aegis-desktop 0.8.8 → 0.8.10

package/README.md

@@ -326,3 +326,9 @@ host over the same engine.
 [`aegis-desktop`](https://www.npmjs.com/package/aegis-desktop) is built from a
 `git subtree split` of it — same code, published without the rest of the
 monorepo. Edits land here and are synced out; nothing is authored elsewhere.
+
+---
+
+Built by **Niklas Borneklint** — [aegiscloud.org](https://aegiscloud.org) · [@aegisinfo](https://github.com/aegisinfo)
+
+Part of the ÆGIS ecosystem.

package/lib/avatar/turn.js

@@ -107,7 +107,7 @@ function recallPolicy(caps, opts = {}) {
  *  - the pooled brain tier (`nexus-brain` and the `-smart`/`-neo` spellings the
  *    server serves as aliases), which is not one model at all: the server fans
  *    the turn out to reasoning workers plus a synthesis pass. That is the one
- *    id the Aegis Cloud class offers (engine.js filterAegisCatalog), so an
+ *    id the Aegis Cloud class offers (engine.js offerableCatalog), so an
  *    Aegis Cloud turn satisfies the floor by construction.
  */
 const REASONING_MODEL_RE = /^(?:deepseek-(?:v4(?:\.\d+)?-(?:flash|pro)|flash|pro|reasoner)|(?:nexus|aegis)-brain(?:-(?:smart|neo))?)$/;

package/lib/local/autonomous.js

@@ -84,7 +84,7 @@ function writtenPath(tool) {
  * The default AEGIS Cloud model for autonomous work: the pooled brain, which
  * is the tier the server can fan out to multiple reasoning workers and
  * synthesise. `nexus-brain` is the canonical id the catalog itself prefers
- * (the other tier spellings are aliases of it — see filterAegisCatalog in
+ * (the other tier spellings are aliases of it — see offerableCatalog in
  * engine.js).
  *
  * The model id is only the tier. It is NOT what makes an autonomous task
@@ -108,7 +108,7 @@ const DEFAULT_MODEL = 'nexus-brain';
  * the pool auto-route across whichever providers hold a live key.
  *
  * The accept-list is therefore the pooled-brain tier family — the one entry
- * engine.js's filterAegisCatalog offers for the Aegis Cloud class, plus the
+ * engine.js's offerableCatalog offers for the Aegis Cloud class, plus the
  * `-smart`/`-neo` tier spellings the server still serves as aliases of it. This
  * mirrors selectBrainEntry() there rather than re-deriving "anything starting
  * with nexus-": `nexus-fast` is not a tier the catalog has ever served, and

package/lib/local/engine.js

@@ -76,6 +76,63 @@ try {
   }
 }
 
+/**
+ * The shared pooled-brain selection rule (`client/brain-catalog.js`), resolved
+ * the same two ways as every other shared module: repo-relative from a source
+ * checkout, and this app's own staged tree (`desktop/vendor/brain-catalog.js`,
+ * flattened by scripts/predist.mjs because a packaged app cannot reach outside
+ * its own directory). The CLI resolves the same file its own way, through
+ * `cli/src/sharedpaths.js`. Both hosts must agree on which entry stands for the
+ * pool, so there is deliberately no fallback implementation here — a silently
+ * divergent local copy is the exact bug this module removes. When neither
+ * layout has it, require() throws at load time naming the file, rather than the
+ * host quietly offering a different model list than its sibling.
+ */
+function requireSharedBrain() {
+  const candidates = [
+    () => require('../../../client/brain-catalog.js'),
+    () => require('../../vendor/brain-catalog.js'),
+  ];
+  let last = null;
+  for (const load of candidates) {
+    try {
+      return load();
+    } catch (err) {
+      last = err;
+    }
+  }
+  throw last;
+}
+
+/**
+ * The shared BYOK model additions (`client/byok-catalog.js`), resolved exactly
+ * the two ways above and for the same reason: the CLI vendors THIS file
+ * (cli/scripts/predist.mjs) and requires the same module through
+ * `cli/src/sharedpaths.js`, so a copy-per-host here is how the terminal and the
+ * window would come to offer one account two different provider model lists —
+ * the defect class this repo keeps paying for.
+ *
+ * The module is pure and returns a NEW array, so a caller may apply it to a
+ * payload it did not build. It never invents a provider: a provider absent from
+ * the server's catalog stays absent, because a row that accepts a vendor key
+ * must correspond to a slug the relay actually takes.
+ */
+function requireSharedByokCatalog() {
+  const candidates = [
+    () => require('../../../client/byok-catalog.js'),
+    () => require('../../vendor/byok-catalog.js'),
+  ];
+  let last = null;
+  for (const load of candidates) {
+    try {
+      return load();
+    } catch (err) {
+      last = err;
+    }
+  }
+  throw last;
+}
+
 /**
  * How long a turn waits for the working-tree lock before running anyway.
  *
@@ -244,48 +301,36 @@ function normalizeCatalog(models) {
 }
 
