aegis-desktop 0.8.9 → 0.8.10

package/lib/avatar/turn.js

@@ -107,7 +107,7 @@ function recallPolicy(caps, opts = {}) {
  *  - the pooled brain tier (`nexus-brain` and the `-smart`/`-neo` spellings the
  *    server serves as aliases), which is not one model at all: the server fans
  *    the turn out to reasoning workers plus a synthesis pass. That is the one
- *    id the Aegis Cloud class offers (engine.js filterAegisCatalog), so an
+ *    id the Aegis Cloud class offers (engine.js offerableCatalog), so an
  *    Aegis Cloud turn satisfies the floor by construction.
  */
 const REASONING_MODEL_RE = /^(?:deepseek-(?:v4(?:\.\d+)?-(?:flash|pro)|flash|pro|reasoner)|(?:nexus|aegis)-brain(?:-(?:smart|neo))?)$/;

package/lib/local/autonomous.js

@@ -84,7 +84,7 @@ function writtenPath(tool) {
  * The default AEGIS Cloud model for autonomous work: the pooled brain, which
  * is the tier the server can fan out to multiple reasoning workers and
  * synthesise. `nexus-brain` is the canonical id the catalog itself prefers
- * (the other tier spellings are aliases of it — see filterAegisCatalog in
+ * (the other tier spellings are aliases of it — see offerableCatalog in
  * engine.js).
  *
  * The model id is only the tier. It is NOT what makes an autonomous task
@@ -108,7 +108,7 @@ const DEFAULT_MODEL = 'nexus-brain';
  * the pool auto-route across whichever providers hold a live key.
  *
  * The accept-list is therefore the pooled-brain tier family — the one entry
- * engine.js's filterAegisCatalog offers for the Aegis Cloud class, plus the
+ * engine.js's offerableCatalog offers for the Aegis Cloud class, plus the
  * `-smart`/`-neo` tier spellings the server still serves as aliases of it. This
  * mirrors selectBrainEntry() there rather than re-deriving "anything starting
  * with nexus-": `nexus-fast` is not a tier the catalog has ever served, and

package/lib/local/engine.js

@@ -104,6 +104,35 @@ function requireSharedBrain() {
   throw last;
 }
 
+/**
+ * The shared BYOK model additions (`client/byok-catalog.js`), resolved exactly
+ * the two ways above and for the same reason: the CLI vendors THIS file
+ * (cli/scripts/predist.mjs) and requires the same module through
+ * `cli/src/sharedpaths.js`, so a copy-per-host here is how the terminal and the
+ * window would come to offer one account two different provider model lists —
+ * the defect class this repo keeps paying for.
+ *
+ * The module is pure and returns a NEW array, so a caller may apply it to a
+ * payload it did not build. It never invents a provider: a provider absent from
+ * the server's catalog stays absent, because a row that accepts a vendor key
+ * must correspond to a slug the relay actually takes.
+ */
+function requireSharedByokCatalog() {
+  const candidates = [
+    () => require('../../../client/byok-catalog.js'),
+    () => require('../../vendor/byok-catalog.js'),
+  ];
+  let last = null;
+  for (const load of candidates) {
+    try {
+      return load();
+    } catch (err) {
+      last = err;
+    }
+  }
+  throw last;
+}
+
 /**
  * How long a turn waits for the working-tree lock before running anyway.
  *
@@ -272,27 +301,37 @@ function normalizeCatalog(models) {
 }
 
 /**
- * The Aegis Cloud catalog (`/api/v1/models`) lists every backend the pool can
- * reach: per-provider ids (`openai`, `anthropic`, `groq`, `gemini`, ...) and
- * six pooled-brain tier ids (`{aegis,nexus}-brain[-smart|-neo]`) that all run
- * the same worker pool on the same backend model. None of that is a human's
- * model choice — which providers currently hold a valid key is an ops detail
- * (today: deepseek/anthropic/groq; openai and gemini drift in and out), and
- * surfacing it invites picking a provider that happens to be dead right now.
- * The pool already auto-routes across whichever providers are live, so the
- * desktop dropdown offers exactly one entry for the "aegis" class: the
- * collapsed "Nexus" brain — never the raw provider list.
+ * The Aegis Cloud (pooled) dropdown offers Nexus, and only Nexus.
+ *
+ * The catalog (`/api/v1/models`) lists per-provider ids (`deepseek`,
+ * `anthropic`, `groq`, `openai`, ...) alongside five pooled-brain tier
+ * spellings (`{aegis,nexus}-brain[-smart|-neo]`) that all route the same
+ * worker pool. This host briefly offered the full list — the per-provider ids
+ * included — on the theory that a funded account should be able to pin the
+ * exact model it pays for. Niklas's explicit instruction is narrower: AEGIS
+ * Cloud offers Nexus only, no per-provider pin, so this is back on
+ * `filterAegisCatalog` — the shared rule's single-row collapse.
  *
- * The selection rule itself now lives in `client/brain-catalog.js`, shared with
- * the CLI: this host and the terminal were offering the same account two
- * different model lists (one collapsed entry vs. every distinct provider id),
- * and two copies of the rule is precisely how that drift happened. Resolved the
- * two ways this repo resolves every shared module — repo-relative in a
- * checkout, and this app's staged vendor/ tree — with the selection itself
- * unchanged.
+ * The rule itself lives in `client/brain-catalog.js`, shared with the CLI, so
+ * there is exactly one copy of it: two copies is how this host and the
+ * terminal previously came to offer the same account two different model
+ * lists. `filterAegisCatalog` collapses the five brain-tier spellings to the
+ * one row labelled Nexus; a payload with no brain tier (the BYOK listing) is
+ * unaffected — see the desktop's byok branch below, which still offers every
+ * provider id the account holds a key for. Resolved the two ways this repo
+ * resolves every shared module — repo-relative in a checkout, and this app's
+ * staged vendor/ tree.
  */
 const { filterAegisCatalog } = requireSharedBrain();
 
+/**
+ * The BYOK additions, applied to the server's provider catalog below. Same
+ * one-copy rule as the brain rule above: the terminal requires this same module
+ * (cli/src/commands.js, through sharedpaths.js), so neither host can offer a
+ * provider row the other does not.
+ */
+const { withByokAdditions } = requireSharedByokCatalog();
+
 // ── Agent-loop helpers ──────────────────────────────────────────────────────
 
