aegis-desktop 1.0.10 → 1.0.13

package/renderer/app.js

@@ -96,6 +96,14 @@ const ELEMENT_IDS = {
   apiKeyHint: 'api-key-hint',
   classSelect: 'class-select',
   modelSelect: 'model-select',
+  ptSearch: 'pt-search',
+  ptRefresh: 'pt-refresh',
+  ptList: 'pt-list',
+  ptCount: 'pt-count',
+  ptHint: 'pt-hint',
+  companionCard: 'companion-card',
+  companionText: 'companion-text',
+  companionDismiss: 'companion-dismiss',
   modelFree: 'model-input',
   budgetHint: 'budget-hint',
   autonomousToggle: 'autonomous-toggle',
@@ -106,6 +114,15 @@ const ELEMENT_IDS = {
   modelHint: 'model-hint',
   settingsList: 'settings-list',
   settingsHint: 'settings-hint',
+  // The custom-provider card (index.html #custom-provider-card): an address, a
+  // key and a model id, saved as `byok:custom`. Separate from settingsList
+  // because its row carries a base URL the catalog rows do not have.
+  customBaseUrl: 'custom-base-url',
+  customKey: 'custom-key',
+  customModel: 'custom-model',
+  customSave: 'custom-save',
+  customRemove: 'custom-remove',
+  customStatus: 'custom-status',
   quickLauncherEnabled: 'quick-launcher-enabled',
   quickLauncherShortcut: 'quick-launcher-shortcut',
   quickLauncherSave: 'quick-launcher-save',
@@ -239,6 +256,20 @@ const RESERVED_PROVIDERS = new Set(['__aegis', 'aegis']);
 // (desktop/lib/settings.js) and the engine re-checks before every call, so the
 // value typed here can only ever address this machine or this LAN.
 const LOCAL_PROVIDER = 'local';
+// The one catalog provider whose configuration is not a key alone.
+//
+// aegis1 lists `custom` in GET /api/v1/byok/providers (services/byok_service.py
+// `byok_provider_catalog`) even though its descriptor pins no credential env and
+// no base URL, because the address travels per request instead. That makes it
+// the only row where "paste your key" is not enough: aegis1's
+// `_byok_custom_base_url` refuses a custom call that carries no `base_url`, so a
+// key saved with no address is a credential nothing can spend.
+//
+// So the catalog loop below SKIPS this id and the card under #custom-provider-card
+// owns it end to end (address + key + model id, one Save). Kept as one constant
+// because two surfaces must agree on the spelling — the row that is skipped here
+// and the row that is written there.
+const CUSTOM_PROVIDER = 'custom';
 // Ollama's stock port: the address a freshly installed daemon actually answers
 // on, so the field's placeholder is also the value a blank save falls back to.
 const LOCAL_DEFAULT_BASE = 'http://localhost:11434';
@@ -1102,6 +1133,12 @@ function renderStatus(s) {
   // from the CLI) retires the connect block; with no key it stays. No-ops when
   // the panel is not mounted.
   applyWelcomeConnect();
+  // The personalized line reads the same facts (a key that just landed, an
+  // update that just downloaded), and the panel is painted BEFORE this read
+  // returns on a cold start — so without this repaint the line would keep the
+  // tip it chose while the key state was still unknown. No-ops when the panel
+  // is not mounted.
+  applyWelcomePersonal();
   // And the two-key pop-up's gate: a status read is the only thing that knows
   // either fact, so this is where the sheet is opened (a key still missing) or
   // retired (both present). No-ops while the markup is absent.
@@ -1123,6 +1160,10 @@ let updateDismissedFor = null;
 function renderUpdateBanner(state) {
   if (!els.updateBanner) return;
   lastUpdateState = state;
+  // A downloaded update is the single most actionable fact the daily line can
+  // report, and it arrives AFTER boot. Re-rendering here is what keeps the two
+  // from disagreeing — the dismissal rule inside renderCompanion still wins.
+  try { renderCompanion(); } catch { /* the banner must not fail on the card */ }
   const status = state && state.status;
   // 'unavailable' is the npm channel's silent verdict after a background check
   // that failed for a transient reason (no network yet at login, a VPN coming
@@ -1142,12 +1183,15 @@ function renderUpdateBanner(state) {
   let showRetry = false;
   const version = state.version ? `v${state.version} ` : '';
   if (status === 'available') {
-    // The npm channel cannot install itself, so its banner names the command
-    // instead of offering a Download button that would do nothing.
