aegis-desktop 0.8.6 → 0.8.7

package/docs/marketing-assets/README.md

@@ -0,0 +1,89 @@
+# Marketing assets — captions, claim, and tagged links
+
+The three PNGs in this directory are the **existing** asset kit (1440×900, shot
+against the real app — see `docs/marketing-log.md`, 2026-09-22 entry). Images
+carry no link of their own, so the outbound link for each placement lives here,
+in the same directory as the image it belongs to. Nothing in this directory is a
+new asset: these are the captions for the three files below, rewritten for the
+Phase 5 promotion pass (`docs/upgrade-conversion-plan.md` §5).
+
+**The one claim (Phase 3, verbatim, same sentence as the welcome panel):**
+
+> **The autonomous queue keeps running after you close the laptop.**
+
+Plus the honesty line that sits next to it:
+
+> Everything on your machine is free, permanently. The cloud drain is what you
+> pay for.
+
+(`desktop/renderer/app.js` → `PAID_PROMISE` / `FREE_HONESTY`, rendered by
+`#welcome-template` in `desktop/renderer/index.html`.)
+
+**What the caption must not be:** a tour of the three model classes, or the free
+local row written up as if it were the product. The screenshots show the picker
+and the diff card — that is *what the image is of*, not the *offer*. One claim
+per asset; the class list stays out of the caption.
+
+**Channel rule.** Facebook and Reddit are image-friendly; X and YouTube captions
+follow `docs/launch-copy-x-youtube.md` §2/§3. Every link is
+`https://aegiscloud.org/go/upgrade?s=<channel>&c=<campaign>` with `s` in
+`(x, youtube, reddit, facebook)` — the only channels `SIGNUP_SOURCES` in
+`aegis1/app.py` accepts — and one campaign id per channel, stable across every
+asset on that channel.
+
+| Image | Placement | Channel `s` | Campaign `c` | Tagged link (paste this exact URL) |
+|---|---|---|---|---|
+| `01-model-class-picker.png` | X post (picker + claim in the reply) | `x` | `x_launch` | `https://aegiscloud.org/go/upgrade?s=x&c=x_launch` |
+| `01-model-class-picker.png` | Reddit image post (r/LocalLLaMA, r/ollama — link in the closing block, after the limitations) | `reddit` | `reddit_launch` | `https://aegiscloud.org/go/upgrade?s=reddit&c=reddit_launch` |
+| `01-model-class-picker.png` | Facebook Page + groups (image + claim + link) | `facebook` | `facebook_launch` | `https://aegiscloud.org/go/upgrade?s=facebook&c=facebook_launch` |
+| `02-answer-complete.png` | YouTube Short / long-form B-roll; `Upgrade:` line in the description | `youtube` | `yt_launch` | `https://aegiscloud.org/go/upgrade?s=youtube&c=yt_launch` |
+| `02-answer-complete.png` | X post (answer in flight) | `x` | `x_launch` | `https://aegiscloud.org/go/upgrade?s=x&c=x_launch` |
+| `03-tool-approval-diff.png` | X pinned post / thread 3- (the diff card) | `x` | `x_launch` | `https://aegiscloud.org/go/upgrade?s=x&c=x_launch` |
+| `03-tool-approval-diff.png` | Reddit GIF+text post (r/ChatGPTCoding) | `reddit` | `reddit_launch` | `https://aegiscloud.org/go/upgrade?s=reddit&c=reddit_launch` |
+| `03-tool-approval-diff.png` | YouTube thumbnail / description | `youtube` | `yt_launch` | `https://aegiscloud.org/go/upgrade?s=youtube&c=yt_launch` |
+
+Every row above is registered in `docs/marketing-log.md` §7 so post-hoc revenue
+can be joined to the channel and the asset face that produced it.
+
+## Captions
+
+### `01-model-class-picker.png` — the class picker
+
+> The autonomous queue keeps running after you close the laptop. Everything on
+> your machine is free, permanently — the cloud drain is what you pay for.
+> npm i -g aegis-desktop
+> https://aegiscloud.org/go/upgrade?s=x&c=x_launch
+
+Facebook variant (same claim, same tagged shape, different channel):
+
+> The autonomous queue keeps running after you close the laptop. Cloud-backed
+> drain, survives a reboot, fans a task out across workers, memory carried
+> between tasks. Everything on your machine is free, permanently.
+> npm i -g aegis-desktop
+> https://aegiscloud.org/go/upgrade?s=facebook&c=facebook_launch
+
+Do **not** caption this image with the picker's three rows as the pitch. The
+picker is a fact about the product; the claim above is the offer.
+
+### `02-answer-complete.png` — an answer, complete
+
+> The autonomous queue keeps running after you close the laptop — the work does
+> not stop when the laptop does. Everything on your machine is free, permanently.
+> Install: `npm i -g aegis-desktop && aegis`
+> https://aegiscloud.org/go/upgrade?s=youtube&c=yt_launch
+
+### `03-tool-approval-diff.png` — the diff/approval card
+
+> The diff card is the whole product locally — and it is free, permanently. The
+> pocket-book item is the drain that keeps running after you close the laptop.
+> Install: `npm i -g aegis-desktop && aegis`
+> https://aegiscloud.org/go/upgrade?s=x&c=x_launch
+
+## Before posting (§0 of `docs/marketing-plan-social.md`)
+
+1. Re-verify the version (`desktop/package.json`) and re-shoot the image if the
+   UI moved; log that check in `docs/marketing-log.md` §6.
+2. Confirm the link still resolves and still carries `s=`/`c=`. A bare
+   `aegiscloud.org/subscribe` (bare, untagged) link files as `direct` and the channel
+   gets no row.
+3. Never invent a number in a caption (marketing-log §2 rule 1).