 /** Parse a model-supplied argument blob (string or already-parsed object). */
@@ -796,7 +835,14 @@ function createLocalEngine({
       let fee = null;
       try {
         const data = await aegis.byokProviders();
-        providers = (data && data.providers) || [];
+        // The server's catalog, plus the ids it does not name but the vendor
+        // serves and the relay will forward (`client/byok-catalog.js`, shared
+        // with the CLI so both hosts offer the same rows). Applied HERE, at the
+        // single point where the payload enters this engine, so every consumer
+        // of `providers` — the model list built just below, the renderer's
+        // per-provider Settings rows, and the CLI's own `/byok` listing when it
+        // runs on this engine — sees one list instead of three opinions.
+        providers = withByokAdditions((data && data.providers) || []);
         // The handling fee AEGIS adds on top of the caller's vendor bill. It is
         // the server's own published rate (services/pricing.price_byok_call) and
         // is passed through untouched — never re-derived here, because a client

package/lib/provider-key-mirror.js

@@ -0,0 +1,136 @@
+'use strict';
+
+/**
+ * provider-key-mirror.js — make a provider key saved in the DESKTOP visible to
+ * every other host on the same machine.
+ *
+ * The desktop's Provider settings rows persist into its own encrypted settings
+ * store (`desktop/lib/settings.js` -> `settings.json` under the app's userData
+ * dir). That store is private to this app: `aegiscode` (the CLI) and the MCP
+ * plugin never read it, and they cannot — it is an encrypted Electron store in
+ * another process's data directory. So a key added in the desktop was invisible
+ * to the CLI on the next run: same machine, same provider, key asked for twice.
+ *
+ * The fix is not to teach every host to open an encrypted Electron store. It is
+ * to write the key where all four hosts already look at start-up —
+ * `~/.aegiscode/.env`, through the ONE shared writer (`client/env-file.js`
+ * `setEnvValue`). After this, "add your provider key in the app" and "put it in
+ * ~/.aegiscode/.env" are the same instruction, which is the point.
+ *
+ * Policy, deliberately narrow:
+ *
+ *   - PROVIDER keys only. The AEGIS *account* key is already shared through
+ *     `credentials.json` (`client/credentials.js`), which the CLI, the MCP
+ *     plugin and the desktop all read. A second copy in the env file would be a
+ *     second authority that can silently disagree with the first — exactly the
+ *     "which one won?" failure env-file.js refuses for duplicate lines. So
+ *     `setAegisKey()` is deliberately NOT wrapped.
+ *   - The variable name comes from `envFile.envVarFor(provider)`, the same
+ *     mapping the CLI's model picker uses (`keyForModelId`), and must end in
+ *     `_API_KEY`. A name we cannot map is a name we do not invent: an
+ *     unrecognised provider leaves the file untouched rather than growing an
+ *     unrelated variable.
+ *   - Removing a key only touches the file if the file actually carries that
+ *     variable, so "Remove" on a provider the file never knew about does not
+ *     add a stray `OPENAI_API_KEY=` line to a hand-written file.
+ *   - A failure to mirror is REPORTED and swallowed. The key IS saved (the
+ *     encrypted store has it); only the cross-host copy failed, and refusing
+ *     the whole save over that would throw away the key the user just typed.
+ */
+
+/** Reserved namespaces (`__aegis`, `__quickLauncher`, …) are the store's own
+ *  bookkeeping, not providers — never a key variable. */
+const RESERVED_PREFIX = '__';
+
+/** Every provider key variable in this product family ends this way. */
+const KEY_VAR_SUFFIX = /_API_KEY$/;
+
+/**
+ * Write one provider key into the shared env file.
+ *
+ * @param {object} envFile  client/env-file.js (injected: this module must stay
+ *                          unit-testable without touching the real home dir)
+ * @param {string} provider provider id, e.g. 'openai'
+ * @param {string} key      the key; '' means "clear it"
+ * @param {object} [opts]   `onWarn(message)`, `envOpts` forwarded to env-file
+ *                          (its `{ file, env }` seam, used by tests)
+ * @returns {object|null}   env-file's own result, or null when nothing was
+ *                          mirrored (no mapping, reserved row, absent variable)
+ */
+function mirrorProviderKeyToEnvFile(envFile, provider, key, opts = {}) {
+  const warn = typeof opts.onWarn === 'function' ? opts.onWarn : () => {};
+  const envOpts = opts.envOpts || {};
+  if (!envFile || typeof envFile.setEnvValue !== 'function') return null;
+  if (typeof provider !== 'string' || !provider) return null;
+  if (provider.startsWith(RESERVED_PREFIX)) return null;
+
+  const name = typeof envFile.envVarFor === 'function' ? envFile.envVarFor(provider) : '';
+  if (!name || !KEY_VAR_SUFFIX.test(name)) return null;
+
+  try {
+    if (key) return envFile.setEnvValue(name, key, envOpts);
+    const status =
+      typeof envFile.keyStatus === 'function' ? envFile.keyStatus(name, envOpts) : null;
+    if (!status || !status.inFile) return null;
+    if (typeof envFile.clearEnvValue === 'function') {
+      return envFile.clearEnvValue(name, envOpts);
+    }
+    // An older vendored env-file without a remover. Writing an empty value is
+    // NOT a removal — `setEnvValue` refuses an empty value outright, so that
+    // call returned an error and left the stale line in place. Unset the live
+    // variable and say plainly that the file still carries it.
+    if (envOpts.env) delete envOpts.env[name];
+    else delete process.env[name];
+    warn(
+      `removed ${provider}'s key in the app, but ${name} is still in the shared env file — `
+      + 'this build has no clearEnvValue; delete the line by hand',
+    );
+    return null;
+  } catch (e) {
+    warn(`could not mirror ${provider}'s key into the shared env file: ${e && e.message}`);
+    return null;
+  }
+}
+
+/**
+ * Wrap a provider-settings store so every key saved or removed through it is
+ * also written to the shared env file.
+ *
+ * Wrapping the store (rather than each caller) is the whole point: the Settings
+ * pane, the welcome flow's provider rows and any future caller all funnel
+ * through `store.set` / `store.remove`, so there is exactly one place that can
+ * forget to mirror — and this is it.
+ *
+ * @param {object} store    a settings store (settings.get/set/remove/list)
+ * @param {object} envFile  client/env-file.js
+ * @param {object} [opts]   `onWarn`, `envOpts` (see above)
+ * @returns {object} the same store, wrapped
+ */
+function wrapProviderKeyMirror(store, envFile, opts = {}) {
+  if (!store || typeof store.set !== 'function') return store;
+  const mirror = (provider, key) => mirrorProviderKeyToEnvFile(envFile, provider, key, opts);
+
+  const rawSet = store.set.bind(store);
+  const rawRemove = typeof store.remove === 'function' ? store.remove.bind(store) : null;
+
+  store.set = (provider, cfg) => {
+    const res = rawSet(provider, cfg);
+    // A row with no key is a base-URL/local-daemon row: there is no secret to
+    // share, and mirroring would write an empty variable into a file every host
+    // sources. `cfg.key` undefined OR empty both mean "no key supplied"
+    // (a blank field in the pane means "keep the stored one").
+    if (cfg && typeof cfg.key === 'string' && cfg.key) mirror(provider, cfg.key);
+    return res;
+  };
+
+  if (rawRemove) {
+    store.remove = (provider) => {
+      const res = rawRemove(provider);
+      mirror(provider, '');
+      return res;
+    };
+  }
+  return store;
+}
+
+module.exports = { mirrorProviderKeyToEnvFile, wrapProviderKeyMirror };

