_token". The plan field is the account's stored plan, and aegis1 owns
- * the vocabulary for it (`services/billing_service.py`: `PAID_PLANS = ("pro",)`
- * plus the legacy aliases that normalize onto it). This module MIRRORS that
- * vocabulary rather than inventing one; there is no new billing anything here,
- * no new endpoint, and no write to the server.
+ * memory_token". The plan field is the account's plan, and aegis1 owns the
+ * vocabulary for it (`services/billing_service.py`: `TIERS = ("free", "pro",
+ * "unlimited")`, `PAID_PLANS = ("pro", "unlimited")`, plus the legacy aliases
+ * that normalize onto one of them). This module MIRRORS that vocabulary rather
+ * than inventing one; there is no new billing anything here, no new endpoint,
+ * and no write to the server. The probe prefers the server's `plan_effective`
+ * (its own `is_pro()` verdict, trial included) over the stored `plan` string
+ * when it is present, because a welcome-trial account is a real Unlimited
+ * entitlement that `users.plan` does not record — see `classifyProbe`.
+ *
+ * THE BUG THIS VOCABULARY COST (fixed here). `PAID_PLANS` read `("pro",)`,
+ * mirroring the retired €2 line and MISSING `unlimited` — the €9/mo tier that
+ * is the only one sold. So `normalizePlan('unlimited')` fell through to `free`,
+ * and a paying Unlimited subscriber with a spent-out bank was handed the
+ * free-tier boundary: the fan-out refused, the cloud drain clamped to one local
+ * worker, and a "top up your balance" prompt — for an account whose plan is
+ * precisely what pays for the drain. aegis1's own `LEGACY_PLAN_ALIASES` carries
+ * the matching warning from the other side ("Deliberately NOT an alias:
+ * `unlimited` is a live tier you can subscribe to, so it must resolve through
+ * TIERS"), and its `test_tier_vocabulary` pins `PAID_PLANS` at two entries.
+ * Two implementations of "is this account paid" had already drifted once; this
+ * was the drift.
  *
  * PHASE 6 — THE SECOND SIGNAL, THE BALANCE. The plan is only half of how this
  * product charges. aegis1's actual paywall is the Token Bank running dry: the
  * balance is prepaid EUR the OPERATOR credits by hand, and `app.py` states the
  * consequence plainly — "Pool-key users with token bank balance skip legacy
- * credit checks." So entitlement here is `pro || balance > 0`, and when the
+ * credit checks." So entitlement here is `paid_plan || balance > 0` — and the
+ * `paid_plan` half is what carries an Unlimited subscriber whose bank is empty;
+ * the bank is an OVERAGE lever, never the thing that decides whether a paying
+ * account may use the feature it pays for. When the
  * bank reads zero the wall names the fix that exists (a top-up, campaign
  * `topup_bank`) instead of a plan checkout the user may already own. Nothing in
  * this module grants a balance, expires one, or auto-charges: the operator
@@ -64,8 +84,33 @@
 /** The free-tier fan-out ceiling: one worker per task, i.e. a plain turn. */
 const FREE_MAX_WORKERS = 1;
 
-/** Aegis1's paid tier. MIRROR of services/billing_service.py `PAID_PLANS`. */
-const PAID_PLANS = Object.freeze(['pro']);
+/**
+ * Aegis1's paid tiers. MIRROR of services/billing_service.py
+ * `PAID_PLANS = ("pro", "unlimited")` — pinned literal on purpose, because this
+ * is the line that has to move whenever the server sells another tier.
+ *
+ * `unlimited` (€9/mo) is the tier ON SALE and the one a paying customer almost
+ * certainly owns; `pro` is the grandfathered €2 line, kept because its
+ * subscribers keep their entitlements. Reading only `pro` was not a narrower
+ * version of this gate, it was a gate pointing at the wrong tier: every
+ * Unlimited account fell to the free boundary. `starter` stays out — aegis1
+ * itself calls that one free.
+ */
+const PAID_PLANS = Object.freeze(['pro', 'unlimited']);
+
+/**
+ * What each paid tier is CALLED, so a surface that names the account's plan
+ * names the one the server granted. The CLI has read the tier off the server's
+ * plan string since 6443a60 (`cli/src/entitlement.js::paymentView`) after it
+ * told a €9 subscriber they owned the retired €2 plan; this is the same value,
+ * resolved once in the shared module both hosts read.
+ */
+const TIER_NAMES = Object.freeze({ pro: 'Pro', unlimited: 'Unlimited' });
+
+/** The display name for a plan string, or null when it is not a paid tier. */
+function tierName(plan) {
+  return TIER_NAMES[normalizePlan(plan)] || null;
+}
 
 /**
  * MIRROR of services/billing_service.py `LEGACY_PLAN_ALIASES`: every stored
@@ -251,11 +296,20 @@ function promptUrlFor(host) {
  *  card on the next refresh and long enough that a drain never probes per task. */
 const DEFAULT_TTL_MS = 60 * 1000;
 