+    // A channel the main process can install for (npm, pip) gets a real
+    // Download button — `canDownload` is true only when it has an argv to run.
+    // The rest (npx, a source checkout) have nothing to install, so the banner
+    // names the command instead of offering a button that would do nothing.
     text = state.command
       ? `Update ${version}available — run: ${state.command}`
       : `Update ${version}available.`;
     showDownload = !!state.canDownload;
+    if (showDownload) text = `Update ${version}available.`;
   } else if (status === 'downloading') {
     const pct = typeof state.progress === 'number' ? ` (${Math.round(state.progress)}%)` : '';
     text = `Downloading update${pct}…`;
@@ -2045,7 +2089,7 @@ function handleQuickLauncherPush(payload) {
 //
 // Field set per entry (aegis1/app.py:9349 `_memory_row_to_dict`): id,
 // timestamp, createdAt (epoch ms), source, role, tags[], content, session,
-// importance, summary(bool), topics[], entities[], sentiment, tokenCount,
+// importance, summary(bool), entities[], sentiment, tokenCount,
 // embedding[]. There is no `tier` — L0–L3 is the local CLI engine's concept
 // (the upstream engine's memory module) and does not exist on the cloud rows, so
 // source/role are the real provenance axes here.
@@ -2125,6 +2169,166 @@ function keysOverlayOpen() {
  *  above can ask it whether it is open without reaching into its internals. */
 let fpPanel = null;
 
+// ------------------------------------------------- providers & models toolbar
+//
+// The list is built from the SAME calls the Model card uses (models.listClasses
+// then models.listModels per class), so a provider that appears in one place
+// cannot be missing from the other. It is deliberately lazy: the per-class
+// catalog calls cost a network round trip each, and this card is a reference,
+// not the control the user is working in — so it loads on first sight (the
+// Refresh button, or the moment the card is actually opened) rather than
+// delaying boot behind four catalog fetches.
+let ptToolbar = null;
+let ptLoaded = false;
+
+/** Collect every class's models payload, in class order. Never throws. */
+async function collectProviderRows() {
+  let classes = [];
+  try {
+    classes = (await models.listClasses()) || [];
+  } catch (err) {
+    els.ptHint.textContent =
+      `listClasses failed: ${err && err.message ? err.message : err}`;
+    return [];
+  }
+  const rows = [];
+  for (const c of classes) {
+    if (!c || !c.class) continue;
+    let list = null;
+    try {
+      list = await models.listModels(c.class);
+    } catch (err) {
+      // A class that failed is reported AS a class that failed, not dropped:
+      // an absent row would read as "this build cannot address it", which is a
+      // different and much worse claim than "its catalog call errored".
+      list = { models: [], error: (err && err.message) || String(err) };
+    }
+    rows.push({ class: c.class, classLabel: c.label, classConfigured: Boolean(c.configured), list });
+  }
+  return rows;
+}
+
+async function loadProviderToolbar(force) {
+  if (!ptToolbar) return;
+  if (ptLoaded && !force) return;
+  if (els.ptHint) els.ptHint.textContent = 'listing providers…';
+  const rows = await collectProviderRows();
+  ptLoaded = true;
+  ptToolbar.set(rows);
+}
+
+/** Apply a toolbar pick to the Model card's own controls. */
+function applyProviderPick(sel) {
+  if (!sel || !sel.class) return;
+  if (!Array.from(els.classSelect.options).some((o) => o.value === sel.class)) return;
+  els.classSelect.value = sel.class;
+  localStorage.setItem(CLASS_KEY, sel.class);
+  updateBudgetControls(sel.class);
+  loadModels(sel.class).then(() => {
+    // The model list is async, so the model can only be applied once the
+    // options exist. Setting a value the picker does not offer would leave the
+    // select on its first entry while the toolbar claims a different row.
