aegis-desktop 0.8.34 → 1.0.0

package/README.md

@@ -101,6 +101,17 @@ the models that key unlocks appear as their own entries, one per provider.
    startup, and a provider with no key saved in Settings is resolved from it.
 3. Select the **Bring your own key** class and pick a model.
 
+**A model the catalogue does not name yet.** Vendors ship models faster than any
+client release, and the relay forwards whatever model string it is handed — so
+Settings ends with an **Add model** row (provider + model id + *Add model*). It
+writes the same `~/.aegiscode/models.json` the CLI's `/model-add` writes, so a
+model added here appears in the terminal's `/models` immediately and one added
+there appears in this picker on its next refresh; the row prints the file path,
+which is also the bulk-edit path. The provider id is offered from the live
+catalogue but you may type one, and a provider the relay takes no key for is
+refused rather than stored (a declaration nothing can attach a key to would show
+up in no picker at all). Each declared model gets a **Remove** row.
+
 **What it costs.** AEGIS pays your provider nothing on this lane, so there is no
 provider cost to take a margin on — instead your AEGIS account is charged a flat
 **handling fee** per 1k tokens, for the routing, prompt assembly, caching, tool

package/lib/deep-link.js

@@ -14,6 +14,36 @@
 const PROTOCOL = 'aegis';
 const SCHEME_PREFIX = `${PROTOCOL}://`;
 
+/**
+ * Ceilings on the two values a *remote* caller controls.
+ *
+ * Any web page or any other app on the machine can hand the OS an `aegis://`
+ * URL, so both fields are attacker-chosen input on a channel nobody authenticates
+ * (there is no "is this link from the user?" check, and there cannot be one for
+ * a custom scheme). Bounding them keeps a hostile link from parking megabytes of
+ * text in the composer, from filling the window with a wall of pre-filled prompt,
+ * or from using the deep link as a bulk data channel into a session that can run
+ * tools. The renderer pre-fills rather than auto-sends (renderer/app.js
+ * handleDeepLink), so the cost is bounded, but a pre-filled prompt is still the
+ * most direct route from "a page I visited" to "text the user is invited to send
+ * to a model with tools on".
+ *
+ * These are generous on purpose: a real hand-written link is a sentence or two.
+ */
+const MAX_PROMPT_LENGTH = 2000;
+/** Session ids are uuids (36 chars); the slack is for a future format, not a payload. */
+const MAX_SESSION_ID_LENGTH = 128;
+/**
+ * …and the charset is pinned too, because this id does not stay a string: the
+ * renderer's `open` handler hands it to openSession(), which loads the session
+ * by name. A hostile link could otherwise offer `../../…` or an absolute path
+ * and have the *renderer* ask main to open whatever that resolves to. Ids this
+ * app mints are `[0-9a-f-]`; anything outside a conservative id alphabet is not
+ * one of ours, so it is rejected rather than escaped or repaired.
+ */
+const SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+
+
 /** True for any string that looks like our protocol, cheap enough to filter
  *  argv with before the full URL parse (which throws on most argv entries —
  *  flags, file paths — so callers should not run it against every arg). */
@@ -44,11 +74,15 @@ function parseDeepLinkUrl(url) {
   if (action === 'open') {
     const sessionId = parsed.searchParams.get('session');
     if (!sessionId) return null;
+    if (sessionId.length > MAX_SESSION_ID_LENGTH) return null;
+    if (!SESSION_ID_PATTERN.test(sessionId)) return null;
     return { action: 'open', sessionId };
   }
 
   if (action === 'new') {
-    return { action: 'new', prompt: parsed.searchParams.get('prompt') || '' };
+    const prompt = parsed.searchParams.get('prompt') || '';
+    if (prompt.length > MAX_PROMPT_LENGTH) return null;
+    return { action: 'new', prompt };
   }
 
   return null;

package/lib/local/autonomous.js

@@ -73,6 +73,83 @@ const MAX_ROUND_STOPS = 3;
  */
 const WRITE_TOOLS = new Set(['writeFile', 'editFile']);
 