-/** Collapse any stored/alias plan string onto a tier, exactly as aegis1 does. */
+/** Collapse any stored/alias plan string onto a tier, exactly as aegis1 does.
+ *
+ *  Aegis1 checks its live `TIERS` BEFORE the alias table (`normalize_plan`), so
+ *  an alias can never shadow a tier it also names — and `unlimited` is a live
+ *  tier. It is therefore returned as itself and never collapsed onto `pro`: the
+ *  two grant different entitlements server-side (the monthly Unlimited
+ *  allowance and the BYOK fee waiver are `is_unlimited()`-gated), and telling a
+ *  €9 customer they own the retired €2 plan is the mistake commit 6443a60
+ *  exists to record.
+ */
 function normalizePlan(plan) {
   const raw = String(plan == null ? '' : plan).trim().toLowerCase();
   if (!raw) return 'free';
-  if (PAID_PLANS.includes(raw)) return 'pro';
+  if (PAID_PLANS.includes(raw)) return raw;
   const aliased = LEGACY_PLAN_ALIASES[raw];
   return aliased || 'free';
 }
@@ -265,9 +319,9 @@ function normalizePlan(plan) {
  *  drift into two different instructions. */
 const ASK_EXAMPLE = 'Do X autonomously';
 
-/** True only for a tier aegis1 itself would call paid. */
+/** True only for a tier aegis1 itself would call paid (`pro` or `unlimited`). */
 function isPaidPlan(plan) {
-  return normalizePlan(plan) === 'pro';
+  return normalizePlan(plan) !== 'free';
 }
 
 /**
@@ -367,7 +421,19 @@ function classifyProbe(result, error) {
   const body = result && typeof result === 'object' ? result : {};
   const bal = balanceOf(body);
   if (body.valid === false) return { source: 'no-key', plan: 'free', degraded: false, ...bal };
-  const stated = String(body.plan == null ? '' : body.plan).trim();
+  // WHICH plan field. `plan_effective` is aegis1's own entitlement verdict —
+  // the same predicate its `is_pro()` gates pooled calls on, so it counts the
+  // 30-day welcome trial that never writes `users.plan` (see app.py's
+  // register_device: the trial lives in `subscriptions`). The stored `plan`
+  // column cannot express that account, so an installing user read as `free`
+  // here and only the €12 signup credit kept the gate open — spend it, or fail
+  // to receive it, and a real Unlimited account was refused the feature. The
+  // stored string is still the fallback: an older server that predates the
+  // field must keep working, and it is the same value when nothing is on trial.
+  const rawPlan = body.plan_effective != null && String(body.plan_effective).trim()
+    ? body.plan_effective
+    : body.plan;
+  const stated = String(rawPlan == null ? '' : rawPlan).trim();
   if (!stated) {
     // A key that verified but carried no plan: aegis1's own default for such an
     // account is `free` (the column default), and a missing field is not proof
@@ -411,6 +477,8 @@ function createEntitlement({
     balanceZero: false,
     wall: 'plan',
     plan: 'free',
+    tier: null,
+    tierName: null,
     planRaw: null,
     maxWorkers: FREE_MAX_WORKERS,
     source: 'unresolved',
@@ -424,12 +492,20 @@ function createEntitlement({
   let inflight = null;
 
   function fromProbe({ source, plan, degraded, planRaw, balanceKnown = false, balanceMicros = null }) {
-    const pro = isPaidPlan(plan);
+    // The tier itself, not a paid/not-paid bit: `unlimited` and `pro` are both
+    // paid and must stay distinguishable, because the surfaces that name the
+    // account's plan (the desktop's queue boundary, the CLI's `/billing`) name
+    // the one the server granted. `pro` below keeps its original meaning — "the
+    // PLAN is paid for", as opposed to a free plan carried by a funded bank.
+    const tier = normalizePlan(plan);
+    const pro = tier !== 'free';
     const banked = balanceKnown && Number.isFinite(balanceMicros) && balanceMicros > 0;
     // TWO independent ways to be paid for: a paid plan, or a funded bank. The
     // operator controls the second by hand (aegis1 admin `add_funds`), which is
     // the lever this wall is built around — nothing here grants, times out or
-    // auto-charges; it only reads the number the operator set.
+    // auto-charges; it only reads the number the operator set. The FIRST way is
+    // the one a paying subscriber holds, and it does not weaken when their bank
+    // runs dry: the balance is overage, the subscription is the entitlement.
     const entitled = pro || banked;
     // The bank was READABLE and EMPTY — the operator's own signal that this
     // account is now paying, not the absence of a plan.
@@ -447,7 +523,12 @@ function createEntitlement({
       balanceMicros: balanceKnown ? balanceMicros : null,
       balanceZero,
       wall,
-      plan: pro ? 'pro' : 'free',
+      // The tier a paid PLAN grants, else `free`. A funded bank on a free plan
+      // is still `free` here — the bank is not a tier, and naming one would put
+      // a plan on the account the server never granted.
+      plan: pro ? tier : 'free',
+      tier: pro ? tier : null,
+      tierName: pro ? (TIER_NAMES[tier] || null) : null,
       planRaw: planRaw == null ? null : String(planRaw),
       // A paid session has no ceiling of its own here: main.js still clamps the
       // renderer's number to QUEUE_MAX_WORKERS, which stays the only upper bound.
@@ -543,6 +624,8 @@ module.exports = {
   createEntitlement,
   normalizePlan,
   isPaidPlan,
+  tierName,
+  TIER_NAMES,
   classifyProbe,
   fanoutRefusal,
   balanceRefusal,

