aegis-desktop 0.8.31 → 0.8.32

package/lib/local/entitlement.js

@@ -28,17 +28,37 @@
  * THE SIGNAL (see the report / the module's `probe`): main injects a probe that
  * calls `aegis.verifyApiKey()` — aegis1 `/api/verify-api-key`, which its own
  * docstring describes as "Verify a shared api_key and return plan/email/
- * memory_token". The plan field is the account's stored plan, and aegis1 owns
- * the vocabulary for it (`services/billing_service.py`: `PAID_PLANS = ("pro",)`
- * plus the legacy aliases that normalize onto it). This module MIRRORS that
- * vocabulary rather than inventing one; there is no new billing anything here,
- * no new endpoint, and no write to the server.
+ * memory_token". The plan field is the account's plan, and aegis1 owns the
+ * vocabulary for it (`services/billing_service.py`: `TIERS = ("free", "pro",
+ * "unlimited")`, `PAID_PLANS = ("pro", "unlimited")`, plus the legacy aliases
+ * that normalize onto one of them). This module MIRRORS that vocabulary rather
+ * than inventing one; there is no new billing anything here, no new endpoint,
+ * and no write to the server. The probe prefers the server's `plan_effective`
+ * (its own `is_pro()` verdict, trial included) over the stored `plan` string
+ * when it is present, because a welcome-trial account is a real Unlimited
+ * entitlement that `users.plan` does not record — see `classifyProbe`.
+ *
+ * THE BUG THIS VOCABULARY COST (fixed here). `PAID_PLANS` read `("pro",)`,
+ * mirroring the retired €2 line and MISSING `unlimited` — the €9/mo tier that
+ * is the only one sold. So `normalizePlan('unlimited')` fell through to `free`,
+ * and a paying Unlimited subscriber with a spent-out bank was handed the
+ * free-tier boundary: the fan-out refused, the cloud drain clamped to one local
+ * worker, and a "top up your balance" prompt — for an account whose plan is
+ * precisely what pays for the drain. aegis1's own `LEGACY_PLAN_ALIASES` carries
+ * the matching warning from the other side ("Deliberately NOT an alias:
+ * `unlimited` is a live tier you can subscribe to, so it must resolve through
+ * TIERS"), and its `test_tier_vocabulary` pins `PAID_PLANS` at two entries.
+ * Two implementations of "is this account paid" had already drifted once; this
+ * was the drift.
  *
  * PHASE 6 — THE SECOND SIGNAL, THE BALANCE. The plan is only half of how this
  * product charges. aegis1's actual paywall is the Token Bank running dry: the
  * balance is prepaid EUR the OPERATOR credits by hand, and `app.py` states the
  * consequence plainly — "Pool-key users with token bank balance skip legacy
- * credit checks." So entitlement here is `pro || balance > 0`, and when the
+ * credit checks." So entitlement here is `paid_plan || balance > 0` — and the
+ * `paid_plan` half is what carries an Unlimited subscriber whose bank is empty;
+ * the bank is an OVERAGE lever, never the thing that decides whether a paying
+ * account may use the feature it pays for. When the
  * bank reads zero the wall names the fix that exists (a top-up, campaign
  * `topup_bank`) instead of a plan checkout the user may already own. Nothing in
  * this module grants a balance, expires one, or auto-charges: the operator
@@ -64,8 +84,33 @@
 /** The free-tier fan-out ceiling: one worker per task, i.e. a plain turn. */
 const FREE_MAX_WORKERS = 1;
 