+    if (sel.model && Array.from(els.modelSelect.options).some((o) => o.value === sel.model)) {
+      els.modelSelect.value = sel.model;
+      els.modelSelect.dispatchEvent(new Event('change'));
+    }
+  });
+}
+
+function mountProviderToolbar() {
+  if (!window.aegisProviderToolbar || !els.ptList) return;
+  ptToolbar = window.aegisProviderToolbar.mount({
+    list: els.ptList,
+    count: els.ptCount,
+    search: els.ptSearch,
+    hint: els.ptHint,
+    onSelect: applyProviderPick,
+  });
+  if (els.ptRefresh) {
+    els.ptRefresh.addEventListener('click', () => { loadProviderToolbar(true); });
+  }
+  // Lazy first load: fires once, when the card is first scrolled into view.
+  if (typeof IntersectionObserver === 'function' && els.ptList.closest('section')) {
+    const io = new IntersectionObserver((hits) => {
+      if (hits.some((h) => h.isIntersecting)) {
+        io.disconnect();
+        loadProviderToolbar(false);
+      }
+    });
+    io.observe(els.ptList.closest('section'));
+  } else {
+    loadProviderToolbar(false);
+  }
+}
+
+// ------------------------------------------------------- the daily line
+//
+// One message per local day, from facts this process already holds (see
+// companion.js for why every branch is fact-gated). Stored as `{day, id}` so a
+// dismissal survives a restart and a NEW day re-opens the card.
+const COMPANION_KEY = 'aegis.companion.dismissed';
+
+function companionFacts() {
+  const facts = { keyConfigured: keyConfigured === null ? undefined : keyConfigured };
+  // Only counts the renderer can actually see are passed; everything else is
+  // left undefined so companion.js drops that branch instead of guessing.
+  //
+  // The memory count comes from `memoryView.entries` — the inspector's own
+  // fetched page — NOT from `fpPanel.entries()`, which this used to call and
+  // which does not exist: renderer/fingerprint.js's mount() returns open/close/
+  // isOpen/refresh/loadAutoMint/state/actions and nothing else, so that branch
+  // was dead code and `memoryCount` was never populated, which in turn made the
+  // memory branch in companion.js unreachable in the app. `memoryView.entries`
+  // is empty until the inspector has been opened once (loadMemoryOverlay is
+  // what fills it), so this reports a count only when the process has really
+  // seen one — the same "no guess in the blank" rule as every other fact here.
+  if (Array.isArray(memoryView.entries) && memoryView.entries.length) {
+    facts.memoryCount = memoryView.entries.length;
+  }
+  if (lastUpdateState && lastUpdateState.status === 'downloaded' && lastUpdateState.version) {
+    facts.updatePending = String(lastUpdateState.version);
+  }
+  if (classOptions.length && els.modelSelect && els.modelSelect.options.length > 1) {
+    facts.modelCount = els.modelSelect.options.length;
+  }
+  return facts;
+}
+
+function renderCompanion() {
+  if (!window.aegisCompanion || !els.companionCard || !els.companionText) return;
+  const now = new Date();
+  let dismissed = null;
+  try {
+    dismissed = JSON.parse(localStorage.getItem(COMPANION_KEY) || 'null');
+  } catch {
+    dismissed = null;
+  }
+  if (window.aegisCompanion.dismissedToday(dismissed, now)) {
+    els.companionCard.hidden = true;
+    return;
+  }
+  const msg = window.aegisCompanion.pickMessage(companionFacts(), now);
+  if (!msg || !msg.text) {
+    els.companionCard.hidden = true;
+    return;
+  }
+  els.companionText.textContent = msg.text;
+  els.companionCard.dataset.kind = msg.kind;
+  els.companionCard.dataset.messageId = msg.id;
+  els.companionCard.hidden = false;
+}
+
+function wireCompanion() {
+  if (els.companionDismiss) {
+    els.companionDismiss.addEventListener('click', () => {
+      localStorage.setItem(COMPANION_KEY, JSON.stringify({ day: window.aegisCompanion
+        ? window.aegisCompanion.dayKey(new Date()) : '', id: els.companionCard.dataset.messageId || '' }));
+      els.companionCard.hidden = true;
+    });
+  }
+  renderCompanion();
+}
+
 /** "3m ago" / "2d ago" from epoch ms. Empty string when unknown. */
 function relTime(ms) {
   if (!Number.isFinite(ms)) return '';
@@ -2156,7 +2360,6 @@ function normalizeMemoryEntry(raw) {
     source: asString(r.source) || '(unknown source)',
     role: asString(r.role),
     tags: asArray(r.tags),
-    topics: asArray(r.topics),