package/lib/local/queue.js

@@ -176,34 +176,38 @@ function upsert(items, entry) {
 
 /**
  * Queue a task. `cwd` is where the work happens (the worker runs the turn
- * with it as the tool loop's working directory), `model` is the AEGIS Cloud
- * model id to run it on, and `commit` asks the worker to commit what the task
- * changed (scoped — see autonomous.js).
+ * with it as the tool loop's working directory), `class` + `model` are the
+ * same pair engine.js's interactive turns use ('aegis'/'byok'/'local' and the
+ * model id that class expects), and `commit` asks the worker to commit what
+ * the task changed (scoped — see autonomous.js).
  *
- * AEGIS CLOUD ONLY, REFUSED AT THE DOOR. The worker sends every task out as
- * `class: 'aegis'`, so a model the pool does not serve cannot run here at all —
- * it is a task that fails minutes into a drain, after being picked up, with an
- * opaque server error. `model: null` stays legal: that is "no pick", and
- * autonomous.resolveModel fills in the pooled brain. Anything else has to pass
- * that module's own accept-list, so the CLI (`aegiscode autonomous add
- * --model`), the desktop card and a hand-written queue file are all held to the
- * same rule. Required lazily: queue.js is a dependency of autonomous.js, and
- * this check must not turn that into a load-order cycle.
+ * REFUSED AT THE DOOR, not three stages into a drain. `class` defaults to
+ * 'aegis' (every task queued before this field existed), and the (model,
+ * class) pair has to pass autonomous.js's own accept-list — the CLI
+ * (`aegiscode autonomous add --model`), the desktop card and a hand-written
+ * queue file are all held to the same rule, so a bad row fails here with a
+ * reason instead of coming back as an opaque server error after being picked
+ * up. `model: null` stays legal for the 'aegis' class only: that is "no
+ * pick", and autonomous.resolveModel fills in the pooled brain. 'byok' and
+ * 'local' have no such default and are refused if blank — see
+ * autonomous.modelRefusal. Required lazily: queue.js is a dependency of
+ * autonomous.js, and this check must not turn that into a load-order cycle.
  */
 function addTask(env, opts = {}) {
   const task = String(opts.task == null ? '' : opts.task).trim();
   if (!task) throw new Error('queue: a task needs text');
+  const autonomousMod = require('./autonomous.js');
+  const cls = autonomousMod.normalizeClass(opts.class);
   const statedModel = String(opts.model == null ? '' : opts.model).trim();
-  if (statedModel) {
-    const refusal = require('./autonomous.js').modelRefusal(statedModel);
-    if (refusal) throw new Error(`queue: ${refusal}`);
-  }
+  const refusal = autonomousMod.modelRefusal(statedModel, cls);
+  if (refusal) throw new Error(`queue: ${refusal}`);
   const items = loadQueue(env);
   const now = opts.now || Date.now();
   const entry = {
     id: nextId(items),
     task,
     cwd: opts.cwd || process.cwd(),
+    class: cls,
     model: statedModel || null,
     effort: opts.effort || null,
     workers: Number.isInteger(opts.workers) ? opts.workers : null,

package/lib/settings.js

@@ -270,6 +270,15 @@ function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
     try {
       return prefs.adopt({ dir: sharedDir, legacyDir: dir });
     } catch (err) {
+      // Best-effort, but NOT silent (AEGISONE ON8). Swallowing this throw is how
+      // `prefs.adopt()`'s refusal to write its own ledger went unnoticed — the
+      // migration failed for every install that had something to adopt, and the
+      // store reported a healthy `adopted: false`. A failed migration is a
+      // preference a user set that this launch did not honor, so it is reported
+      // where a developer will see it; a store must still open either way.
+      if (process.env.AEGISCODE_DEBUG || process.env.AEGIS_HIST_DEBUG) {
+        process.stderr.write(`aegis-desktop: shared-preference adoption failed: ${err.message}\n`);
+      }
       return { adopted: false, keys: [], reason: `adoption failed: ${err.message}` };
     }
   })();
@@ -525,26 +534,50 @@ function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
     return quickLauncherConfig();
   }
 