-/** Aegis1's paid tier. MIRROR of services/billing_service.py `PAID_PLANS`. */
-const PAID_PLANS = Object.freeze(['pro']);
+/**
+ * Aegis1's paid tiers. MIRROR of services/billing_service.py
+ * `PAID_PLANS = ("pro", "unlimited")` — pinned literal on purpose, because this
+ * is the line that has to move whenever the server sells another tier.
+ *
+ * `unlimited` (€9/mo) is the tier ON SALE and the one a paying customer almost
+ * certainly owns; `pro` is the grandfathered €2 line, kept because its
+ * subscribers keep their entitlements. Reading only `pro` was not a narrower
+ * version of this gate, it was a gate pointing at the wrong tier: every
+ * Unlimited account fell to the free boundary. `starter` stays out — aegis1
+ * itself calls that one free.
+ */
+const PAID_PLANS = Object.freeze(['pro', 'unlimited']);
+
+/**
+ * What each paid tier is CALLED, so a surface that names the account's plan
+ * names the one the server granted. The CLI has read the tier off the server's
+ * plan string since 6443a60 (`cli/src/entitlement.js::paymentView`) after it
+ * told a €9 subscriber they owned the retired €2 plan; this is the same value,
+ * resolved once in the shared module both hosts read.
+ */
+const TIER_NAMES = Object.freeze({ pro: 'Pro', unlimited: 'Unlimited' });
+
+/** The display name for a plan string, or null when it is not a paid tier. */
+function tierName(plan) {
+  return TIER_NAMES[normalizePlan(plan)] || null;
+}
 
 /**
  * MIRROR of services/billing_service.py `LEGACY_PLAN_ALIASES`: every stored
@@ -251,11 +296,20 @@ function promptUrlFor(host) {
  *  card on the next refresh and long enough that a drain never probes per task. */
 const DEFAULT_TTL_MS = 60 * 1000;
 
-/** Collapse any stored/alias plan string onto a tier, exactly as aegis1 does. */
+/** Collapse any stored/alias plan string onto a tier, exactly as aegis1 does.
+ *
+ *  Aegis1 checks its live `TIERS` BEFORE the alias table (`normalize_plan`), so
+ *  an alias can never shadow a tier it also names — and `unlimited` is a live
+ *  tier. It is therefore returned as itself and never collapsed onto `pro`: the
+ *  two grant different entitlements server-side (the monthly Unlimited
+ *  allowance and the BYOK fee waiver are `is_unlimited()`-gated), and telling a
+ *  €9 customer they own the retired €2 plan is the mistake commit 6443a60
+ *  exists to record.
+ */
 function normalizePlan(plan) {
   const raw = String(plan == null ? '' : plan).trim().toLowerCase();
   if (!raw) return 'free';
-  if (PAID_PLANS.includes(raw)) return 'pro';
+  if (PAID_PLANS.includes(raw)) return raw;
   const aliased = LEGACY_PLAN_ALIASES[raw];
   return aliased || 'free';
 }
@@ -265,9 +319,9 @@ function normalizePlan(plan) {
  *  drift into two different instructions. */
 const ASK_EXAMPLE = 'Do X autonomously';
 
-/** True only for a tier aegis1 itself would call paid. */
+/** True only for a tier aegis1 itself would call paid (`pro` or `unlimited`). */
 function isPaidPlan(plan) {
-  return normalizePlan(plan) === 'pro';
+  return normalizePlan(plan) !== 'free';
 }
 
 /**
@@ -367,7 +421,19 @@ function classifyProbe(result, error) {
   const body = result && typeof result === 'object' ? result : {};
   const bal = balanceOf(body);
   if (body.valid === false) return { source: 'no-key', plan: 'free', degraded: false, ...bal };
-  const stated = String(body.plan == null ? '' : body.plan).trim();
+  // WHICH plan field. `plan_effective` is aegis1's own entitlement verdict —
+  // the same predicate its `is_pro()` gates pooled calls on, so it counts the
+  // 30-day welcome trial that never writes `users.plan` (see app.py's
+  // register_device: the trial lives in `subscriptions`). The stored `plan`
+  // column cannot express that account, so an installing user read as `free`
+  // here and only the €12 signup credit kept the gate open — spend it, or fail
+  // to receive it, and a real Unlimited account was refused the feature. The
+  // stored string is still the fallback: an older server that predates the
+  // field must keep working, and it is the same value when nothing is on trial.
+  const rawPlan = body.plan_effective != null && String(body.plan_effective).trim()
+    ? body.plan_effective
+    : body.plan;
+  const stated = String(rawPlan == null ? '' : rawPlan).trim();
   if (!stated) {
     // A key that verified but carried no plan: aegis1's own default for such an
     // account is `free` (the column default), and a missing field is not proof
@@ -411,6 +477,8 @@ function createEntitlement({
     balanceZero: false,
     wall: 'plan',
     plan: 'free',
+    tier: null,
+    tierName: null,
     planRaw: null,
     maxWorkers: FREE_MAX_WORKERS,
     source: 'unresolved',
@@ -424,12 +492,20 @@ function createEntitlement({
   let inflight = null;
 