package/main.js

@@ -2600,6 +2600,31 @@ function bootstrap() {
     dir: dataDir,
   });
 
+  // A provider key typed in the Settings pane used to reach ONLY this app's
+  // encrypted store, so `aegiscode` (the CLI) and the MCP plugin never saw it:
+  // same machine, same provider, key asked for twice, and a key entered here
+  // was gone from every other host on the next run. Mirror every key write into
+  // the shared `~/.aegiscode/.env` — the one file all four hosts read at
+  // start-up (loadEnvFile() above; cli/bin/aegiscode.js before the CLI runs) —
+  // so "add the key in the app" and "put it in ~/.aegiscode/.env" are the same
+  // instruction. The encrypted store stays this app's authority; the file is
+  // what makes the key exist for the others. The AEGIS *account* key is
+  // deliberately not mirrored: it is already shared via credentials.json, and a
+  // second copy is a second authority that can disagree (see the module's
+  // header). Wrapped before registerModelIpc below, so every IPC path uses the
+  // wrapped store.
+  try {
+    const { wrapProviderKeyMirror } = require('./lib/provider-key-mirror.js');
+    const onWarn = (m) => console.warn(`aegis: ${m}`);
+    wrapProviderKeyMirror(settings, envFile, { onWarn });
+    if (engine && engine.settings && engine.settings !== settings) {
+      wrapProviderKeyMirror(engine.settings, envFile, { onWarn });
+    }
+  } catch (e) {
+    // Never fatal: the store still works, only the cross-host copy is missing.
+    console.warn(`aegis: could not wire the shared env-file key mirror: ${e && e.message}`);
+  }
+
   // Persist the in-app AEGIS key in its own reserved namespace, encrypted —
   // never as a provider named 'aegis' (that coupling let the Settings pane's
   // "Remove" delete the AEGIS key; defect #1).
@@ -2610,6 +2635,10 @@ function bootstrap() {
   // `savedAt` stamps so whichever host wrote last is the key in force.
   const persistApiKey = (key) => {
     const result = settings.setAegisKey(key);
+    // NOT mirrored into ~/.aegiscode/.env on purpose — the line below already
+    // shares this key with every host (credentials.json, 0600, read by the CLI,
+    // the MCP plugin and this app). Two stores for one account key is two
+    // answers to "which key is in force"; see desktop/lib/provider-key-mirror.js.
     if (key) credentials.saveApiKey(key);
     else credentials.clearApiKey();
     return result;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -2236,6 +2236,38 @@ function applyWelcomeConnect() {
   box.hidden = dismissed || keyConfigured === true || providerConfigured === true;
 }
 
+/**
+ * Land the user on the ONE provider row a just-picked byok model needs a key
+ * for — the per-selection counterpart to `welcomeByok()`'s whole-class reveal.
+ *
+ * Before this, picking an unconfigured row in the model dropdown (deliberately
+ * still offered — see `loadModels()`'s `needsProviderKey` hint, which engine.js
+ * documents as "the catalog answers with no key at all, hiding the row would
+ * hide the answer to which key to get") did nothing: the class-level hint only
+ * fires when NO provider is configured, so a machine with one working key and
+ * nine unconfigured ones got no help picking a row among the nine — just a
+ * turn that fails downstream at the relay with no picker-side context. This
+ * is the CLI's `collectKeyFor` (chatflow.js), for this host: same question
+ * (does this row need a key this machine does not have), answered by pointing
+ * at where to type it rather than reading it inline, because that is how this
+ * app's Settings pane already works for every other key.
+ *
+ * `dataset.provider` on a byok row is `byok:<id>` (see the Provider settings
+ * build loop above), not the bare provider id `modelMeta` rows carry.
+ */
+function focusProviderKeyRow(provider) {
+  if (!els.settingsList || !provider) return;
+  const row = els.settingsList.querySelector(
+    `.setting-row[data-provider="byok:${provider}"] input[type="password"]`
+  );
+  revealSidebarCard(els.settingsList);
+  if (row) row.focus();
+  if (els.modelHint) {
+    const base = els.modelHint.textContent.replace(/ — no .* key saved; add it below\.$/, '');
+    els.modelHint.textContent = `${base} — no ${provider} key saved; add it below.`;
+  }
+}
+
 /** Scroll a sidebar card into view and mark it, so a welcome click has a
  *  visible landing spot. The sidebar is a plain scroll container, so this is
  *  the whole of the "open settings" affordance. */
@@ -4088,13 +4120,20 @@ async function init() {
   });
 
   els.modelSelect.addEventListener('change', () => {
+    const meta = modelMeta.get(els.modelSelect.value);
     // Display-only (see budget.js): the model's own advertised output limit,
     // which is never the number this app puts on a request.
-    const ceiling = maxTokensCeiling(modelMeta.get(els.modelSelect.value));
+    const ceiling = maxTokensCeiling(meta);
     const base = els.modelHint.textContent.replace(/ · max output: [\d,]+$/, '');
     els.modelHint.textContent =
       ceiling < FLAT_CEILING ? `${base} · max output: ${ceiling.toLocaleString()}` : base;
     updateBudgetControls(els.classSelect.value);
+    // Picking a byok row this machine holds no key for: point at where the
+    // key goes, right now, instead of a turn that fails at the relay with no
+    // picker-side context. See focusProviderKeyRow's doc for why this exists.
+    if (els.classSelect.value === 'byok' && meta && meta.provider && meta.configured === false) {
+      focusProviderKeyRow(meta.provider);
+    }
   });
 