-  // --- Confirm mode: reserved namespace, plain (unencrypted) preference ----
-  // "Confirm before running tools" — the ON/OFF switch for the renderer's
-  // tool-call approval gate (desktop/lib/local/engine.js gatedExecuteTool).
-  // ON (default, and the behaviour shipped so far) means every mutating tool
-  // call — exec / writeFile / editFile — is previewed and approved by the user
-  // first. OFF means the engine runs them straight through, like a tool the
-  // session already allowed. Nothing secret is stored here, so no encryption.
+  // --- Confirm mode: SHARED preference (AEGISONE ON8, decision D8 rule 1) --
+  // "Confirm before running tools" — the switch for the renderer's tool-call
+  // approval gate (desktop/lib/local/engine.js gatedExecuteTool). ON (default,
+  // and the behaviour shipped so far) means every mutating tool call — exec /
+  // writeFile / editFile — is previewed and approved by the user first. OFF
+  // means the engine runs them straight through, like a tool the session
+  // already allowed. Nothing secret is stored here, so no encryption.
+  //
+  // This preference MOVED to the shared store (`confirmMode`) because D8 rule 1
+  // is "one posture, two faces": a rule set in the window has to be the rule the
+  // shell honors. The pre-ON8 `__confirmMode` namespace in `<userData>` is
+  // adopted once (client/prefs.js `extractNonSecretHalf`) and still read as a
+  // fallback, never written — a second writer is the split-brain this replaced.
+  // The gate's polarity is unchanged: ON when unset, in both places, so an
+  // install that never touched the switch keeps the gate exactly as it was.
+
+  function confirmModeState() {
+    const shared = loadShared();
+    if (typeof shared.confirmMode === 'boolean') {
+      return { enabled: shared.confirmMode, source: 'config' };
+    }
+    const cfg = load()[CONFIRM_MODE_NAMESPACE] || {};
+    if (cfg.enabled === undefined) return { enabled: true, source: 'default' };
+    return { enabled: Boolean(cfg.enabled), source: 'config' };
+  }
 
   function getConfirmMode() {
-    const cfg = load()[CONFIRM_MODE_NAMESPACE] || {};
-    // Unset === true: an existing install that never touched the toggle keeps
-    // the gate exactly as it was.
-    return cfg.enabled === undefined ? true : Boolean(cfg.enabled);
+    return confirmModeState().enabled;
   }
 
   function setConfirmMode(enabled) {
+    prefs.set({ confirmMode: Boolean(enabled) }, { dir: sharedDir });
+    // One-way: retire the legacy copy in the same breath, so the posture exists
+    // in exactly one place from here on (the same retirement the memory-persist
+    // preference below does).
     const data = load();
-    data[CONFIRM_MODE_NAMESPACE] = { enabled: Boolean(enabled) };
-    save(data);
-    return getConfirmMode();
+    if (data[CONFIRM_MODE_NAMESPACE] !== undefined) {
+      delete data[CONFIRM_MODE_NAMESPACE];
+      save(data);
+    }
+    // The boolean, not the state record: main.js's IPC reply is `{ enabled }`
+    // and it wraps the return value itself, so widening this would have put an
+    // object inside an object on the wire.
+    return confirmModeState().enabled;
   }
 
   // --- Telemetry: reserved namespace, plain preference, DEFAULT OFF --------
@@ -771,6 +804,7 @@ function createSettingsStore({ dir, safeStorage, prefsDir, env } = {}) {
     setQuickLauncherConfig,
     getConfirmMode,
     setConfirmMode,
+    confirmModeState,
     getTelemetryOptIn,
     setTelemetryOptIn,
     getMemoryPersist,

package/main.js

@@ -1972,8 +1972,10 @@ function createQueueDispatch({
       draining,
       stopping: stopRequested,
       defaultCwd: process.cwd(),
-      // What a task with no model of its own actually runs on. The queue is
-      // Aegis Cloud only, so this is a pooled tier id — and the card prints it,
+      // What a task with no model of its own, on the Aegis Cloud class, actually
+      // runs on — a pooled tier id. byok and local tasks always carry an
+      // explicit model (see autonomous.js modelRefusal), so there is no
+      // equivalent default to report for those classes. The card prints this
       // because "which model is this drain spending on" was previously
       // unanswerable from the UI.
       defaultModel: autonomous.resolveModel({ env }),
@@ -2008,19 +2010,20 @@ function createQueueDispatch({
     if (!path.isAbsolute(cwd)) return { error: 'the working directory must be an absolute path' };
     if (!isExistingDir(cwd)) return { error: `not a directory: ${cwd}` };
 