   function fromProbe({ source, plan, degraded, planRaw, balanceKnown = false, balanceMicros = null }) {
-    const pro = isPaidPlan(plan);
+    // The tier itself, not a paid/not-paid bit: `unlimited` and `pro` are both
+    // paid and must stay distinguishable, because the surfaces that name the
+    // account's plan (the desktop's queue boundary, the CLI's `/billing`) name
+    // the one the server granted. `pro` below keeps its original meaning — "the
+    // PLAN is paid for", as opposed to a free plan carried by a funded bank.
+    const tier = normalizePlan(plan);
+    const pro = tier !== 'free';
     const banked = balanceKnown && Number.isFinite(balanceMicros) && balanceMicros > 0;
     // TWO independent ways to be paid for: a paid plan, or a funded bank. The
     // operator controls the second by hand (aegis1 admin `add_funds`), which is
     // the lever this wall is built around — nothing here grants, times out or
-    // auto-charges; it only reads the number the operator set.
+    // auto-charges; it only reads the number the operator set. The FIRST way is
+    // the one a paying subscriber holds, and it does not weaken when their bank
+    // runs dry: the balance is overage, the subscription is the entitlement.
     const entitled = pro || banked;
     // The bank was READABLE and EMPTY — the operator's own signal that this
     // account is now paying, not the absence of a plan.
@@ -447,7 +523,12 @@ function createEntitlement({
       balanceMicros: balanceKnown ? balanceMicros : null,
       balanceZero,
       wall,
-      plan: pro ? 'pro' : 'free',
+      // The tier a paid PLAN grants, else `free`. A funded bank on a free plan
+      // is still `free` here — the bank is not a tier, and naming one would put
+      // a plan on the account the server never granted.
+      plan: pro ? tier : 'free',
+      tier: pro ? tier : null,
+      tierName: pro ? (TIER_NAMES[tier] || null) : null,
       planRaw: planRaw == null ? null : String(planRaw),
       // A paid session has no ceiling of its own here: main.js still clamps the
       // renderer's number to QUEUE_MAX_WORKERS, which stays the only upper bound.
@@ -543,6 +624,8 @@ module.exports = {
   createEntitlement,
   normalizePlan,
   isPaidPlan,
+  tierName,
+  TIER_NAMES,
   classifyProbe,
   fanoutRefusal,
   balanceRefusal,

package/main.js

@@ -3546,14 +3546,15 @@ function bootstrap() {
         // Nothing configured anywhere (env, this app's encrypted copy, or the
         // shared store): a fresh install. Auto-provision a free device key
         // from aegis1 — same shared helper mcp/server.js and the CLI use, so
-        // the desktop app works with no manual sign-in step. It starts at
-        // zero token-bank balance server-side (register-device), and pooled
-        // aegiscloud models additionally require an upgraded plan (aegis1's
-        // is_pro() gate) — this only unblocks BYOK and account status/
-        // settings until the account is funded and/or upgraded. Failure
-        // (offline, aegis1 unreachable) falls through exactly as before: the
-        // renderer's normal "not signed in" state handles it, and the next
-        // launch tries again.
+        // the desktop app works with no manual sign-in step. A brand-new
+        // fingerprint is granted aegis1's 30-day welcome-trial `unlimited`
+        // entitlement (token-bank credit + a subscriptions row) in the same
+        // register-device call that mints the key — see client/
+        // auto-provision.js's header for the aegis1 commit that made this a
+        // real grant rather than a badge. Failure (offline, aegis1
+        // unreachable) falls through exactly as before: the renderer's
+        // normal "not signed in" state handles it, and the next launch tries
+        // again.
         const result = await autoProvision.autoProvisionApiKey(aegis, credentials);
         if (result.key) settings.setAegisKey(result.key);
       }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.31",
+  "version": "0.8.32",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -1536,9 +1536,14 @@ function renderQueueEntitlement(state) {
     if (!resolved) els.queueBoundary.textContent = '';
     else if (entitled) {
       // Say which of the two ways this account is paid for, so a funded bank
-      // does not read as a Pro plan somebody did not buy.
+      // does not read as a Pro plan somebody did not buy — and name WHICH tier
+      // the plan is: `ent.tierName` is resolved in main from the plan string the
+      // server stated (shared module's TIER_NAMES), so a €9 Unlimited subscriber
+      // is not told they own the retired €2 plan. That mislabelling is the same
+      // class CLI commit 6443a60 fixed in `/billing`; the literal is only a
+      // fallback for a snapshot from a host that predates the field.
       els.queueBoundary.textContent = ent.pro
-        ? 'Pro — the cloud drain and the fan-out are unlocked.'
+        ? `${ent.tierName || 'Pro'} — the cloud drain and the fan-out are unlocked.`
         : 'Balance on your account — the cloud drain and the fan-out are unlocked.';
     } else {
       // The refusal names the Pro value AND keeps the free tier's real reach