     entities: asArray(r.entities),
     session: asString(r.session),
     sentiment: asString(r.sentiment),
@@ -2307,7 +2510,7 @@ async function searchMemory(query) {
 
 // ------------------------------------------------- memory inspector overlay
 
-/** Small coloured label used for source / role / tag / topic / entity. */
+/** Small coloured label used for source / role / tag / entity. */
 function memoryChip(text, cls) {
   const span = document.createElement('span');
   span.className = `mem-chip${cls ? ` ${cls}` : ''}`;
@@ -2345,7 +2548,7 @@ function memoryCard(e) {
   body.textContent = e.content || '(empty)';
   li.appendChild(body);
 
-  const pills = [...e.tags, ...e.topics, ...e.entities];
+  const pills = [...e.tags, ...e.entities];
   if (pills.length) {
     const row = document.createElement('div');
     row.className = 'mem-card-pills';
@@ -2381,7 +2584,6 @@ function memoryMatches(e, q) {
     e.session,
     e.sentiment,
     ...e.tags,
-    ...e.topics,
     ...e.entities,
   ].join('\n').toLowerCase();
   return hay.includes(String(q == null ? '' : q).toLowerCase());
@@ -2644,16 +2846,262 @@ function applyGreeting() {
           : 'Working late?';
 }
 
-/** Prefill the composer with a starter question, caret at the end. */
-function quickAction(text) {
-  const inp = els.prompt;
-  if (!inp) return;
-  inp.value = text;
-  inp.focus();
+/** Pack the facts above into the shape renderer/companion.js consumes.
+ *
+ *  The welcome line and the sidebar's daily message answer the same question —
+ *  "what does this install actually know that is worth saying?" — so they read
+ *  the SAME fact bag rather than growing a second, drifting opinion of what is
+ *  true. Everything absent is left undefined on purpose: companion.js drops a
+ *  branch whose facts are missing instead of filling the gap with a guess.
+ */
+function personalizeFacts() {
+  const facts = companionFacts();
+  // companionFacts() only returns `keyConfigured` when the status read has
+  // landed (null means "not read yet"). The welcome panel is painted before
+  // that read on a cold start, and the panel is the one place where "paste your
+  // key" is the useful thing to say — so an unread status, not a known keyless
+  // machine, must NOT be reported as keyConfigured === false.
+  if (facts.keyConfigured === undefined) delete facts.keyConfigured;
+  /*
+   * The provider-class-with-models-but-no-key case is deliberately NOT passed
+   * here. It is a sidebar diagnosis (it names the Provider settings card the
+   * user was already looking at); in the welcome panel the byok route below is
+   * the same information written as an invitation, and showing both in one
+   * column reads as two warnings about one thing.
+   */
+  return facts;
+}
+
+/**
+ * The one personalized line in the welcome panel.
+ *
+ * This replaced five generic topic pills ("Write code", "Explain a concept", …)
+ * that every install showed identically. A topic menu asks the user to invent
+ * an intent that fits a canned frame; a line built from a fact about THEIR
+ * install either saves them a step (a downloaded update, a key they have not
+ * pasted yet) or tells them something true that they already own (memory
+ * entries, sessions). Where no such fact exists it rotates one true tip — and
+ * where even that is unavailable, the node stays hidden rather than printing an
+ * empty box or a guess.
+ *
+ * Returns `{ text, kind }` or null. `kind` is 'action' (a concrete step) or
+ * 'tip' (a true statement about the build); it is written to the dataset so CSS
+ * can style an action line a little louder than a rotation.
+ */
+function welcomePersonalize(now) {
+  const panel = window.aegisCompanion;
+  if (!panel || typeof panel.pickMessage !== 'function') return null;
+  const msg = panel.pickMessage(personalizeFacts(), now || new Date());
+  if (!msg || !msg.text) return null;
+  return { text: msg.text, kind: msg.kind || 'tip' };
+}
+
+/** Paint the personalized line into the cloned panel. */
+function applyWelcomePersonal() {
+  const el = document.getElementById('welcome-personal');
+  if (!el) return;
+  const line = welcomePersonalize();
+  if (!line) {
+    // Nothing true to say: hidden, and empty, so a stale line can never be left
+    // behind by a second render in the same session.