+    const cls = autonomous.normalizeClass(p.class);
     const model = String(p.model == null ? '' : p.model).trim().slice(0, 120) || null;
-    // Aegis Cloud only (autonomous.js modelRefusal): the worker's requests go
-    // out as `class: 'aegis'`, so a model the pool does not serve is a task that
-    // fails inside a drain. Refused HERE so the card gets the reason at the
-    // moment of queueing instead of a red row later. queue.addTask enforces the
-    // same rule for the CLI and for hand-written queue files.
-    const modelRefusal = model ? autonomous.modelRefusal(model) : '';
+    // Refused HERE so the card gets the reason at the moment of queueing
+    // instead of a red row later. queue.addTask enforces the same (model,
+    // class) rule for the CLI and for hand-written queue files — see
+    // autonomous.js modelRefusal for what each class requires.
+    const modelRefusal = autonomous.modelRefusal(model, cls);
     if (modelRefusal) return { error: modelRefusal };
     const effortRaw = String(p.effort == null ? '' : p.effort).trim().toLowerCase();
     return {
       opts: {
         task,
         cwd,
+        class: cls,
         model,
         effort: QUEUE_EFFORTS.has(effortRaw) ? effortRaw : null,
         workers: clampInt(p.workers, 1, QUEUE_MAX_WORKERS),
@@ -2029,7 +2032,12 @@ function createQueueDispatch({
         // it costs about workers+1 full reasoning calls on one task, so the
         // card has to ask for it per task. queue.addTask stores the inverse
         // (`singlePass`), which is also the field a hand-written queue file
-        // or the CLI uses.
+        // or the CLI uses. Fan-out is an Aegis Cloud mechanism only — a
+        // byok/local task that somehow carried `fanout: true` is NOT honoured
+        // as a fan-out here (autonomous.js's runTask forces it off for any
+        // non-aegis class regardless of this flag), but it is still recorded
+        // as the task's own ask rather than silently rewritten, matching
+        // resolveFanout's "a wrong pick is reported, not rewritten" rule.
         singlePass: !(p.fanout === true || p.autonomous === true),
         commit: Boolean(p.commit),
         source: 'desktop',
@@ -3538,14 +3546,15 @@ function bootstrap() {
         // Nothing configured anywhere (env, this app's encrypted copy, or the
         // shared store): a fresh install. Auto-provision a free device key
         // from aegis1 — same shared helper mcp/server.js and the CLI use, so
-        // the desktop app works with no manual sign-in step. It starts at
-        // zero token-bank balance server-side (register-device), and pooled
-        // aegiscloud models additionally require an upgraded plan (aegis1's
-        // is_pro() gate) — this only unblocks BYOK and account status/
-        // settings until the account is funded and/or upgraded. Failure
-        // (offline, aegis1 unreachable) falls through exactly as before: the
-        // renderer's normal "not signed in" state handles it, and the next
-        // launch tries again.
+        // the desktop app works with no manual sign-in step. A brand-new
+        // fingerprint is granted aegis1's 30-day welcome-trial `unlimited`
+        // entitlement (token-bank credit + a subscriptions row) in the same
+        // register-device call that mints the key — see client/
+        // auto-provision.js's header for the aegis1 commit that made this a
+        // real grant rather than a badge. Failure (offline, aegis1
+        // unreachable) falls through exactly as before: the renderer's
+        // normal "not signed in" state handles it, and the next launch tries
+        // again.
         const result = await autoProvision.autoProvisionApiKey(aegis, credentials);
         if (result.key) settings.setAegisKey(result.key);
       }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.29",
+  "version": "0.8.32",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/preload.js

@@ -423,8 +423,8 @@ const quickLauncher = {
 //      a real checkout, so that switch is persisted and visible rather than
 //      implied — but it is also not hidden from this file's users any more.
 const queue = {
-  // Queue one task. `payload` is { task, cwd, model, effort, workers, maxRounds,
-  // commit }; main.js range-checks every field and answers
+  // Queue one task. `payload` is { task, cwd, class, model, effort, workers,
+  // maxRounds, commit }; main.js range-checks every field and answers
   // { ok, item, items, pending, running, runs, … } or { ok: false, reason }.
   enqueue: (payload) => invokeQueue('enqueue', queueTaskFields(payload)),
   // Full state: { items, pending, running, draining, runs, defaultCwd, … }.
@@ -531,6 +531,11 @@ function queueTaskFields(payload) {
   return {
     task: String(p.task == null ? '' : p.task),
     cwd: String(p.cwd == null ? '' : p.cwd),
+    // 'aegis' | 'byok' | 'local' — same three classes the main composer uses
+    // (window.models.listClasses()). main.js defaults a blank/missing value to
+    // 'aegis' (autonomous.normalizeClass), so an older renderer build that
+    // never sends this field keeps behaving exactly as it did before.
+    class: p.class == null ? null : String(p.class),
     model: p.model == null ? null : String(p.model),
     effort: p.effort == null ? null : String(p.effort),
     workers: p.workers == null ? null : Number(p.workers),

package/renderer/app.js

@@ -145,6 +145,10 @@ const ELEMENT_IDS = {
   send: 'send',
   exploreToggle: 'explore-toggle',
   queueTask: 'queue-task',
+  queueClassSelect: 'queue-class-select',
+  queueModelSelect: 'queue-model-select',
+  queueModelInput: 'queue-model-input',
+  queueModelHint: 'queue-model-hint',
   queueCwd: 'queue-cwd',
   queueCommit: 'queue-commit',
   queueEnqueue: 'queue-enqueue',
@@ -186,6 +190,11 @@ for (const [prop, id] of Object.entries(ELEMENT_IDS)) {
 }
 
