aegis-desktop 0.8.33 → 0.8.35

package/lib/local/engine.js

@@ -797,6 +797,7 @@ function createLocalEngine({
   // remembering "no" makes the first answer stick.
   const sessionDenials = new Map(); // rootSessionId -> Set<toolName>
   const pendingApprovals = new Map(); // approvalId -> { resolve }
+  const pendingRoundAsks = new Map(); // askId -> { resolve }
 
   function sessionAllows(rootId, name) {
     const set = sessionAllowlists.get(rootId);
@@ -911,6 +912,62 @@ function createLocalEngine({
     });
   }
 
+  /** The renderer's rounds-dialog answer resolves the pending
+   *  requestRoundsAsk() promise below. An unknown/already-answered id is a
+   *  no-op, same contract as respondApproval. */
+  function respondRoundsAsk(askId, decision) {
+    const pending = pendingRoundAsks.get(askId);
+    if (!pending) return { ok: false };
+    pendingRoundAsks.delete(askId);
+    pending.resolve(decision === true || decision === 'continue');
+    return { ok: true };
+  }
+
+  /**
+   * Ask the renderer whether to fund another block of tool rounds, mirroring
+   * requestApproval's shape exactly: pushed over `rootOnDelta` as a `{ rounds }`
+   * chunk (the one channel a detached renderer has into a running turn) and
+   * resolved externally via `respondRoundsAsk`. Resolves `true` (fund one more
+   * block) or `false` (stop here) — never throws. Fails safe to `false`: no
+   * listener, an aborted turn, or an unanswered ask must not keep the loop
+   * waiting forever (or, worse, spend rounds nobody agreed to).
+   */
+  function requestRoundsAsk(rootSessionId, rootOnDelta, signal, info) {
+    return new Promise((resolve) => {
+      if (signal && signal.aborted) {
+        resolve(false);
+        return;
+      }
+      const id = randomUUID();
+      let settled = false;
+      const onAbort = () => finish(false);
+      const finish = (decision) => {
+        if (settled) return;
+        settled = true;
+        pendingRoundAsks.delete(id);
+        if (signal) signal.removeEventListener('abort', onAbort);
+        resolve(decision);
+      };
+      if (signal) signal.addEventListener('abort', onAbort, { once: true });
+      pendingRoundAsks.set(id, { resolve: finish });
+      if (typeof rootOnDelta !== 'function') {
+        finish(false);
+        return;
+      }
+      rootOnDelta({
+        delta: '',
+        rounds: {
+          id,
+          sessionId: rootSessionId,
+          spent: info.spent,
+          extensions: info.extensions,
+          max: info.max,
+          size: info.size,
+        },
+      });
+    });
+  }
+
   /**
    * The gate itself: read-only tools and already-session-allowed mutating
    * tools run exactly like executeTool always did. A first-time mutating
@@ -1522,6 +1579,12 @@ function createLocalEngine({
     // synthesis pass) instead of a single provider call. UI-gated to the
     // 'aegis' class only (see AUTONOMOUS_CLASS in app.js).
     const autonomous = cls === 'aegis' && Boolean(payload && payload.autonomous);
+    // Opt-in only: the round-horizon dialog (requestRoundsAsk below) needs a
+    // live renderer on the other end of `rootOnDelta` able to answer it. The
+    // interactive CLI session sets this; the queue worker and `-p` one-shot
+    // runs never do (nobody is there to click), so they keep the old
+    // stop-and-record-session behaviour (sessionRounds below) untouched.
+    const roundsAsk = Boolean(payload && payload.roundsAsk);
     const sessionId = (payload && payload.sessionId) || randomUUID();
     // Recursion depth for the task tool: 0 for a real user turn, N+1 for a
     // subagent spawned by depth N. Never set by an IPC caller — only by
@@ -1797,8 +1860,17 @@ function createLocalEngine({
       }
       // A resumed turn gets a small bonus on top of the base horizon so
       // re-orientation does not consume the new budget before any work lands.
-      const maxRounds = statedRounds || baseRounds + (resumed ? sessionRounds.bonus(baseRounds) : 0);
+      let maxRounds = statedRounds || baseRounds + (resumed ? sessionRounds.bonus(baseRounds) : 0);
       let round = 0;
+      // Rounds bought by one confirmed extension, and a hard cap on how many
+      // extensions a single turn may spend — matching the upstream engine's
+      // numbers (src/autonomous.js ROUND_EXTENSION_SIZE/MAX_ROUND_EXTENSIONS)
+      // so a turn behaves the same whether it runs there or here. The cap
+      // exists even though the renderer is the one asking: a dialog that
+      // always says yes must still terminate (8 x baseRounds extra rounds).
+      const ROUND_EXTENSION_SIZE = baseRounds;
+      const MAX_ROUND_EXTENSIONS = 8;
+      let extensions = 0;
 