+    el.textContent = '';
+    el.hidden = true;
+    return;
+  }
+  el.textContent = line.text;
+  el.dataset.kind = line.kind;
+  el.hidden = false;
+}
+
+// ------------------------------------------------ welcome: the AI's own line
+//
+// The line above is written by this app, from facts it holds. It is always true
+// and it is always the same sentence, which is exactly why it stops being read
+// after the third launch: the same install gets the same words every day.
+//
+// So the panel asks the model instead — one short turn, once per local day,
+// given the facts (the local time of day, how many memory entries there are,
+// which model is selected, whether a key is present) and told to write ONE
+// sentence for this user. It is cached per day, so a New chat re-render costs
+// nothing, and the app's own line is what paints first: the panel never waits
+// on a network round trip to have something to say.
+//
+// WHAT THIS DELIBERATELY IS NOT. It is not a free-form agent turn. It carries
+// no tools, no history and no user text; `singlePass` keeps a pooled model id
+// from silently fanning out to (workers + 1) calls, and the budget is the small
+// fixed one below. A greeting that bills a multi-worker dispatch on every cold
+// start would be the most expensive sentence in the app.
+//
+// AND IT IS GATED, not assumed: a turn is only sent when something can answer
+// it — an AEGIS key for the pooled class, or a local model list with a model in
+// it. With neither, no request is made at all and the fact line stands alone.
+// Nothing is invented when the model cannot be reached; a failed call leaves the
+// fact line exactly as it was.
+
+const AI_GREETING_KEY = 'aegis.welcomeAiLine';
+/** One sentence. Long enough for a model to finish a thought, short enough that
+ *  a truncated answer cannot fill the panel — the renderer trims to the last
+ *  sentence boundary below rather than showing half a clause. */
+const AI_GREETING_MAX_TOKENS = 120;
+/** Hard cap on what is put on screen, characters. A model that ignores the
+ *  length instruction must not be able to push the composer off the panel. */
+const AI_GREETING_MAX_CHARS = 200;
+
+/** Local calendar day, YYYY-MM-DD. Local, for the same reason companion.js is:
+ *  "today" means the user's today, not UTC's. */
+function aiGreetingDay(now) {
+  const d = now instanceof Date ? now : new Date(now == null ? Date.now() : now);
+  if (Number.isNaN(d.getTime())) return '';
+  const p = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
+
+/** Can a turn actually be sent right now? Read from what the process knows. */
+function aiGreetingReachable() {
+  if (keyConfigured === true) return true;
+  // Local needs no account. A listed model means the daemon answered, which is
+  // the only evidence this renderer has that anything is listening.
+  return !!(els.modelSelect && els.modelSelect.options && els.modelSelect.options.length > 1);
+}
+
+/** The cached line for today, or null. Cache is `{ day, text }`. */
+function aiGreetingCached(now) {
+  let rec = null;
   try {
-    inp.setSelectionRange(text.length, text.length);
-  } catch (err) {
-    /* not supported on every input type; focus alone is enough */
+    rec = JSON.parse(localStorage.getItem(AI_GREETING_KEY) || 'null');
+  } catch {
+    rec = null;
+  }
+  if (!rec || typeof rec.text !== 'string' || !rec.text) return null;
+  if (rec.day !== aiGreetingDay(now)) return null;
+  return rec.text;
+}
+
+/** Trim a model's answer to one presentable sentence.
+ *
+ *  Models wrap greetings in quotes, prefix them with "Sure!" or emit three
+ *  sentences when asked for one. Rather than trusting the instruction, this
+ *  takes the first sentence and drops the scaffolding — and returns '' when
+ *  what is left is too short to be a greeting, so the caller keeps the fact
+ *  line instead of printing a fragment. */
+function trimAiGreeting(raw) {
+  let t = String(raw == null ? '' : raw).trim();
+  if (!t) return '';
+  // Reasoning models sometimes lead with a labelled preamble line.
+  t = t.replace(/^(assistant|greeting|response)\s*:\s*/i, '');
+  // ...and chat models lead with agreement ("Sure!", "Of course.") or an
+  // announcement of what follows ("Here's your greeting:"). Neither is the
+  // sentence that was asked for, and both read as a machine clearing its
+  // throat at the top of the panel. Stripped repeatedly, so "Sure! Here you
+  // go:" composed of two such segments goes too.