   // The typed model tag IS the selection while the box is visible (see

package/vendor/brain-catalog.js

@@ -105,9 +105,84 @@ function filterAegisCatalog(models) {
   return [{ ...rest, label: NEXUS_LABEL }];
 }
 
+/**
+ * The Aegis-class catalog as a host must OFFER it: the FULL list the server
+ * advertises — the pooled brain first, under its one name, then every other
+ * model the account can pin.
+ *
+ * `filterAegisCatalog` above collapses the class to the single brain row, and
+ * that was shipped: the desktop's dropdown and the terminal's alt+p picker both
+ * showed one entry, "Nexus", because collapsing was implemented to end a real
+ * disagreement (seven rows in one host, one in the other). Ending the
+ * disagreement by removing the choice was the wrong fix, and a user with a
+ * funded account could see no way to pin the deepseek or anthropic models the
+ * same catalogue advertises — the model was chosen for them, with no lever.
+ *
+ * So this is the rule both hosts now share: offer everything, collapse only the
+ * *aliases*.
+ *
+ *   - The brain tier stays ONE row, labelled `NEXUS_LABEL`, first. The server
+ *     lists it under five spellings (`nexus-brain` canonical, `aegis-brain` and
+ *     the `-smart`/`-neo` tiers as `hidden: true, alias_of: "nexus-brain"`);
+ *     those name one route, so they are folded into that one row rather than
+ *     painted as five models — which is what `filterAegisCatalog` was for, and
+ *     that half of it is kept.
+ *   - Every other entry is offered as the server advertises it, INCLUDING
+ *     entries the payload marks `hidden`, because "hidden" in this payload means
+ *     "not the canonical spelling", not "do not offer".
+ *   - An entry that is an alias OF another entry in the same payload is dropped
+ *     only when its target is present — a pure duplicate row that would pin the
+ *     id it points at, which is the `models.js` defect the CLI already guarded
+ *     against. When the payload is nothing but aliases, they are all offered:
+ *     an empty list is not a better answer than a list of aliases.
+ *
+ * Pure, like the rest of this file, and shape-tolerant (raw relay payload or
+ * the CLI's normalised entries) so both hosts can call it with what they hold.
+ * Returns `[]` for an empty payload; never invents an entry.
+ *
+ * @param {Array<object>} models the server's catalog (any shape).
+ * @returns {Array<object>} the entries to show, brain first (a new array).
+ */
+function offerableCatalog(models) {
+  const list = Array.isArray(models) ? models.filter(Boolean) : [];
+  if (!list.length) return [];
+
+  const brain = selectBrainEntry(list);
+  const out = [];
+  const seen = new Set();
+
+  if (brain) {
+    // Same de-aliasing as filterAegisCatalog: this row IS the selection, so no
+    // renderer may filter it back out as a hidden alias.
+    const { hidden, alias_of, aliasOf, ...rest } = brain;
+    out.push({ ...rest, label: NEXUS_LABEL });
+    for (const id of NEXUS_BRAIN_IDS) seen.add(id);
+    if (typeof brain.id === 'string') seen.add(brain.id);
+  }
+
+  const ids = new Set(
+    list.map((m) => (typeof m.id === 'string' ? m.id.trim() : '')).filter(Boolean)
+  );
+  const aliasTargets = new Set(
+    list.map((m) => aliasOfEntry(m)).filter((t) => t && ids.has(t))
+  );
+
+  for (const m of list) {
+    const id = typeof m.id === 'string' ? m.id.trim() : '';
+    if (!id || seen.has(id)) continue;
+    // A row whose target is present is a duplicate pin, not a second model.
+    // Dropped here rather than per host, so the two hosts cannot disagree.
+    if (aliasOfEntry(m) && aliasTargets.has(aliasOfEntry(m))) continue;
+    seen.add(id);
+    out.push(m);
+  }
+  return out;
+}
+
 module.exports = {
   NEXUS_BRAIN_IDS,
   NEXUS_LABEL,
   selectBrainEntry,
   filterAegisCatalog,
+  offerableCatalog,
 };