       // Token accounting for the whole TURN, not just its last round. An
       // agentic turn makes one provider call per tool round, and returning only
@@ -1858,11 +1930,49 @@ function createLocalEngine({
         // which is the same "(empty response)" failure the guards below exist
         // to prevent.
         if (round >= maxRounds) {
+          // Before conceding, give an interactive caller the chance to fund
+          // another block of rounds instead of ending the turn outright — the
+          // upstream engine's "asks" contract (src/backend.js requestExtension).
+          // Only reachable with `roundsAsk` AND a live signal: a caller with no
+          // renderer on the other end (queue, `-p`) falls straight through to
+          // the session-hold stop below, unchanged.
+          if (roundsAsk && extensions < MAX_ROUND_EXTENSIONS && !signal.aborted) {
+            const granted = await requestRoundsAsk(rootSessionId, rootOnDelta, signal, {
+              spent: maxRounds,
+              extensions: extensions + 1,
+              max: MAX_ROUND_EXTENSIONS,
+              size: ROUND_EXTENSION_SIZE,
+            });
+            if (granted) {
+              extensions += 1;
+              const spent = maxRounds;
+              maxRounds += ROUND_EXTENSION_SIZE;
+              history.push({
+                role: 'user',
+                content: `You have used all ${spent} tool rounds allowed for this turn; ` +
+                  `${ROUND_EXTENSION_SIZE} more have been granted (do not restart). Continue the task ` +
+                  'from exactly where you stopped — do not re-plan, do not repeat work already done, ' +
+                  'and finish with an answer.',
+              });
+              continue;
+            }
+            // Declined (or the extension cap is spent): fall through to the
+            // same session-hold stop a non-interactive caller gets, so a "no"
+            // here is bit-for-bit the old hard stop rather than a dead end.
+          }
+          // The knob is only advice where nobody could have been asked about
+          // it. An interactive caller was already offered another block of
+          // rounds (requestRoundsAsk above) and declined or spent the cap, so
+          // pointing it at an env var it cannot set from inside the app — and
+          // would have to restart to apply — is obsolete text: drop it. The
+          // queue worker and `-p` one-shots have no dialog, so for them the
+          // variable remains the only lever and is still named.
+          const knob = roundsAsk ? '' : `, or raise ${roundEnvName} for a longer single turn`;
           const note =
             `[stopped at ${maxRounds} tool rounds` +
             `${turnUsage.total_tokens ? `, ${turnUsage.total_tokens.toLocaleString()} tokens` : ''}` +
             `. This session holds the work: your next message here resumes it automatically` +
-            ` (with a continuation preamble), or raise ${roundEnvName} for a longer single turn.]`;
+            ` (with a continuation preamble)${knob}.]`;
           // File the interruption before returning, so the horizon is a pause
           // in the session rather than the end of the job. `chain` carries the
           // count forward across resumes.
@@ -2146,6 +2256,7 @@ function createLocalEngine({
     chat,
     cancel,
     respondApproval,
+    respondRoundsAsk,
     clearSessionApprovals,
     settings,
     unloadLocalModels,