package/vendor/aegis.js

@@ -841,10 +841,16 @@ function createClient(opts = {}) {
    * Ask aegis1 for a free device key when the caller has none configured yet
    * (`POST /api/v1/auth/register-device`). Idempotent server-side on
    * `fingerprint` — the same fingerprint always returns the same account's
-   * key rather than minting a new one. The account starts at zero token-bank
-   * balance: this hands out an account, not free inference, so the existing
-   * balance=0 gate on `/api/v1/chat/completions` still applies unchanged.
-   * Sends no API key of its own — there isn't one yet.
+   * key rather than minting a new one. A BRAND-NEW fingerprint (first call
+   * ever for this machine) is additionally granted aegis1's 30-day
+   * welcome-trial `unlimited` entitlement in the SAME request that mints the
+   * key — a token-bank credit of UNLIMITED_CLOUD_ALLOWANCE_MICROS plus a
+   * time-boxed `subscriptions` row (aegis1 commit 4372830), so a fresh
+   * install can use pooled cloud models immediately instead of starting at a
+   * zero balance. Re-registering an already-known fingerprint does NOT
+   * re-grant it; the pool balance gate still applies once the allowance is
+   * spent or the 30 days lapse. Sends no API key of its own — there isn't
+   * one yet.
    */
   async function registerDevice(fingerprint, opts) {
     return apiPost('/api/v1/auth/register-device', { fingerprint }, undefined, opts);

package/vendor/auto-provision.js

@@ -12,11 +12,18 @@
  * device-fingerprint.js) so a wiped credential store still resolves back to
  * the same account rather than minting a new, unfunded one.
  *
- * The provisioned account starts at ZERO token-bank balance server-side, and
- * aegis1 additionally requires an upgraded (paid, active) plan to use pooled
- * aegiscloud models at all (nexus_chat_completions' is_pro() gate) — this
- * only unblocks BYOK and account status/settings until the account is funded
- * and/or upgraded. It is account creation, not a grant of free inference.
+ * As of aegis1 commit 4372830, a brand-new fingerprint (first call ever for
+ * this machine) is granted the 30-day welcome-trial `unlimited` entitlement
+ * server-side — a token-bank credit (UNLIMITED_CLOUD_ALLOWANCE_MICROS) and a
+ * time-boxed `unlimited` row in `subscriptions` — in the SAME request that
+ * mints the key, not a separate step this client has to ask for. is_pro()'s
+ * pool gate and the BYOK fee waiver both see that grant immediately. This
+ * comment previously said the account "starts at ZERO balance" and "only
+ * unblocks BYOK" — that described pre-4372830 behavior and was stale; see
+ * services/billing_service.py's is_pro()/is_unlimited() docstrings on the
+ * aegis1 side for the current contract. A re-registration of an already-known
+ * fingerprint (the idempotent path) does NOT re-grant the trial — it only
+ * happens once per machine, ever.
  */
 const { machineFingerprint } = require('./device-fingerprint.js');