 /**
- * The Aegis Cloud catalog (`/api/v1/models`) lists every backend the pool can
- * reach: per-provider ids (`openai`, `anthropic`, `groq`, `gemini`, ...) and
- * six pooled-brain tier ids (`{aegis,nexus}-brain[-smart|-neo]`) that all run
- * the same worker pool on the same backend model. None of that is a human's
- * model choice — which providers currently hold a valid key is an ops detail
- * (today: deepseek/anthropic/groq; openai and gemini drift in and out), and
- * surfacing it invites picking a provider that happens to be dead right now.
- * The pool already auto-routes across whichever providers are live, so the
- * desktop dropdown offers exactly one entry for the "aegis" class: the
- * collapsed "Nexus" brain — never the raw provider list.
+ * The Aegis Cloud (pooled) dropdown offers Nexus, and only Nexus.
+ *
+ * The catalog (`/api/v1/models`) lists per-provider ids (`deepseek`,
+ * `anthropic`, `groq`, `openai`, ...) alongside five pooled-brain tier
+ * spellings (`{aegis,nexus}-brain[-smart|-neo]`) that all route the same
+ * worker pool. This host briefly offered the full list — the per-provider ids
+ * included — on the theory that a funded account should be able to pin the
+ * exact model it pays for. Niklas's explicit instruction is narrower: AEGIS
+ * Cloud offers Nexus only, no per-provider pin, so this is back on
+ * `filterAegisCatalog` — the shared rule's single-row collapse.
+ *
+ * The rule itself lives in `client/brain-catalog.js`, shared with the CLI, so
+ * there is exactly one copy of it: two copies is how this host and the
+ * terminal previously came to offer the same account two different model
+ * lists. `filterAegisCatalog` collapses the five brain-tier spellings to the
+ * one row labelled Nexus; a payload with no brain tier (the BYOK listing) is
+ * unaffected — see the desktop's byok branch below, which still offers every
+ * provider id the account holds a key for. Resolved the two ways this repo
+ * resolves every shared module — repo-relative in a checkout, and this app's
+ * staged vendor/ tree.
  */
-const NEXUS_BRAIN_IDS = Object.freeze(['nexus-brain', 'aegis-brain']);
-const NEXUS_LABEL = 'Nexus';
+const { filterAegisCatalog } = requireSharedBrain();
 