 const CLASS_KEY = 'aegis.class';
+// The queue card's own class pick, kept separate from the chat composer's
+// (CLASS_KEY) — a queued task's backend and the interactive chat's are
+// independent choices, so picking "local" for one must not silently flip
+// the other the next time either picker loads.
+const QUEUE_CLASS_KEY = 'aegis.queueClass';
 const AUTONOMOUS_KEY = 'aegis.autonomous';
 // The budget rung. Applies to every class now that the Max tokens dropdown is
 // gone, so it is no longer stored under the autonomous-mode namespace; the old
@@ -1463,6 +1472,8 @@ async function enqueueQueueTask() {
     const res = await queueApi.enqueue({
       task,
       cwd: els.queueCwd ? els.queueCwd.value.trim() : '',
+      class: els.queueClassSelect ? els.queueClassSelect.value : undefined,
+      model: queueSelectedModel(),
       commit: els.queueCommit ? els.queueCommit.checked : false,
     });
     if (res && res.ok) {
@@ -1525,9 +1536,14 @@ function renderQueueEntitlement(state) {
     if (!resolved) els.queueBoundary.textContent = '';
     else if (entitled) {
       // Say which of the two ways this account is paid for, so a funded bank
-      // does not read as a Pro plan somebody did not buy.
+      // does not read as a Pro plan somebody did not buy — and name WHICH tier
+      // the plan is: `ent.tierName` is resolved in main from the plan string the
+      // server stated (shared module's TIER_NAMES), so a €9 Unlimited subscriber
+      // is not told they own the retired €2 plan. That mislabelling is the same
+      // class CLI commit 6443a60 fixed in `/billing`; the literal is only a
+      // fallback for a snapshot from a host that predates the field.
       els.queueBoundary.textContent = ent.pro
-        ? 'Pro — the cloud drain and the fan-out are unlocked.'
+        ? `${ent.tierName || 'Pro'} — the cloud drain and the fan-out are unlocked.`
         : 'Balance on your account — the cloud drain and the fan-out are unlocked.';
     } else {
       // The refusal names the Pro value AND keeps the free tier's real reach
@@ -1702,11 +1718,17 @@ function formatAutoInterval(ms) {
   return Number.isInteger(min) ? `every ${min} min` : `every ${min.toFixed(1)} min`;
 }
 
-/** Paint both automation states from main's answer (`auto.status()`). */
+/**
+ * Paint the auto-drain half of main's answer (`auto.status()`). The mint
+ * (auto-seal) half is NOT painted here: that control lives on the φ(α) panel,
+ * not the queue card, and desktop/renderer/fingerprint.js's own mount() reads
+ * and repaints it independently (loadAutoMint() -> renderAutoMint(), a
+ * closure local to that module, not a global this file could reach even if
+ * it wanted to).
+ */
 function renderAutoStatus(payload) {
   if (!payload || typeof payload !== 'object') return;
   if (payload.drain) renderAutoDrain(payload.drain);
-  if (typeof renderAutoMint === 'function' && payload.mint) renderAutoMint(payload.mint);
 }
 
 /**
@@ -3585,6 +3607,125 @@ async function loadModels(cls) {
   }
 }
 
+// --------------------------------------------------------- queue model class
+//
+// The queue card's own class/model picker, independent of the chat
+// composer's (QUEUE_CLASS_KEY vs CLASS_KEY — see the constant above): a
+// queued task can run on a different backend than whatever the composer is
+// currently pointed at. Deliberately a trimmed copy of loadClasses/loadModels
+// rather than a shared helper — the composer's version carries budget-ceiling
+// display and the autonomous-toggle visibility it owns, neither of which
+// belongs to a task that has not run yet.
+
+/** Mirrors currentModelId() for the queue's own picker. */
+function queueSelectedModel() {
+  if (els.queueModelInput && !els.queueModelInput.hidden) {
+    const typed = els.queueModelInput.value.trim();
+    if (typed) return typed;
+  }
+  return els.queueModelSelect ? els.queueModelSelect.value : '';
+}
+
+/** Fan-out is an Aegis Cloud mechanism only (autonomous.js runTask forces it
+ *  off for any other class) — hide the control instead of leaving a checkbox
+ *  on screen that would silently do nothing, same reasoning as the composer's
+ *  autonomousToggleWrap (AUTONOMOUS_CLASS). */
+function updateQueueFanoutVisibility(cls) {
+  const wrap = els.queueFanout && els.queueFanout.closest('label');
+  if (wrap) wrap.hidden = cls !== 'aegis';
+}
+
+async function loadQueueModels(cls) {
+  if (!els.queueModelSelect) return;
+  updateQueueFanoutVisibility(cls);
+
+  els.queueModelSelect.hidden = false;
+  els.queueModelSelect.disabled = false;
+  if (els.queueModelInput) {
+    els.queueModelInput.hidden = true;
+    els.queueModelInput.value = '';
+  }
+  if (els.queueModelHint) els.queueModelHint.textContent = '';
+
+  els.queueModelSelect.innerHTML = '';
+  if (cls === 'aegis') {
+    // Only this class has a real default to fall back to (resolveModel fills
+    // in the pooled brain) — byok/local tasks must name a model, so neither
+    // gets this option.
+    const auto = document.createElement('option');
+    auto.value = '';
+    auto.textContent = 'server default (auto)';
+    els.queueModelSelect.appendChild(auto);
+  }
+
+  try {
+    const data = await models.listModels(cls);
+    const list = Array.isArray(data && data.models) ? data.models : [];
+    const needsKey = Boolean(data && data.needsKey);
+    const needsDaemon = Boolean(data && data.needsDaemon);
+    const listed = !(data && data.listed === false);
+    if (els.queueModelInput) {
+      els.queueModelInput.hidden = !(cls === 'local' && (needsDaemon || !listed));
+    }
+    for (const m of list) {
+      const opt = document.createElement('option');
+      opt.value = m.id;
+      opt.textContent = m.label || m.id;
+      els.queueModelSelect.appendChild(opt);
+    }
+    if (!els.queueModelHint) return;
+    if (needsKey) {
+      els.queueModelHint.textContent =
+        'Connect this class in the Model card above (API key / provider key), then Refresh.';
+    } else if (needsDaemon) {
+      els.queueModelHint.textContent =
+        `No local model server at ${(data && data.baseURL) || 'the configured address'} — ` +
+        'start it, then reopen this picker.';
+    } else if (cls === 'local' && !listed) {
+      els.queueModelHint.textContent =
+        'That address answered but listed no models — type the model tag above.';
+    } else if (!list.length) {
+      els.queueModelHint.textContent =
+        cls === 'local'
+          ? 'No models on this server yet — pull one first (ollama pull llama3.2).'
+          : cls === 'aegis'
+            ? "No models to pin — this runs the pooled route on the server's own default."
+            : 'No models listed.';
+    } else if (cls === 'byok' && data && data.needsProviderKey) {
+      els.queueModelHint.textContent =
+        'A provider key is required before a queued task on this model can run — add one in the Model card above.';
+    }
+  } catch (err) {
+    if (els.queueModelHint) {
+      els.queueModelHint.textContent = `listModels failed: ${err && err.message ? err.message : err}`;
+    }
+  }
+}
+
+async function loadQueueClasses() {
+  if (!els.queueClassSelect) return;
+  let classOptions = [];
+  try {
+    classOptions = (await models.listClasses()) || [];
+  } catch (err) {
+    classOptions = [];
+    if (els.queueModelHint) {
+      els.queueModelHint.textContent = `listClasses failed: ${err && err.message ? err.message : err}`;
+    }
+  }
+  els.queueClassSelect.innerHTML = '';
+  for (const c of classOptions) {
+    const opt = document.createElement('option');
+    opt.value = c.class;
+    opt.textContent = c.configured ? c.label : `${c.label} (not configured)`;
+    els.queueClassSelect.appendChild(opt);
+  }
+  const saved = localStorage.getItem(QUEUE_CLASS_KEY);
+  if (saved && classOptions.some((c) => c.class === saved)) {
+    els.queueClassSelect.value = saved;
+  }
+  await loadQueueModels(els.queueClassSelect.value);
+}
 