+  let prev;
+  do {
+    prev = t;
+    t = t.replace(
+      /^(?:sure|certainly|of course|absolutely|okay|ok|got it|no problem|here(?:'s| is)\b[^.!?:]*)\s*[.!?:,—–-]\s*/i,
+      '',
+    );
+  } while (t !== prev && t);
+  // A quoted one-liner: keep what is inside the outermost quotes.
+  const q = t.match(/^["'“”'']([\s\S]+)["'“”'']$/);
+  if (q) t = q[1].trim();
+  t = t.replace(/\s+/g, ' ');
+  // First sentence, on a boundary that is followed by a space or end of string,
+  // so "llama3.2:3b" and "a.m." are not cut in half.
+  const m = t.match(/^[\s\S]*?[.!?](?=\s|$)/);
+  if (m) t = m[0].trim();
+  if (t.length > AI_GREETING_MAX_CHARS) {
+    const cut = t.slice(0, AI_GREETING_MAX_CHARS);
+    const at = Math.max(cut.lastIndexOf('. '), cut.lastIndexOf('! '), cut.lastIndexOf('? '));
+    t = at > 40 ? cut.slice(0, at + 1) : `${cut.replace(/[,;:\s]+$/, '')}…`;
+  }
+  return t.length >= 12 ? t : '';
+}
+
+/** The one sentence the model is asked for. Facts only — no user text, no
+ *  history, nothing that could carry a conversation in. */
+function aiGreetingPrompt(facts) {
+  const h = new Date().getHours();
+  const when =
+    h >= 5 && h < 12 ? 'morning'
+      : h >= 12 && h < 17 ? 'afternoon'
+        : h >= 17 && h < 22 ? 'evening'
+          : 'late night';
+  const known = [];
+  if (typeof facts.memoryCount === 'number') {
+    known.push(`${facts.memoryCount} entries saved in the user's memory`);
+  }
+  if (typeof facts.modelCount === 'number') known.push(`${facts.modelCount} models available`);
+  if (typeof facts.updatePending === 'string') {
+    known.push(`update ${facts.updatePending} is downloaded and installs on quit`);
+  }
+  if (facts.keyConfigured === true) known.push('the account key is connected');
+  if (facts.keyConfigured === false) known.push('no account key is connected yet');
+  return [
+    'Write the one sentence shown at the top of a coding assistant\'s empty',
+    `chat panel. It is ${when} for the person reading it.`,
+    known.length ? `What you know about their setup: ${known.join('; ')}.` : '',
+    'Rules: one sentence, at most 25 words, second person, no greeting cliché',
+    'like "Welcome back", no exclamation marks, no quotes, no preamble, no',
+    'markdown. Say something specific and useful about their work right now, or',
+    'ask one short question that helps them start. Reply with the sentence only.',
+  ].filter(Boolean).join(' ');
+}
+
+/** Ask the model for the line and paint it. Never throws, never blocks paint. */
+async function applyWelcomeAiLine() {
+  const el = document.getElementById('welcome-personal');
+  if (!el) return;
+  if (typeof models === 'undefined' || !models || typeof models.chat !== 'function') return;
+  if (!aiGreetingReachable()) return;
+
+  const now = new Date();
+  const cached = aiGreetingCached(now);
+  if (cached) {
+    el.textContent = cached;
+    el.dataset.kind = 'ai';
+    el.hidden = false;
+    return;
+  }
+
+  const facts = personalizeFacts();
+  const classId = els.classSelect && els.classSelect.value ? els.classSelect.value : 'aegis';
+  const modelId = els.modelSelect && els.modelSelect.value ? els.modelSelect.value : '';
+  const payload = {
+    class: classId,
+    prompt: aiGreetingPrompt(facts),
+    maxTokens: AI_GREETING_MAX_TOKENS,
+    // One cheap pass: no tools, no history, no fan-out. See the block comment.
+    tools: false,
+    singlePass: true,
+    effort: 'low',
+  };
+  if (modelId) payload.model = modelId;
+
+  let data = null;
+  try {
+    data = await models.chat(payload);
+  } catch {
+    // Unreachable, refused, out of balance: the fact line already on screen
+    // stands. Saying "could not write your greeting" would be noise about a
+    // sentence the user never asked for.
+    return;
+  }
+  const choice = (data && data.choices && data.choices[0]) || {};
+  const text = trimAiGreeting((choice.message && choice.message.content) || '');
+  if (!text) return;
+
+  // The panel may have been replaced (New chat, another session opened) while
+  // the turn was in flight. Only paint into a node still in the document.