 /**
- * Pick the one entry standing in for the pooled brain. The server serves
- * `nexus-brain` as the canonical tier (`hidden: false`, no `alias_of`) and
- * marks every other spelling — `aegis-brain` and the `-smart`/`-neo` tiers —
- * as `hidden: true, alias_of: "nexus-brain"`. Prefer the canonical id so the
- * request travels on the name the server owns; fall back to the alias, then to
- * any tier whose `alias_of` names the brain, so a renamed or trimmed catalog
- * still resolves to something selectable instead of silently emptying the
- * dropdown (the previous fixed-id lookup returned [] if `aegis-brain` was ever
- * retired, leaving the class with no model to choose).
+ * The BYOK additions, applied to the server's provider catalog below. Same
+ * one-copy rule as the brain rule above: the terminal requires this same module
+ * (cli/src/commands.js, through sharedpaths.js), so neither host can offer a
+ * provider row the other does not.
  */
-function selectBrainEntry(models) {
-  return (
-    models.find((m) => NEXUS_BRAIN_IDS.includes(m.id) && !m.hidden && m.alias_of === undefined)
-    || models.find((m) => NEXUS_BRAIN_IDS.includes(m.id))
-    || models.find((m) => m.alias_of && NEXUS_BRAIN_IDS.includes(m.alias_of))
-    || null
-  );
-}
-
-function filterAegisCatalog(models) {
-  const nexus = selectBrainEntry(models);
-  if (!nexus) return [];
-  // Drop the alias bookkeeping: this entry *is* the selection, so the renderer
-  // must never treat it as a hidden alias and filter it back out.
-  const { hidden, alias_of, ...rest } = nexus;
-  return [{ ...rest, label: NEXUS_LABEL }];
-}
+const { withByokAdditions } = requireSharedByokCatalog();
 
 // ── Agent-loop helpers ──────────────────────────────────────────────────────
 
@@ -790,7 +835,14 @@ function createLocalEngine({
       let fee = null;
       try {
         const data = await aegis.byokProviders();
-        providers = (data && data.providers) || [];
+        // The server's catalog, plus the ids it does not name but the vendor
+        // serves and the relay will forward (`client/byok-catalog.js`, shared
+        // with the CLI so both hosts offer the same rows). Applied HERE, at the
+        // single point where the payload enters this engine, so every consumer
+        // of `providers` — the model list built just below, the renderer's
+        // per-provider Settings rows, and the CLI's own `/byok` listing when it
+        // runs on this engine — sees one list instead of three opinions.
+        providers = withByokAdditions((data && data.providers) || []);
         // The handling fee AEGIS adds on top of the caller's vendor bill. It is
         // the server's own published rate (services/pricing.price_byok_call) and
         // is passed through untouched — never re-derived here, because a client