package/lib/local/autonomous.js

@@ -402,7 +402,28 @@ function errorText(err) {
  * @param {object} [opts.git]   Injectable git-scope (tests).
  * @param {function} [opts.now] Clock.
  */
-function createQueueWorker({ engine, env = process.env, log = () => {}, git = gitScope, now = Date.now } = {}) {
+function createQueueWorker({
+  engine,
+  env = process.env,
+  log = () => {},
+  git = gitScope,
+  now = Date.now,
+  // May a task fan out AT ALL this session? The default preserves every host's
+  // behaviour (a CLI drain, a systemd timer: no entitlement, no clamp), and
+  // main.js passes the queue's entitlement gate — see
+  // desktop/lib/local/entitlement.js and Phase 4 of
+  // docs/upgrade-conversion-plan.md.
+  //
+  // This exists because the fan-out is otherwise reachable around the desktop's
+  // IPC gate: a task queued by the CLI or written into queue.jsonl by hand
+  // carries `singlePass: false`, and main.js had already accepted it long
+  // before anyone asked about entitlement. Refusing the whole task would be
+  // worse than the leak (the free tier keeps working — that is a promise), so
+  // the request is honoured as a SINGLE PASS and said out loud via a `note`
+  // frame: the run is clamped, never silently different from what the card
+  // shows.
+  canFanOut = () => true,
+} = {}) {
   if (!engine || typeof engine.chat !== 'function') {
     throw new Error('autonomous: a local engine with chat() is required');
   }
@@ -415,6 +436,18 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
     }
   };
 