package/vendor/byok-catalog.js

@@ -0,0 +1,144 @@
+'use strict';
+
+/**
+ * BYOK model additions — the models a host OFFERS for a provider that the
+ * server's own catalog does not list.
+ *
+ * ── why a client-side addition is legitimate here, and only here ────────────
+ *
+ * For the POOLED class it would not be. `client/brain-catalog.js` exists
+ * precisely because a host may not invent an id: the pool can only address what
+ * it advertises, so an id a client made up would pin, look accepted, and 404 on
+ * the first turn. `/api/v1/models` is the whole list, and the rule is "offer
+ * what the server sends".
+ *
+ * BYOK is the opposite shape, and the server says so itself
+ * (services/byok_service.py, `byok_provider_catalog`): "the pooled route cannot
+ * address it, but BYOK relays whatever model the caller names, so it stays
+ * usable and stays listed". The relay is a stateless pass-through — the
+ * caller's own vendor key authenticates upstream, and AEGIS forwards the model
+ * string it was given. So for a provider the account holds a key for, an id the
+ * *vendor* serves is callable whether or not AEGIS's catalog happens to name
+ * it. That is the whole reason this file is allowed to exist.
+ *
+ * ── what was actually missing ──────────────────────────────────────────────
+ *
+ * The server derives each provider's `models` from MODEL_CATALOG, and for
+ * `deepseek` that catalog holds one descriptor (`default_model
+ * "deepseek-v4-flash"`, services/nexus_provider/catalog.py). Verified live
+ * 2026-09-18: `GET https://aegiscloud.org/api/v1/byok/providers` answers
+ * `deepseek` with `models: ["deepseek-v4-flash"]` and nothing else.
+ *
+ * So a user who brought a DeepSeek key saw exactly one pinnable model, and the
+ * 4.1 Flash — `deepseek-flash`, the spelling whose rate row, reasoning-token
+ * budget and effort rung this repo ALREADY carries (desktop/renderer/
+ * budget.js, desktop/lib/local/engine.js DEEPSEEK_REASONING_MODEL_RE, and the
+ * rate table in desktop/renderer/usage.js: "deepseek-flash, i.e. Flash 4.1")
+ * — was unreachable from the picker, with no hint that the key they had just
+ * pasted could call it.
+ *
+ * ── the rules this module keeps ────────────────────────────────────────────
+ *
+ *   - ONE spelling per route. `deepseek-v4.1-flash` is the legacy alias the
+ *     same regexes accept; listing both would paint two rows that pin one
+ *     model, which is the "five spellings of one brain" defect the sibling
+ *     brain-catalog module exists to end. The canonical 4.1 id is
+ *     `deepseek-flash`, so that is the one added.
+ *   - NEVER invent a provider. Only a provider the payload already lists is
+ *     augmented. A provider row is a slot that accepts a vendor key; a row a
+ *     client fabricated would invite a key for a slug the relay may not accept,
+ *     and the failure would land on the user's first turn.
+ *   - Idempotent and non-mutating. A payload that already carries the id comes
+ *     back with the same provider objects untouched, so this is safe to apply
+ *     twice (a caller that adds at fetch time and again before rendering cannot
+ *     double-list) and safe to apply to a shared payload.
+ *   - The server's order is preserved and additions are APPENDED, so the
+ *     server's `default_model` keeps its first position — the default is what a
+ *     bare provider id runs, and a client that reordered it would silently
+ *     change which model a user gets for typing nothing.
+ *
+ * Pure: no I/O, no node builtins, no dependencies — requireable from a
+ * renderer, the CLI start-up path, the desktop main process, or an MCP host.
+ * Shared by the CLI and the desktop through one file for the same reason
+ * brain-catalog.js is: two copies is how those two hosts came to show one
+ * account two different model lists.
+ */
+
+/**
+ * provider id → extra models to offer, in the order to append them.
+ *
+ * Frozen, and deliberately tiny: every entry here is a claim that the vendor
+ * serves an id the AEGIS catalog does not advertise. The durable fix for any of
+ * them is the server's MODEL_CATALOG (aegis1 services/nexus_provider/
+ * catalog.py) — this map is what keeps the two clients useful until that
+ * lands, and an entry must be deleted once the server lists the id itself
+ * (`withByokAdditions` then no longer reports it as an addition).
+ */
+const BYOK_MODEL_ADDITIONS = Object.freeze({
+  // DeepSeek's 4.1 Flash. `deepseek-flash` is the spelling DeepSeek's own
+  // current API uses and the one this repo's rate table, token-budget and
+  // reasoning-model regexes all already key off; `deepseek-v4.1-flash` is the
+  // retired alias for the same route and is NOT listed separately.
+  deepseek: Object.freeze(['deepseek-flash']),
+});
+
+/** The extras to offer for one provider id (an empty array when there are none). */
+function addedModelsFor(providerId) {
+  const id = typeof providerId === 'string' ? providerId.trim() : '';
+  const extra = id ? BYOK_MODEL_ADDITIONS[id] : null;
+  return Array.isArray(extra) ? extra.slice() : [];
+}
+
+/** The model ids an entry names, tolerating the server's two shapes. */
+function modelIdsOf(provider) {
+  return (Array.isArray(provider && provider.models) ? provider.models : [])
+    .map((m) => (typeof m === 'string' ? m : m && m.id))
+    .map((m) => (typeof m === 'string' ? m.trim() : ''))
+    .filter(Boolean);
+}
+
+/**
+ * The server's BYOK provider catalog with the additions above applied.
+ *
+ * @param {Array<object>|object} providers the `providers` array from
+ *   `GET /api/v1/byok/providers`, or the whole `{providers: [...]}` payload.
+ * @returns {Array<object>} a new array; provider objects are shared unless the
+ *   row actually gained a model, and an empty/absent payload returns `[]`
+ *   rather than a fabricated catalog.
+ */
+function withByokAdditions(providers) {
+  const raw = Array.isArray(providers)
+    ? providers
+    : Array.isArray(providers && providers.providers)
+      ? providers.providers
+      : null;
+  if (!raw) return [];
+
+  const out = [];
+  for (const p of raw) {
+    if (!p || typeof p !== 'object') continue;
+    const id = typeof p.id === 'string' ? p.id.trim() : '';
+    const extra = id ? BYOK_MODEL_ADDITIONS[id] : null;
+    if (!Array.isArray(extra) || !extra.length) {
+      out.push(p);
+      continue;
+    }
+    const have = new Set(modelIdsOf(p));
+    const missing = extra.filter((m) => !have.has(m));
+    // Nothing to add: hand back the SAME object, so an already-complete payload
+    // is byte-identical after this pass and callers cannot tell it ran.
+    if (!missing.length) {
+      out.push(p);
+      continue;
+    }
+    const models = Array.isArray(p.models) ? p.models : [];
+    out.push({ ...p, models: [...models, ...missing] });
+  }
+  return out;
+}
+
+module.exports = {
+  BYOK_MODEL_ADDITIONS,
+  addedModelsFor,
+  withByokAdditions,
+};

package/vendor/env-file.js

@@ -1,9 +1,8 @@
 'use strict';
 