package/lib/provider-key-mirror.js

@@ -0,0 +1,136 @@
+'use strict';
+
+/**
+ * provider-key-mirror.js — make a provider key saved in the DESKTOP visible to
+ * every other host on the same machine.
+ *
+ * The desktop's Provider settings rows persist into its own encrypted settings
+ * store (`desktop/lib/settings.js` -> `settings.json` under the app's userData
+ * dir). That store is private to this app: `aegiscode` (the CLI) and the MCP
+ * plugin never read it, and they cannot — it is an encrypted Electron store in
+ * another process's data directory. So a key added in the desktop was invisible
+ * to the CLI on the next run: same machine, same provider, key asked for twice.
+ *
+ * The fix is not to teach every host to open an encrypted Electron store. It is
+ * to write the key where all four hosts already look at start-up —
+ * `~/.aegiscode/.env`, through the ONE shared writer (`client/env-file.js`
+ * `setEnvValue`). After this, "add your provider key in the app" and "put it in
+ * ~/.aegiscode/.env" are the same instruction, which is the point.
+ *
+ * Policy, deliberately narrow:
+ *
+ *   - PROVIDER keys only. The AEGIS *account* key is already shared through
+ *     `credentials.json` (`client/credentials.js`), which the CLI, the MCP
+ *     plugin and the desktop all read. A second copy in the env file would be a
+ *     second authority that can silently disagree with the first — exactly the
+ *     "which one won?" failure env-file.js refuses for duplicate lines. So
+ *     `setAegisKey()` is deliberately NOT wrapped.
+ *   - The variable name comes from `envFile.envVarFor(provider)`, the same
+ *     mapping the CLI's model picker uses (`keyForModelId`), and must end in
+ *     `_API_KEY`. A name we cannot map is a name we do not invent: an
+ *     unrecognised provider leaves the file untouched rather than growing an
+ *     unrelated variable.
+ *   - Removing a key only touches the file if the file actually carries that
+ *     variable, so "Remove" on a provider the file never knew about does not
+ *     add a stray `OPENAI_API_KEY=` line to a hand-written file.
+ *   - A failure to mirror is REPORTED and swallowed. The key IS saved (the
+ *     encrypted store has it); only the cross-host copy failed, and refusing
+ *     the whole save over that would throw away the key the user just typed.
+ */
+
+/** Reserved namespaces (`__aegis`, `__quickLauncher`, …) are the store's own
+ *  bookkeeping, not providers — never a key variable. */
+const RESERVED_PREFIX = '__';
+
+/** Every provider key variable in this product family ends this way. */
+const KEY_VAR_SUFFIX = /_API_KEY$/;
+
+/**
+ * Write one provider key into the shared env file.
+ *
+ * @param {object} envFile  client/env-file.js (injected: this module must stay
+ *                          unit-testable without touching the real home dir)
+ * @param {string} provider provider id, e.g. 'openai'
+ * @param {string} key      the key; '' means "clear it"
+ * @param {object} [opts]   `onWarn(message)`, `envOpts` forwarded to env-file
+ *                          (its `{ file, env }` seam, used by tests)
+ * @returns {object|null}   env-file's own result, or null when nothing was
+ *                          mirrored (no mapping, reserved row, absent variable)
+ */
+function mirrorProviderKeyToEnvFile(envFile, provider, key, opts = {}) {
+  const warn = typeof opts.onWarn === 'function' ? opts.onWarn : () => {};
+  const envOpts = opts.envOpts || {};
+  if (!envFile || typeof envFile.setEnvValue !== 'function') return null;
+  if (typeof provider !== 'string' || !provider) return null;
+  if (provider.startsWith(RESERVED_PREFIX)) return null;
+
+  const name = typeof envFile.envVarFor === 'function' ? envFile.envVarFor(provider) : '';
+  if (!name || !KEY_VAR_SUFFIX.test(name)) return null;
+
+  try {
+    if (key) return envFile.setEnvValue(name, key, envOpts);
+    const status =
+      typeof envFile.keyStatus === 'function' ? envFile.keyStatus(name, envOpts) : null;
+    if (!status || !status.inFile) return null;
+    if (typeof envFile.clearEnvValue === 'function') {
+      return envFile.clearEnvValue(name, envOpts);
+    }
+    // An older vendored env-file without a remover. Writing an empty value is
+    // NOT a removal — `setEnvValue` refuses an empty value outright, so that
+    // call returned an error and left the stale line in place. Unset the live
+    // variable and say plainly that the file still carries it.
+    if (envOpts.env) delete envOpts.env[name];
+    else delete process.env[name];
+    warn(
+      `removed ${provider}'s key in the app, but ${name} is still in the shared env file — `
+      + 'this build has no clearEnvValue; delete the line by hand',
+    );
+    return null;
+  } catch (e) {
+    warn(`could not mirror ${provider}'s key into the shared env file: ${e && e.message}`);
+    return null;
+  }
+}
+
+/**
+ * Wrap a provider-settings store so every key saved or removed through it is
+ * also written to the shared env file.
+ *
+ * Wrapping the store (rather than each caller) is the whole point: the Settings
+ * pane, the welcome flow's provider rows and any future caller all funnel
+ * through `store.set` / `store.remove`, so there is exactly one place that can
+ * forget to mirror — and this is it.
+ *
+ * @param {object} store    a settings store (settings.get/set/remove/list)
+ * @param {object} envFile  client/env-file.js
+ * @param {object} [opts]   `onWarn`, `envOpts` (see above)
+ * @returns {object} the same store, wrapped
+ */
+function wrapProviderKeyMirror(store, envFile, opts = {}) {
+  if (!store || typeof store.set !== 'function') return store;
+  const mirror = (provider, key) => mirrorProviderKeyToEnvFile(envFile, provider, key, opts);
+
+  const rawSet = store.set.bind(store);
+  const rawRemove = typeof store.remove === 'function' ? store.remove.bind(store) : null;
+
+  store.set = (provider, cfg) => {
+    const res = rawSet(provider, cfg);
+    // A row with no key is a base-URL/local-daemon row: there is no secret to
+    // share, and mirroring would write an empty variable into a file every host
+    // sources. `cfg.key` undefined OR empty both mean "no key supplied"
+    // (a blank field in the pane means "keep the stored one").
+    if (cfg && typeof cfg.key === 'string' && cfg.key) mirror(provider, cfg.key);
+    return res;
+  };
+
+  if (rawRemove) {
+    store.remove = (provider) => {
+      const res = rawRemove(provider);
+      mirror(provider, '');
+      return res;
+    };
+  }
+  return store;
+}
+
+module.exports = { mirrorProviderKeyToEnvFile, wrapProviderKeyMirror };