+// ── Auto mode and the round horizon ─────────────────────────────────────────
+//
+// The two halves of "auto mode" the upstream engine (aegiscodex-dev) defines
+// are independent, and a host that wires only one of them is *not* running auto
+// mode — it is running "no approval cards", which is half the feature and all
+// the friction:
+//
+//   1. no approval keystroke per mutating tool call;
+//   2. a turn that hits its round horizon is EXTENDED silently a few times
+//      before a human is asked.
+//
+// (1) is the posture (the desktop's Tool-approvals switch, the CLI's
+// /automode); (2) needs the arithmetic below, and the plugin's Electron host
+// had none of it — with auto mode ON, every horizon hit still raised the
+// blocking round card, which is precisely the question auto mode exists to stop
+// asking ("12 rounds — keep going?" answered the same way every time).
+//
+// Ported verbatim from the engine's src/autonomous.js (DEFAULT_AUTO_CONTINUES,
+// autoContinueLimit, autoRoundsDefault, autoContinuePlan) rather than vendored,
+// because this repo hosts no build of that ESM module — but with the SAME
+// numbers and the SAME env knobs, so a turn behaves identically in either
+// client. cli/src/chatflow.js carries the third copy, which is what the CLI
+// presenter uses to answer the ask.
+
+/** Automatic continuations an attended turn may take while auto mode is on. */
+const DEFAULT_AUTO_CONTINUES = 3;
+
+/**
+ * The auto-continue allowance, honouring AEGIS_AUTO_CONTINUE_MAX.
+ *
+ * Bounded and pure, and a garbage value falls back to the default rather than
+ * to 0: an unparseable env var must not silently switch auto mode off, because
+ * the visible symptom of that ("why is it asking me again?") points nowhere
+ * near the environment.
+ */
+function autoContinueLimit(env = process.env) {
+  const n = Number.parseInt(env && env.AEGIS_AUTO_CONTINUE_MAX, 10);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_AUTO_CONTINUES;
+}
+
+/**
+ * Values of AEGIS_AUTO_ROUNDS that mean "start in manual mode". Anything else —
+ * unset, empty, a typo like `flase` — leaves auto mode's default in place, so a
+ * misspelt opt-out cannot silently disable the mode the operator asked for.
+ * Same set, same reasoning, as the engine's AUTO_ROUNDS_OFF.
+ */
+const AUTO_ROUNDS_OFF = new Set(['0', 'false', 'off', 'no']);
+
+/** False only when AEGIS_AUTO_ROUNDS explicitly says so. */
+function autoRoundsDefault(env = process.env) {
+  const raw = env && env.AEGIS_AUTO_ROUNDS;
+  if (raw === undefined || raw === null) return true;
+  const val = String(raw).trim().toLowerCase();
+  if (!val) return true;
+  return !AUTO_ROUNDS_OFF.has(val);
+}
+
+/**
+ * Decide what one round-horizon ask becomes while auto mode is on.
+ *
+ * Pure, because this is budget arithmetic on a keystroke-less path: the caller
+ * only renders the answer and must not be trusted to keep the count. `used` is
+ * the running tally the caller holds and echoes back, so an ask that IS shown
+ * to the human resets it — the human was asked, so the next block of automatic
+ * continuations starts clean.
+ *
+ *   { auto: true,  used: n }  → answer the ask "yes" without a dialog
+ *   { auto: false, used: n }  → show the real ask (allowance spent, or off)
+ */
+function autoContinuePlan({ on = false, used = 0, limit = DEFAULT_AUTO_CONTINUES } = {}) {
+  const cap = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : DEFAULT_AUTO_CONTINUES;
+  const spent = Number.isFinite(used) && used > 0 ? Math.floor(used) : 0;
+  if (!on) return { auto: false, used: spent, cap };
+  if (spent >= cap) return { auto: false, used: 0, cap };
+  return { auto: true, used: spent + 1, cap };
+}
+
 /** The path a file-writing tool call names, in either spelling the engine uses. */
 function writtenPath(tool) {
   const args = (tool && tool.args) || {};
@@ -906,6 +983,10 @@ module.exports = {
   isAutonomousRequest,
   maxRounds,
   withRoundHorizon,
+  DEFAULT_AUTO_CONTINUES,
+  autoContinueLimit,
+  autoRoundsDefault,
+  autoContinuePlan,
   resolveModel,
   ignoredEnvModel,
   resolveEffort,