+  const live = document.getElementById('welcome-personal');
+  if (!live) return;
+  live.textContent = text;
+  live.dataset.kind = 'ai';
+  live.hidden = false;
+  try {
+    localStorage.setItem(AI_GREETING_KEY, JSON.stringify({ day: aiGreetingDay(now), text }));
+  } catch {
+    /* storage disabled — the line is regenerated next launch, nothing breaks */
   }
 }
 
@@ -2664,9 +3112,11 @@ function renderWelcome() {
   els.messages.innerHTML = '';
   els.messages.appendChild(tpl.content.cloneNode(true));
   applyGreeting();
-  for (const btn of els.messages.querySelectorAll('.chat-quick-pill')) {
-    btn.addEventListener('click', () => quickAction(btn.dataset.quick || ''));
-  }
+  applyWelcomePersonal();
+  // Then, if a model can be reached, let it write the line (cached per day).
+  // Deliberately not awaited: the panel is already complete without it, and a
+  // slow or dead backend must not hold up the first paint.
+  applyWelcomeAiLine();
   // The connect block's three controls. Bound here (not inline, not at boot)
   // because they only exist in the cloned panel; CSP `script-src 'self'` would
   // drop an inline handler anyway.
@@ -4304,7 +4754,14 @@ async function loadSettings() {
     const byokProviders = Array.isArray(byokData && byokData.providers) ? byokData.providers : [];
     for (const p of byokProviders) {
       if (!p || !p.id) continue;
+      // Offered to the "your own models" datalist either way: `custom` is a
+      // provider id the relay takes a key for, and a hand-declared model under
+      // it is legitimate.
       byokProviderIds.push({ id: p.id, label: p.label || p.id });
+      // ...but not rendered as a key row here. Its own card (below) collects the
+      // base URL that makes the key spendable; a row here would save a key with
+      // nowhere to send it, which is exactly the state this split removes.
+      if (p.id === CUSTOM_PROVIDER) continue;
       const provider = `byok:${p.id}`;
       const local = settings.find((s) => s.provider === provider) || {
         provider, baseURL: '', configured: false, keyMask: null,
@@ -4355,6 +4812,19 @@ async function loadSettings() {
     els.settingsHint.textContent =
       `your own models: ${err && err.message ? err.message : err}`;
   }
+
+  // The custom endpoint's own card (#custom-provider-card) is painted from the
+  // same two stores this function just read — the settings row it owns and the
+  // declarations the block above lists — so the two surfaces cannot disagree
+  // about whether `custom` is configured.
+  try {
+    await loadCustomProvider();
+  } catch (err) {
+    if (els.customStatus) {
+      els.customStatus.textContent =
+        `custom provider: ${err && err.message ? err.message : err}`;
+    }
+  }
 }
 
 /**
@@ -4638,6 +5108,166 @@ async function renderUserModelRows(byokProviderIds) {
   els.settingsList.appendChild(block);
 }
 
+/**
+ * The custom-provider card: address + key + model id, one Save.
+ *
+ * WHY A CARD OF ITS OWN. Every other BYOK provider is reachable by key alone —
+ * its upstream host is a constant aegis1 already knows (services/nexus_provider/
+ * catalog.py), so the client's only input is the credential. `custom` is the
+ * inverse: the HOST is the user's to name, and the server validates it per call
+ * (`_byok_custom_base_url`: https, and no loopback/private/link-local target,
+ * because that route is otherwise an SSRF primitive). So the row has a field no
+ * other provider has, and it is not the same decision as "paste a key" — hence
+ * its own card instead of a special case inside the catalog list.
+ *
+ * The model id is part of the same save because aegis1's `custom` descriptor
+ * pins no `default_model`, so the relay catalog contributes no custom model row:
+ * the picker can only offer what the user-models file declares. Saving the key
+ * without declaring a model would leave a configured provider with nothing
+ * selectable — half a setup that looks finished.
+ *
+ * Order of writes, and why: the settings row first (that is what holds the
+ * address), the model declaration second, the re-render last. A failure between
+ * them leaves a saved endpoint and no model, which the status line says outright
+ * rather than reporting a clean save.