package/main.js

@@ -2600,6 +2600,31 @@ function bootstrap() {
     dir: dataDir,
   });
 
+  // A provider key typed in the Settings pane used to reach ONLY this app's
+  // encrypted store, so `aegiscode` (the CLI) and the MCP plugin never saw it:
+  // same machine, same provider, key asked for twice, and a key entered here
+  // was gone from every other host on the next run. Mirror every key write into
+  // the shared `~/.aegiscode/.env` — the one file all four hosts read at
+  // start-up (loadEnvFile() above; cli/bin/aegiscode.js before the CLI runs) —
+  // so "add the key in the app" and "put it in ~/.aegiscode/.env" are the same
+  // instruction. The encrypted store stays this app's authority; the file is
+  // what makes the key exist for the others. The AEGIS *account* key is
+  // deliberately not mirrored: it is already shared via credentials.json, and a
+  // second copy is a second authority that can disagree (see the module's
+  // header). Wrapped before registerModelIpc below, so every IPC path uses the
+  // wrapped store.
+  try {
+    const { wrapProviderKeyMirror } = require('./lib/provider-key-mirror.js');
+    const onWarn = (m) => console.warn(`aegis: ${m}`);
+    wrapProviderKeyMirror(settings, envFile, { onWarn });
+    if (engine && engine.settings && engine.settings !== settings) {
+      wrapProviderKeyMirror(engine.settings, envFile, { onWarn });
+    }
+  } catch (e) {
+    // Never fatal: the store still works, only the cross-host copy is missing.
+    console.warn(`aegis: could not wire the shared env-file key mirror: ${e && e.message}`);
+  }
+
   // Persist the in-app AEGIS key in its own reserved namespace, encrypted —
   // never as a provider named 'aegis' (that coupling let the Settings pane's
   // "Remove" delete the AEGIS key; defect #1).
@@ -2610,6 +2635,10 @@ function bootstrap() {
   // `savedAt` stamps so whichever host wrote last is the key in force.
   const persistApiKey = (key) => {
     const result = settings.setAegisKey(key);
+    // NOT mirrored into ~/.aegiscode/.env on purpose — the line below already
+    // shares this key with every host (credentials.json, 0600, read by the CLI,
+    // the MCP plugin and this app). Two stores for one account key is two
+    // answers to "which key is in force"; see desktop/lib/provider-key-mirror.js.
     if (key) credentials.saveApiKey(key);
     else credentials.clearApiKey();
     return result;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.8",
-  "description": "Thin Electron host for AEGIS \u2014 a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
+  "version": "0.8.10",
+  "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",
     "email": "nborneklint@gmail.com"
@@ -32,7 +32,7 @@
     "demo": "node scripts/record-demo-gif.mjs",
     "dist": "npm run predist && electron-builder",
     "dist:dir": "npm run predist && electron-builder --dir",
-    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check lib/local/local.js && node --check lib/local/context.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check lib/avatar/tiers.js && node --check lib/avatar/xp.js && node --check lib/avatar/level.js && node --check lib/avatar/events.js && node --check lib/avatar/persona.js && node --check bin/aegis.js",
+    "check": "node --check main.js && node --check preload.js && node --check renderer/app.js && node --check renderer/quick.js && node --check renderer/budget.js && node --check renderer/usage.js && node --check renderer/stream-policy.js && node --check renderer/transcript-view.js && node --check renderer/diff.js && node --check renderer/diffview.js && node --check renderer/markdown.js && node --check renderer/vendor/aegis-highlight.js && node --check scripts/predist.mjs && node --check scripts/generate-icon.mjs && node --check scripts/bundle-fonts.mjs && node --check lib/local/local.js && node --check lib/local/context.js && node --check lib/local/engine.js && node --check lib/local/session-rounds.js && node --check lib/local/tools.js && node --check lib/local/prompt.js && node --check lib/local/shell.js && node --check lib/local/agents.js && node --check lib/local/queue.js && node --check lib/local/autonomous.js && node --check lib/settings.js && node --check lib/sync/sessions.js && node --check lib/sync/memory-queue.js && node --check lib/window-state.js && node --check lib/deep-link.js && node --check lib/quick-launcher.js && node --check lib/avatar/tiers.js && node --check lib/avatar/xp.js && node --check lib/avatar/level.js && node --check lib/avatar/events.js && node --check lib/avatar/persona.js && node --check bin/aegis.js",
     "test:shell": "node ../test/desktop-shell.mjs",
     "test:model": "node ../test/model-dispatch.mjs",
     "test:budget": "node ../test/budget.test.mjs",
@@ -52,7 +52,8 @@
     "test:avatar-level": "node test/avatar-level.test.mjs",
     "test:avatar-events": "node test/avatar-events.test.mjs",
     "test:avatar-tiers": "node test/avatar-tiers.test.mjs",
-    "test:avatar-persona": "node test/avatar-persona.test.mjs"
+    "test:avatar-persona": "node test/avatar-persona.test.mjs",
+    "test:renderer-fonts": "node test/renderer-fonts.test.mjs"
   },
   "dependencies": {
     "electron-updater": "^6.8.9"