 /**
- * The shared `~/.aegiscode/.env` loader.
- *
- * One file holding every key this product family can use, for every host:
+ * The shared `~/.aegiscode/.env` store — the one file holding every key this
+ * product family can use, for every host:
  *
  *     AEGIS_API_KEY=aegis_…
  *     OPENAI_API_KEY=sk-…
@@ -18,14 +17,39 @@
  * needs no other change in either, because `AEGIS_API_KEY` is already the FIRST
  * entry in `client/credentials.js`'s documented resolution order.
  *
- * Two rules this module deliberately obeys:
+ * READING still obeys two rules this module started with:
  *
  *   1. A variable already present in the environment is never overwritten. The
  *      file is a convenience for the common case, not a way for a stale file to
  *      shadow an explicit `AEGIS_API_KEY=… aegiscode` in CI.
- *   2. It reads only. Nothing here writes a secret, so the 0600 store remains
- *      the one thing this repo creates; if the file the user made is readable
- *      by other accounts we say so rather than fixing it silently.
+ *   2. A load never rewrites anything. If the file the user made is readable by
+ *      other accounts we say so rather than fixing it silently.
+ *
+ * WRITING was added later, because the file being read-only was the reason the
+ * key a user typed at the model picker did not survive the session: the only
+ * place a host could put it was its own encrypted store, so the CLI and the
+ * desktop each held a private key for the same provider and the user had to
+ * enter it twice. The demand is one key, entered once at the model picker,
+ * stored where BOTH hosts already look. So `setEnvValue` is the single writer:
+ *
+ *   - the variable name is validated (`/^[A-Za-z_][A-Za-z0-9_]*$/`) and the
+ *     value may not contain a newline, so a key can never inject a second line
+ *     (or an unrelated variable) into a file every host sources at start-up;
+ *   - an existing line with the same name is REPLACED in place — including its
+ *     `export ` prefix, which is preserved — so comments, ordering and every
+ *     other key in the file survive untouched, and a hand-written file is not
+ *     reformatted;
+ *   - duplicate definitions of the same name are collapsed to the one that was
+ *     just written. Two `OPENAI_API_KEY=` lines is the "which one won?" bug,
+ *     and the answer would otherwise depend on the reader's merge order;
+ *   - the file is created 0600 and written through a same-directory temp file
+ *     + rename, so a crash mid-write cannot leave a half-written key file, and
+ *     a write never widens permissions on a file that was already tighter. A
+ *     file that WAS group/world-readable is tightened, and the caller is told
+ *     (`tightened: true`) rather than the change going unmentioned;
+ *   - the value is applied to `process.env` as well, so the selection that
+ *     triggered the write runs on the key it just stored;
+ *   - the value is never returned, logged or echoed by anything in here.
  */
 
 const fs = require('node:fs');
@@ -34,6 +58,12 @@ const credentials = require('./credentials.js');
 
 const ENV_FILE = '.env';
 
+/** Permissions for a file holding secrets: owner read/write, nothing else. */
+const SECRET_FILE_MODE = 0o600;
+
+/** A directory we create for a secret file: owner only. */
+const SECRET_DIR_MODE = 0o700;
+
 /**
  * provider id -> the env var a BYOK key is conventionally exported as, for the
  * ids where the generic rule below would spell the wrong name. The generic rule
@@ -56,6 +86,9 @@ const ALIASES = Object.freeze({
   'voyage-ai': 'VOYAGE_API_KEY',
 });
 
+/** The variable that carries an AEGIS Cloud account key (see credentials.js). */
+const ACCOUNT_ENV_VAR = 'AEGIS_API_KEY';
+
 /** The file this host would read, honouring `$AEGISCODE_HOME`. */
 function envFileFor(dir) {
   return path.join(dir || credentials.aegisHome(), ENV_FILE);
@@ -85,7 +118,9 @@ function envVarFor(providerId) {
  * (and a stray `#` comment or a blank line is normal, not an error).
  *
  * Handles `export `, `KEY=value`, `KEY="value"`, `KEY='value'` and a trailing
- * ` # comment` on an unquoted value.
+ * ` # comment` on an unquoted value. A double-quoted value is unescaped (`\"`,
+ * `\\`) because that is what `quoteEnvValue` writes and what dotenv readers do;
+ * a single-quoted value is literal.
  */
 function parseEnvText(text) {
   const out = {};
@@ -98,9 +133,19 @@ function parseEnvText(text) {
     if (name.startsWith('export ')) name = name.slice('export '.length).trim();
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
     let value = line.slice(eq + 1).trim();
-    const quoted = (value.startsWith('"') && value.endsWith('"') && value.length >= 2)
-      || (value.startsWith("'") && value.endsWith("'") && value.length >= 2);
-    if (quoted) {
+    const doubleQuoted = value.startsWith('"') && value.endsWith('"') && value.length >= 2;
+    const singleQuoted = value.startsWith("'") && value.endsWith("'") && value.length >= 2;
+    if (doubleQuoted) {
+      // Double quotes are the one form that carries escapes, so they are the
+      // one form that must be unescaped — `\"` and `\\`, exactly what
+      // `quoteEnvValue` writes and what every dotenv reader does. Without this
+      // the writer's escaping was one-way: a value containing a quote or a
+      // backslash was stored doubled and read back mangled, so a key survived
+      // the session it was typed in but not the next one. Single quotes stay
+      // literal (`'C:\keys'` is a backslash, not an escape), which is the
+      // convention that makes the two quote styles mean something different.
+      value = value.slice(1, -1).replace(/\\(["\\])/g, '$1');
+    } else if (singleQuoted) {
       value = value.slice(1, -1);
     } else {
       const hash = value.indexOf(' #');
@@ -171,12 +216,354 @@ function providerKeyFromEnv(providerId, env) {
   return { key, env: name };
 }
 