package/main.js

@@ -1430,6 +1430,22 @@ function createModelDispatch(engine) {
     // session" grants so a fresh thread never inherits a prior one's.
     respondApproval: (payload) =>
       engine.respondApproval(payload && payload.approvalId, payload && payload.decision),
+    // Round-horizon gate (desktop/lib/local/engine.js requestRoundsAsk): the
+    // renderer's rounds card answers a pending "fund another block of tool
+    // rounds?" ask here. The ask itself arrives as a `{ rounds }` chunk on the
+    // same chat() delta stream the approval card rides — see
+    // desktop/renderer/app.js renderRoundsCard. An unanswered id is a no-op,
+    // same contract as respondApproval.
+    //
+    // Guarded on the method's existence rather than assuming it: an engine
+    // without the ask can never emit a `{ rounds }` chunk, so this branch is
+    // unreachable there — but a renderer/window pair that is newer than the
+    // engine it drives must get an honest `{ ok: false }` instead of a
+    // TypeError inside the IPC handler.
+    respondRoundsAsk: (payload) =>
+      typeof engine.respondRoundsAsk === 'function'
+        ? engine.respondRoundsAsk(payload && payload.roundsAskId, payload && payload.decision)
+        : { ok: false },
     clearApprovals: (payload) =>
       engine.clearSessionApprovals(payload && payload.sessionId),
   };
@@ -1748,6 +1764,18 @@ function registerModelIpc(ipcMain, engine, sessionsDir, aegis, onReplyFinished,
     if (name === 'chat') {
       ipcMain.handle(`${MODEL_PREFIX}${name}`, (event, payload) => {
         const opts = { ...(payload || {}) };
+        // The rung every renderer sends is low|medium|high; this is the one
+        // place a stale window can still hand us the retired `auto` (a page
+        // loaded before the select lost that row, or a renderer that forgot to
+        // resolve), and a falsy effort is NOT "the engine's default" — the
+        // shared engine states the field conditionally, so an absent value
+        // means "state no opinion" and the server sizes the turn itself. So it
+        // is normalised here rather than passed through: an unknown value
+        // becomes `high`, the same floor the engine and the CLI apply, and no
+        // turn can reach the wire with an effort nobody chose.
+        const effortRung =
+          opts.effort === 'low' || opts.effort === 'medium' ? opts.effort : 'high';
+        opts.effort = effortRung;
         const sender = event && event.sender;
         const forward = (chunk) => {
           if (
@@ -1867,11 +1895,30 @@ function queueEngineWithDeniedApprovals(engine) {
       /* the turn's own error path reports a gate that cannot be answered */
     }
   };
+  // The third net under the same rule, for the round-horizon ask. A queued task
+  // is unattended, so nobody can fund another block and the answer is always
+  // "no" — which is precisely the engine's own non-interactive behaviour (it
+  // stops, files the session hold, and names the env knob). Answering `false`
+  // rather than leaving the promise pending is what keeps a worker from parking
+  // on a card nobody will ever click: an unanswered ask does resolve false
+  // (requestRoundsAsk fails safe), but waiting for the abort instead would look
+  // like a hung task in the queue for however long the turn ran.
+  const stopRounds = (chunk) => {
+    const ask = chunk && chunk.rounds;
+    if (!ask || !ask.id) return;
+    if (typeof engine.respondRoundsAsk !== 'function') return;
+    try {
+      engine.respondRoundsAsk(ask.id, false);
+    } catch {
+      /* as above: the turn reports a gate that cannot be answered */
+    }
+  };
   return {
     ...engine,
     chat(payload, onDelta) {
       return engine.chat(payload, (chunk) => {
         deny(chunk);
+        stopRounds(chunk);
         if (typeof onDelta === 'function') onDelta(chunk);
       });
     },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.33",
+  "version": "0.8.35",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/preload.js

@@ -357,6 +357,12 @@ const models = {
   // this session" grants; newChat() calls it so a fresh thread starts clean.
   respondApproval: (approvalId, decision) =>
     invokeModel('respondApproval', { approvalId, decision }),
+  // Round-horizon gate: answers a pending `{ rounds }` ask raised by the engine
+  // when a turn has used every tool round it was allowed (see app.js
+  // renderRoundsCard, and requestRoundsAsk in lib/local/engine.js). Same shape
+  // and same channel as respondApproval above.
+  respondRoundsAsk: (roundsAskId, decision) =>
+    invokeModel('respondRoundsAsk', { roundsAskId, decision }),
   clearApprovals: (sessionId) => invokeModel('clearApprovals', { sessionId }),
 };