package/renderer/app.js

@@ -2236,6 +2236,38 @@ function applyWelcomeConnect() {
   box.hidden = dismissed || keyConfigured === true || providerConfigured === true;
 }
 
+/**
+ * Land the user on the ONE provider row a just-picked byok model needs a key
+ * for — the per-selection counterpart to `welcomeByok()`'s whole-class reveal.
+ *
+ * Before this, picking an unconfigured row in the model dropdown (deliberately
+ * still offered — see `loadModels()`'s `needsProviderKey` hint, which engine.js
+ * documents as "the catalog answers with no key at all, hiding the row would
+ * hide the answer to which key to get") did nothing: the class-level hint only
+ * fires when NO provider is configured, so a machine with one working key and
+ * nine unconfigured ones got no help picking a row among the nine — just a
+ * turn that fails downstream at the relay with no picker-side context. This
+ * is the CLI's `collectKeyFor` (chatflow.js), for this host: same question
+ * (does this row need a key this machine does not have), answered by pointing
+ * at where to type it rather than reading it inline, because that is how this
+ * app's Settings pane already works for every other key.
+ *
+ * `dataset.provider` on a byok row is `byok:<id>` (see the Provider settings
+ * build loop above), not the bare provider id `modelMeta` rows carry.
+ */
+function focusProviderKeyRow(provider) {
+  if (!els.settingsList || !provider) return;
+  const row = els.settingsList.querySelector(
+    `.setting-row[data-provider="byok:${provider}"] input[type="password"]`
+  );
+  revealSidebarCard(els.settingsList);
+  if (row) row.focus();
+  if (els.modelHint) {
+    const base = els.modelHint.textContent.replace(/ — no .* key saved; add it below\.$/, '');
+    els.modelHint.textContent = `${base} — no ${provider} key saved; add it below.`;
+  }
+}
+
 /** Scroll a sidebar card into view and mark it, so a welcome click has a
  *  visible landing spot. The sidebar is a plain scroll container, so this is
  *  the whole of the "open settings" affordance. */
@@ -4088,13 +4120,20 @@ async function init() {
   });
 