 // -------------------------------------------------------------- settings pane
 
@@ -4756,10 +4897,17 @@ async function init() {
     // A worker's frames are a status line, never transcript entries (that
     // separation is main.js's own progress channel, not aegis:chatDelta).
     if (typeof queueApi.onProgress === 'function') queueApi.onProgress(renderQueueProgress);
+    if (els.queueClassSelect) {
+      els.queueClassSelect.addEventListener('change', () => {
+        localStorage.setItem(QUEUE_CLASS_KEY, els.queueClassSelect.value);
+        loadQueueModels(els.queueClassSelect.value);
+      });
+    }
     // Paint the card once, from state that already exists on disk. A list, not a
     // drain: queueing a task in another window (or from the CLI) and opening
     // this one must show that task, and must not run it.
     await loadQueueState();
+    await loadQueueClasses();
   }
 
   // ── the two automation switches ──────────────────────────────────────────

package/renderer/index.html

@@ -277,6 +277,24 @@
           rows="2"
           placeholder="Queue a task to run unattended…"
         ></textarea>
+        <!-- Which backend this task runs on — the same three classes
+             (window.models.listClasses()) and the same per-class model list
+             (listModels(cls)) the chat composer's #class-select/#model-select
+             use. Aegis Cloud can leave the model on "server default"; byok and
+             local tasks must name one (autonomous.js modelRefusal refuses a
+             blank at the door for those two). -->
+        <div class="api-key-row">
+          <select id="queue-class-select" title="Which backend this task runs on."></select>
+          <select id="queue-model-select" title="The model for the picked class."></select>
+        </div>
+        <input
+          type="text"
+          id="queue-model-input"
+          placeholder="model tag — e.g. llama3.2:3b"
+          autocomplete="off"
+          hidden
+        />
+        <p class="hint" id="queue-model-hint"></p>
         <div class="api-key-row">
           <input
             type="text"

package/vendor/aegis.js

@@ -841,10 +841,16 @@ function createClient(opts = {}) {
    * Ask aegis1 for a free device key when the caller has none configured yet
    * (`POST /api/v1/auth/register-device`). Idempotent server-side on
    * `fingerprint` — the same fingerprint always returns the same account's
-   * key rather than minting a new one. The account starts at zero token-bank
-   * balance: this hands out an account, not free inference, so the existing
-   * balance=0 gate on `/api/v1/chat/completions` still applies unchanged.
-   * Sends no API key of its own — there isn't one yet.
+   * key rather than minting a new one. A BRAND-NEW fingerprint (first call
+   * ever for this machine) is additionally granted aegis1's 30-day
+   * welcome-trial `unlimited` entitlement in the SAME request that mints the
+   * key — a token-bank credit of UNLIMITED_CLOUD_ALLOWANCE_MICROS plus a
+   * time-boxed `subscriptions` row (aegis1 commit 4372830), so a fresh
+   * install can use pooled cloud models immediately instead of starting at a
+   * zero balance. Re-registering an already-known fingerprint does NOT
+   * re-grant it; the pool balance gate still applies once the allowance is
+   * spent or the 30 days lapse. Sends no API key of its own — there isn't
+   * one yet.
    */
   async function registerDevice(fingerprint, opts) {
     return apiPost('/api/v1/auth/register-device', { fingerprint }, undefined, opts);