+  /** `canFanOut` is host-supplied, so it is treated like any other injected
+   *  seam: a predicate that throws must not abort a drain — it fails CLOSED
+   *  (no fan-out), because the alternative is spending the multiplier the gate
+   *  exists to withhold. */
+  const safeCanFanOut = () => {
+    try {
+      return canFanOut() !== false;
+    } catch {
+      return false;
+    }
+  };
+
   /**
    * Run ONE queued task. Never throws: a failed task is data (so the drain can
    * decide whether to continue), not an exception that aborts the queue.
@@ -437,7 +470,21 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
     const model = resolveModel({ model: item.model, env });
     const ignored = ignoredEnvModel({ model: item.model, env });
     if (ignored) emit({ type: 'note', taskId: item.id, note: ignored });
-    const fanout = resolveFanout(item, env);
+    const fanoutAsked = resolveFanout(item, env);
+    // The clamp. `canFanOut()` is the entitlement answer (true everywhere
+    // except a non-Pro desktop session), and it can only ever take a fan-out
+    // AWAY: a task the session is not entitled to fan out runs as one plain
+    // turn on the same tier, exactly like a `singlePass` task.
+    const fanout = fanoutAsked && safeCanFanOut();
+    if (fanoutAsked && !fanout) {
+      emit({
+        type: 'note',
+        taskId: item.id,
+        note:
+          'fan-out needs Pro (the cloud drain that keeps running after you close ' +
+          'the laptop) — this task ran as a single pass',
+      });
+    }
     const effort = resolveEffort({ effort: item.effort, env, fanout });
     const rounds = maxRounds(env, item.maxRounds);
     // Approval requests have no one to answer them here; see the header.
@@ -496,6 +543,26 @@ function createQueueWorker({ engine, env = process.env, log = () => {}, git = gi
             // the default for exactly that reason; the retry/write-up passes in
             // the engine send `brain: false` for the same one-call reason.
             autonomous: fanout,
+            // THE OPT-OUT HAS TO BE SAID OUT LOUD, or the clamp above is
+            // decoration. `autonomous: false` does NOT reach the wire as a
+            // "no fan-out": engine.js derives its brain flag as
+            // `opts.singlePass ? false : opts.autonomous ? true : undefined`, so
+            // false-and-not-singlePass evaluates to `undefined`, and an absent
+            // `brain` means "leave the model id's own default alone". The model
+            // here IS `nexus-brain`, and aegis1 services/pool_brain.py
+            // parse_brain_request enables the fan-out when
+            // `is_brain_model(spec)` — no flag or worker count required:
+            //
+            //     enabled = not flag_off and (is_brain_model(spec) or flag_on or ...)
+            //
+            // So a clamped task went out asking for the full workers+1
+            // fan-out and got it, while the log said it ran as a single pass.
+            // `brain: false` is the only instruction that outranks the model id
+            // (pool_brain's own docstring: "the only way to ask for one provider
+            // call on a brain id"), and `singlePass: true` is how a caller
+            // produces it. This also fixes the plain `--single-pass` task, which
+            // never reached the wire as one for the same reason.
+            singlePass: !fanout,
             effort,
             workers: fanout ? item.workers || undefined : undefined,
             // The turn's working directory rides on `env`: engine.js reads the

package/lib/local/engine.js

@@ -1296,6 +1296,16 @@ function createLocalEngine({
         // field is off, which is what keeps every existing caller (the
         // renderer's IPC payloads included) on the cheap read.
         recallDeep: payload && payload.recallDeep === true,
+        // The fan-out opt-out, and it must be an explicit `true` for the same
+        // reason `recallDeep` is. `undefined` is NOT an opt-out: the wire flag
+        // below is `singlePass ? false : autonomous ? true : undefined`, and an
+        // absent `brain` flag lets the *model id* turn the fan-out on by itself
+        // (aegis1 pool_brain.parse_brain_request: `is_brain_model(spec)` alone
+        // enables it). So a clamped task on a brain model fanned out anyway
+        // while the log claimed a single pass — the caller's intent never
+        // reached the wire. Forwarding it here is what lets the refusal be real
+        // rather than a local boolean nobody downstream could see.
+        singlePass: payload && payload.singlePass === true,
         onReasoning,
         idleTimeoutMs: autonomous ? AUTONOMOUS_IDLE_TIMEOUT_MS : undefined,
         // A caller with no live streaming surface (a `--no-stream` CLI flag, a