   els.modelSelect.addEventListener('change', () => {
+    const meta = modelMeta.get(els.modelSelect.value);
     // Display-only (see budget.js): the model's own advertised output limit,
     // which is never the number this app puts on a request.
-    const ceiling = maxTokensCeiling(modelMeta.get(els.modelSelect.value));
+    const ceiling = maxTokensCeiling(meta);
     const base = els.modelHint.textContent.replace(/ · max output: [\d,]+$/, '');
     els.modelHint.textContent =
       ceiling < FLAT_CEILING ? `${base} · max output: ${ceiling.toLocaleString()}` : base;
     updateBudgetControls(els.classSelect.value);
+    // Picking a byok row this machine holds no key for: point at where the
+    // key goes, right now, instead of a turn that fails at the relay with no
+    // picker-side context. See focusProviderKeyRow's doc for why this exists.
+    if (els.classSelect.value === 'byok' && meta && meta.provider && meta.configured === false) {
+      focusProviderKeyRow(meta.provider);
+    }
   });
 
   // The typed model tag IS the selection while the box is visible (see

package/renderer/fonts/NOTICE.md

@@ -0,0 +1,57 @@
+# Vendored webfonts
+
+Committed verbatim, like `renderer/vendor/` — no CDN and no network at run time.
+Loaded by `renderer/index.html` and `renderer/quick.html` under a
+`font-src 'self'` CSP.
+
+Generated by `desktop/scripts/bundle-fonts.mjs`; do not edit the `.woff2` files
+or `fonts.css` by hand. To refresh the set:
+
+    node desktop/scripts/bundle-fonts.mjs          # rewrite
+    node desktop/scripts/bundle-fonts.mjs --check   # verify against the CDN (needs network)
+
+All three families are licensed under the **SIL Open Font License 1.1**, which
+permits bundling and redistribution. The copyright lines Google Fonts serves
+with them:
+
+- `Syne` — © 2018 The Syne Project Authors
+  (<https://github.com/bonjour-monde/fonderie>), OFL 1.1. Display face used for
+  the wordmark, headings and UI chrome (`--font-display`).
+- `DM Mono` — © 2020 The DM Mono Project Authors
+  (<https://github.com/googlefonts/dm-mono>), OFL 1.1. Monospace face for code,
+  diffs and metrics (`--font-mono`).
+- `Ubuntu` — © 2010-2011 Canonical Ltd.
+  (<https://github.com/googlefonts/UbuntuFont>), OFL 1.1. Chat body text
+  (`--font-chat`).
+
+The OFL is a per-file licence; the full text ships with each upstream project at
+the links above and is not duplicated here.
+
+## Why these are vendored rather than fetched
+
+The `<link>` to `fonts.googleapis.com` that used to sit in `index.html` made the
+app's typography depend on the network and on the host. Online it drew the three
+faces above. Offline — or behind a blocker, or on a machine whose font resolver
+disagreed — the fallback chain `'Segoe UI', system-ui, sans-serif` resolved to a
+*different* font on each platform: SF Pro on macOS, Segoe UI on Windows, whatever
+fontconfig offered on Linux. Three visibly different products from one stylesheet.
+
+Serving the same bytes from the app directory makes the rendering identical on
+every platform and lets the CSP drop its external origins entirely. This is the
+desktop counterpart of the terminal-side policy in `cli/src/caps.js`, which
+likewise refuses to let the host change what is drawn.
+
+Note the honest limits. These three families cover latin, latin-ext, cyrillic,
+cyrillic-ext, greek and greek-ext — and **not** vietnamese: Google Fonts serves
+no vietnamese subset for Syne, DM Mono or Ubuntu, and `latin-ext` stops at
+U+1E9F and resumes at U+1EF2, so the core Vietnamese diacritic block
+U+1EA0–U+1EF1 falls through to a host font. `desktop/scripts/bundle-fonts.mjs`
+records the same gap, and `desktop/test/renderer-fonts.test.mjs` asserts it, so
+the day Google adds the subset the test fails loudly instead of the gap
+silently persisting.
+
+Glyphs outside the covered set — CJK, and colour emoji in particular — are also
+still drawn by a host font and remain platform-specific. `Apple Color Emoji`,
+`Segoe UI Emoji` and `Noto Color Emoji` are not interchangeable and are not
+redistributable here, so that divergence cannot be removed by bundling; it is
+inherent to the platform.