+/** A variable name this module is willing to write. */
+function isWritableName(name) {
+  return typeof name === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name);
+}
+
+/**
+ * Quote a value the way `parseEnvText` (and every dotenv reader) will read back
+ * byte-identically. Unquoted when it is safe; double-quoted with backslashes and
+ * quotes escaped when it is not. A newline is refused by the caller, never
+ * escaped here: escaping it would hide a malformed key behind a file that
+ * still looks right.
+ */
+function quoteEnvValue(value) {
+  const s = String(value);
+  if (s === '') return '';
+  if (!/[\s"'#\\]/.test(s)) return s;
+  return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+/**
+ * Apply `name=value` to dotenv text: replace the first existing definition in
+ * place (keeping an `export ` prefix and any trailing comment-less formatting),
+ * drop later duplicates, and append when the name is new. Every other line —
+ * comments, blanks, unrelated keys, their order — is preserved verbatim.
+ *
+ * Pure, and exported for tests: this is the part worth pinning, because a bug
+ * here silently destroys a file the user also edits by hand.
+ *
+ * @returns {{text:string, replaced:boolean}}
+ */
+function upsertEnvText(text, name, value) {
+  const src = String(text == null ? '' : text);
+  // Split without keeping the terminator, then re-join with '\n' and restore a
+  // final newline only if the file had one — so a write never adds a dangling
+  // blank line to a file that ended cleanly.
+  const hadFinalNewline = src === '' ? true : src.endsWith('\n');
+  const trailingBlank = src === '' ? false : src.split('\n').slice(-1)[0] === '';
+  const lines = src.split('\n');
+  if (trailingBlank) lines.pop();
+
+  const re = new RegExp(`^(\\s*(?:export\\s+)?)${name}\\s*=`);
+  const out = [];
+  let replaced = false;
+  for (const line of lines) {
+    const m = re.exec(line);
+    if (!m) {
+      out.push(line);
+      continue;
+    }
+    if (replaced) continue; // a second definition of the same name: collapse it
+    out.push(`${m[1]}${name}=${quoteEnvValue(value)}`);
+    replaced = true;
+  }
+  if (!replaced) out.push(`${name}=${quoteEnvValue(value)}`);
+
+  let joined = out.join('\n');
+  if (joined !== '' && (hadFinalNewline || trailingBlank)) joined += '\n';
+  return { text: joined, replaced };
+}
+
+/**
+ * Store one variable in `~/.aegiscode/.env`, creating the file (0600) and the
+ * directory (0700) when needed, and apply it to the live environment so the
+ * action that triggered the write runs on it.
+ *
+ * The one writer for every host: the CLI calls it when a model is selected and
+ * its key is missing, and the desktop calls the same function through the same
+ * staged file, which is what makes a key entered once usable in both.
+ *
+ * @param {string} name   an env var name, e.g. 'OPENAI_API_KEY'
+ * @param {string} value  the secret. Never returned, never logged.
+ * @param {object} [o]
+ * @param {string} [o.dir]   defaults to aegisHome()
+ * @param {string} [o.file]  an explicit path, for tests
+ * @param {object} [o.env]   defaults to process.env
+ * @param {boolean} [o.apply=true] set it in `o.env`/process.env as well
+ * @returns {{ok:boolean, file:string, name:string, changed:boolean,
+ *            created:boolean, replaced:boolean, mode:number, tightened:boolean,
+ *            error:string}}
+ *   `changed` is false when the file already held that exact value — a re-save
+ *   of an unchanged key must not rewrite the file.
+ */
+function setEnvValue(name, value, o = {}) {
+  const env = o.env || process.env;
+  const file = o.file || envFileFor(o.dir);
+  const out = {
+    ok: false, file, name: String(name || ''), changed: false, created: false,
+    replaced: false, mode: 0, tightened: false, error: '',
+  };
+
+  if (!isWritableName(name)) {
+    out.error = `refusing to write "${name}" — an env var name is [A-Za-z_][A-Za-z0-9_]*`;
+    return out;
+  }
+  const secret = String(value == null ? '' : value).trim();
+  if (!secret) {
+    out.error = `refusing to write an empty ${name}`;
+    return out;
+  }
+  // The one injection this file must not accept: a value carrying a newline
+  // would append a line, and the file is sourced by every host at start-up.
+  if (/[\r\n]/.test(String(value))) {
+    out.error = `refusing to write ${name} — the value contains a line break`;
+    return out;
+  }
+
+  let before = '';
+  let previousMode = 0;
+  out.created = true;
+  try {
+    before = fs.readFileSync(file, 'utf8');
+    out.created = false;
+    try {
+      previousMode = fs.statSync(file).mode & 0o777;
+    } catch { /* advisory */ }
+  } catch (e) {
+    if (e && e.code !== 'ENOENT') {
+      out.error = `could not read ${file}: ${e.code || e.message}`;
+      return out;
+    }
+  }
+
+  const aligned = String(before).replace(/\r\n/g, '\n');
+  if (!out.created && parseEnvText(aligned)[name] === secret) {
+    // Same key already stored: leave the file (its mtime, its mode) alone.
+    out.ok = true;
+    out.changed = false;
+    out.replaced = true;
+    out.mode = previousMode || SECRET_FILE_MODE;
+    if (o.apply !== false) env[name] = secret;
+    return out;
+  }
+
+  const { text, replaced } = upsertEnvText(aligned, name, secret);
+  const tmp = `${file}.tmp-${process.pid}`;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
+    fs.writeFileSync(tmp, text, { encoding: 'utf8', mode: SECRET_FILE_MODE });
+    // The rename carries the temp file's 0600 onto the destination, so a file
+    // that was group-readable ends up owner-only. Say so rather than tightening
+    // a file behind the user's back.
+    fs.chmodSync(tmp, SECRET_FILE_MODE);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch {}
+    out.error = `could not write ${file}: ${e.code || e.message}`;
+    return out;
+  }
+
+  out.ok = true;
+  out.changed = true;
+  out.replaced = replaced;
+  out.mode = SECRET_FILE_MODE;
+  out.tightened = !out.created && previousMode !== 0 && (previousMode & 0o077) !== 0;
+  if (o.apply !== false) env[name] = secret;
+  return out;
+}
+
+/**
+ * Delete every definition of `name` from an env file's text, leaving every
+ * other line — comments, blanks, unrelated keys, their order, `export `
+ * prefixes — byte-identical.
+ *
+ * Removing a key is NOT the same as storing an empty one: `parseEnvText` reads
+ * `NAME=""` back as a present-but-empty variable, so an empty write leaves the