package/vendor/auto-provision.js

@@ -12,11 +12,18 @@
  * device-fingerprint.js) so a wiped credential store still resolves back to
  * the same account rather than minting a new, unfunded one.
  *
- * The provisioned account starts at ZERO token-bank balance server-side, and
- * aegis1 additionally requires an upgraded (paid, active) plan to use pooled
- * aegiscloud models at all (nexus_chat_completions' is_pro() gate) — this
- * only unblocks BYOK and account status/settings until the account is funded
- * and/or upgraded. It is account creation, not a grant of free inference.
+ * As of aegis1 commit 4372830, a brand-new fingerprint (first call ever for
+ * this machine) is granted the 30-day welcome-trial `unlimited` entitlement
+ * server-side — a token-bank credit (UNLIMITED_CLOUD_ALLOWANCE_MICROS) and a
+ * time-boxed `unlimited` row in `subscriptions` — in the SAME request that
+ * mints the key, not a separate step this client has to ask for. is_pro()'s
+ * pool gate and the BYOK fee waiver both see that grant immediately. This
+ * comment previously said the account "starts at ZERO balance" and "only
+ * unblocks BYOK" — that described pre-4372830 behavior and was stale; see
+ * services/billing_service.py's is_pro()/is_unlimited() docstrings on the
+ * aegis1 side for the current contract. A re-registration of an already-known
+ * fingerprint (the idempotent path) does NOT re-grant the trial — it only
+ * happens once per machine, ever.
  */
 const { machineFingerprint } = require('./device-fingerprint.js');
 

package/vendor/prefs.js

@@ -69,6 +69,11 @@ const SHARED_PREF_KEYS = Object.freeze([
   'effort',
   'vim',
   'memoryPersist',
+  // ON8 / D8 rule 1: the confirmation gate is a POSTURE, not a surface. The
+  // window's "confirm before running tools" switch and the shell's rule set
+  // answer the same question ("may this call run unattended?"), so the switch
+  // lives beside the rules that gate answers, in the one store both hosts read.
+  'confirmMode',
 ]);
 
 /**
@@ -79,6 +84,15 @@ const SHARED_PREF_KEYS = Object.freeze([
  */
 const LEGACY_MEMORY_PERSIST_NAMESPACE = '__memoryPersist';
 
+/**
+ * The second legacy namespace this store retires (ON8): the window's
+ * `__confirmMode: { enabled }` becomes the shared `confirmMode` boolean. Same
+ * rule, same reason as memory-persist above — and it is the one that closes
+ * D8's rule 1 in the direction that used to be impossible: a posture set in
+ * the window is now the posture the shell reads.
+ */
+const LEGACY_CONFIRM_MODE_NAMESPACE = '__confirmMode';
+
 /**
  * Key names that mean "secret" wherever they appear in the tree. Deliberately
  * conservative: `keyMask`-style *previews* never reach this file (they are not
@@ -233,7 +247,7 @@ function remove(key, opts) {
 /**
  * The non-secret half of a legacy `<userData>/settings.json`, in the shared
  * store's spellings. Only namespaces THIS store owns are extracted: the other
- * app-level namespaces (`__confirmMode`, `__avatar`, `__telemetry`,
+ * app-level namespaces (`__avatar`, `__telemetry`,
  * `__autoDrain`, `__autoMint`, `__quickLauncher`) stay host-local until their
  * own phase moves them, and the provider rows are never here at all because a
  * provider row is where a key lives.
@@ -244,6 +258,13 @@ function extractNonSecretHalf(legacy) {
   if (src && typeof src === 'object' && typeof src.enabled === 'boolean') {
     out.memoryPersist = src.enabled;
   }
+  // ON8: the confirmation gate adopts the same way. `enabled: true` means the
+  // gate is UP, which is the shared `confirmMode: true`; the shared key keeps
+  // the window's own polarity so an adopting install cannot flip its gate.
+  const gate = (legacy || {})[LEGACY_CONFIRM_MODE_NAMESPACE];
+  if (gate && typeof gate === 'object' && typeof gate.enabled === 'boolean') {
+    out.confirmMode = gate.enabled;
+  }
   return out;
 }
 
@@ -290,10 +311,19 @@ function adopt(opts) {
   }
   const patch = {};
   for (const k of keys) patch[k] = half[k];
+  // `names`, NOT `keys` (AEGISONE ON8): this ledger is written through `write()`
+  // below, so it is scanned like everything else — and `SECRET_KEY_RE` matches
+  // `key`/`keys` by design, because a preference named `keys` IS how key material
+  // would smuggle itself into a file the desktop and the shell both read. Spelled
+  // `keys`, this field made `assertNoSecrets` refuse the store's own write, so
+  // EVERY adoption with something to adopt threw — the whole pre-D5 migration was
+  // dead, silently (settings.js's best-effort catch turned the throw into "no
+  // adoption" and no one was told). The scanner is the control here, not the bug;
+  // a field name is free to change.
   patch.adopted = {
     from: legacyFile,
     at: new Date().toISOString(),
-    keys: keys.slice().sort(),
+    names: keys.slice().sort(),
   };
   write({ ...current, ...patch }, o);
   return { adopted: true, keys: keys.slice().sort(), from: legacyFile };