+ * old value's line in the file and a stale key can still win later. A remover
+ * has to delete the line.
+ *
+ * Pure, and exported for tests: like `upsertEnvText`, a bug here silently
+ * damages a file the user also edits by hand.
+ *
+ * @returns {{text:string, removed:number, changed:boolean}}
+ */
+function removeEnvText(text, name) {
+  const src = String(text == null ? '' : text);
+  const hadFinalNewline = src === '' ? true : src.endsWith('\n');
+  const trailingBlank = src === '' ? false : src.split('\n').slice(-1)[0] === '';
+  const lines = src.split('\n');
+  if (trailingBlank) lines.pop();
+
+  // Same definition matcher as upsertEnvText, so the two can never disagree
+  // about which lines count as this variable.
+  const re = new RegExp(`^(\\s*(?:export\\s+)?)${name}\\s*=`);
+  const out = [];
+  let removed = 0;
+  for (const line of lines) {
+    if (re.test(line)) {
+      removed += 1; // every definition goes, so duplicates cannot survive
+      continue;
+    }
+    out.push(line);
+  }
+
+  let joined = out.join('\n');
+  if (joined !== '' && (hadFinalNewline || trailingBlank)) joined += '\n';
+  return { text: joined, removed, changed: removed > 0 };
+}
+
+/**
+ * Remove one variable from `~/.aegiscode/.env` and from the live environment.
+ *
+ * The counterpart of `setEnvValue`, and the reason a provider key deleted in
+ * the desktop app stops being in force: without it, the key survives in the
+ * shared file and the desktop's own "removed" state disagrees with what the CLI
+ * reads next session.
+ *
+ * A file that never mentioned the name is left untouched — no stray empty
+ * variable, no rewritten mtime.
+ *
+ * @returns {{ok:boolean, file:string, name:string, changed:boolean,
+ *   removed:number, mode:number, error:string}}
+ */
+function clearEnvValue(name, o = {}) {
+  const env = o.env || process.env;
+  const file = o.file || envFileFor(o.dir);
+  const out = {
+    ok: false, file, name: String(name || ''), changed: false, removed: 0,
+    mode: 0, error: '',
+  };
+
+  if (!isWritableName(name)) {
+    out.error = `refusing to clear "${name}" — an env var name is [A-Za-z_][A-Za-z0-9_]*`;
+    return out;
+  }
+
+  let before = '';
+  let missing = false;
+  let previousMode = 0;
+  try {
+    before = fs.readFileSync(file, 'utf8');
+    try {
+      previousMode = fs.statSync(file).mode & 0o777;
+    } catch { /* advisory */ }
+  } catch (e) {
+    if (e && e.code === 'ENOENT') missing = true;
+    else {
+      out.error = `could not read ${file}: ${e.code || e.message}`;
+      return out;
+    }
+  }
+
+  const { text, removed, changed } = missing
+    ? { text: '', removed: 0, changed: false }
+    : removeEnvText(before, name);
+
+  if (!changed) {
+    // Nothing in the file to remove. Still unset the live variable: the caller
+    // asked for the key to stop being used, and a shell export would otherwise
+    // keep serving it for the rest of this process.
+    out.ok = true;
+    out.mode = previousMode || SECRET_FILE_MODE;
+    if (o.apply !== false) delete env[String(name)];
+    return out;
+  }
+
+  const tmp = `${file}.tmp-${process.pid}`;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: SECRET_DIR_MODE });
+    fs.writeFileSync(tmp, text, { encoding: 'utf8', mode: SECRET_FILE_MODE });
+    fs.chmodSync(tmp, SECRET_FILE_MODE);
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch {}
+    out.error = `could not write ${file}: ${e.code || e.message}`;
+    return out;
+  }
+
+  out.ok = true;
+  out.changed = true;
+  out.removed = removed;
+  out.mode = SECRET_FILE_MODE;
+  if (o.apply !== false) delete env[String(name)];
+  return out;
+}
+
+/**
+ * Whether the key a route needs is already stored, and where that answer came
+ * from. Read-only; the caller uses it to decide whether to prompt.
+ *
+ * `inFile` is the distinction that matters for the model picker: a key in the
+ * process environment belongs to the shell that launched this host and is gone
+ * next session (and invisible to the desktop), where a key in the file is the
+ * durable, cross-host one.
+ *
+ * @returns {{name:string, present:boolean, inFile:boolean, source:string}}
+ *   `source` — 'shell' | 'file' | 'both' | 'none'
+ */
+function keyStatus(name, o = {}) {
+  const env = o.env || process.env;
+  const file = o.file || envFileFor(o.dir);
+  const varName = String(name || '');
+  const out = { name: varName, present: false, inFile: false, source: 'none' };
+  if (!isWritableName(varName)) return out;
+
+  const raw = env[varName];
+  const shell = typeof raw === 'string' && raw.trim() !== '';
+  let file_ = false;
+  try {
+    const parsed = parseEnvText(fs.readFileSync(file, 'utf8'));
+    file_ = typeof parsed[varName] === 'string' && parsed[varName].trim() !== '';
+  } catch { /* absent or unreadable is simply "not in the file" */ }
+
+  out.present = shell || file_;
+  out.inFile = file_;
+  out.source = shell && file_ ? 'both' : shell ? 'shell' : file_ ? 'file' : 'none';
+  return out;
+}
+
+/**
+ * The env var a model id's key belongs in — the question the model picker asks
+ * to know what to collect, and the reason one key is not collected twice.
+ *
+ * A byok id is `<provider>:<model>` and its key is that provider's variable. A
+ * pooled id (`deepseek`, `anthropic-haiku`, `nexus-brain`, …) is served by the
+ * pool, which holds the provider keys itself, so the credential such a route
+ * needs is the AEGIS ACCOUNT key — one variable, `AEGIS_API_KEY`, however many
+ * providers the picker lists.
+ *
+ * @param {string} modelId
+ * @param {string} [cls] 'byok' | 'aegis' | anything else
+ * @returns {{env:string, provider:string, pooled:boolean}}
+ */
+function keyForModelId(modelId, cls) {
+  const id = String(modelId == null ? '' : modelId).trim();
+  const byok = String(cls || '').toLowerCase() === 'byok' || id.includes(':');
+  if (byok && id.includes(':')) {
+    const provider = id.slice(0, id.indexOf(':')).trim();
+    return { env: envVarFor(provider), provider, pooled: false };
+  }
+  return { env: ACCOUNT_ENV_VAR, provider: '', pooled: true };
+}
+
 module.exports = {
   ENV_FILE,
   ALIASES,
+  ACCOUNT_ENV_VAR,
+  SECRET_FILE_MODE,
   envFileFor,
   envVarFor,
   parseEnvText,
   loadEnvFile,
   providerKeyFromEnv,
+  isWritableName,
+  quoteEnvValue,
+  upsertEnvText,
+  removeEnvText,
+  setEnvValue,
+  clearEnvValue,
+  keyStatus,
+  keyForModelId,
 };