+ */
+function paintCustomRow(cfg, declared) {
+  if (!els.customBaseUrl) return;
+  const saved = cfg || {};
+  const declaredModels = Array.isArray(declared) ? declared : [];
+  if (!els.customBaseUrl.value && saved.baseURL) els.customBaseUrl.value = saved.baseURL;
+  if (els.customKey) {
+    els.customKey.placeholder = saved.configured
+      ? `key ${saved.keyMask || '••••'} (blank = keep)`
+      : 'sk-…';
+    els.customKey.value = '';
+  }
+  if (els.customRemove) els.customRemove.disabled = !saved.configured && !saved.baseURL;
+  if (!els.customStatus) return;
+  const parts = [];
+  if (saved.baseURL) parts.push(`endpoint ${saved.baseURL}`);
+  else parts.push('no endpoint saved');
+  parts.push(saved.configured ? `key ${saved.keyMask || 'saved'}` : 'no key');
+  parts.push(declaredModels.length
+    ? `model${declaredModels.length === 1 ? '' : 's'} ${declaredModels.join(', ')}`
+    : 'no model declared');
+  els.customStatus.textContent = parts.join(' · ');
+}
+
+/** Read the custom provider's saved state back (settings row + declarations). */
+async function loadCustomProvider() {
+  if (!els.customBaseUrl) return;
+  let cfg = null;
+  let declared = [];
+  try {
+    const rows = (await models.settings.get()) || [];
+    const found = (Array.isArray(rows) ? rows : []).find(
+      (s) => s && s.provider === `byok:${CUSTOM_PROVIDER}`
+    );
+    if (found) {
+      // `baseURL` IS part of the row `settings.get()` returns (settings.js
+      // `get()`: provider, baseURL, configured, keyMask) — only the key itself
+      // is masked. So the address is read, never re-written to be read back.
+      cfg = {
+        baseURL: found.baseURL || '',
+        configured: Boolean(found.configured),
+        keyMask: found.keyMask,
+      };
+    }
+  } catch {
+    /* store unreadable: the status line below says what is missing */
+  }
+  try {
+    const report = await models.userModels.get();
+    const map = (report && report.map) || {};
+    declared = Array.isArray(map[CUSTOM_PROVIDER]) ? map[CUSTOM_PROVIDER] : [];
+  } catch {
+    /* no declarations readable: treat as none */
+  }
+  paintCustomRow(cfg, declared);
+}
+
+/** Save the custom endpoint: settings row (address + key), then the model id. */
+async function saveCustomProvider() {
+  if (!els.customBaseUrl) return;
+  const baseURL = String(els.customBaseUrl.value || '').trim();
+  const key = els.customKey ? String(els.customKey.value || '').trim() : '';
+  const model = els.customModel ? String(els.customModel.value || '').trim() : '';
+  const say = (t) => { if (els.customStatus) els.customStatus.textContent = t; };
+
+  if (!baseURL) {
+    say('an address is required — aegis1 dials the endpoint you name, and refuses a custom call that names none.');
+    return;
+  }
+  // Checked here as well as server-side so the refusal is a sentence next to the
+  // field instead of a 400 that arrives after the model was declared. aegis1
+  // refuses http:// and every non-public target for this provider; saying so up
+  // front is the difference between a fixable typo and "custom is broken".
+  if (!/^https:\/\//i.test(baseURL)) {
+    say('refused: only an https:// endpoint is dialed — aegis1 rejects a plain-http or scheme-less base URL for this provider.');
+    return;
+  }
+  if (!model) {
+    say('a model id is required — the `custom` provider pins no default, so nothing would be selectable in the picker.');
+    return;
+  }
+
+  say('saving…');
+  const provider = `byok:${CUSTOM_PROVIDER}`;
+  try {
+    const cfg = {};
+    cfg.baseURL = baseURL;
+    if (key) cfg.key = key;
+    await models.settings.set(provider, cfg);
+  } catch (err) {
+    say(`endpoint not saved: ${err && err.message ? err.message : err}`);
+    return;
+  }
+  try {
+    await models.userModels.add(CUSTOM_PROVIDER, model);
+  } catch (err) {
+    say(`endpoint saved, model NOT declared: ${err && err.message ? err.message : err}`);
+    await loadCustomProvider();
+    await loadModels(els.classSelect.value).catch(() => {});
+    return;
+  }
+  if (els.customModel) els.customModel.value = '';
+  say(`saved ${baseURL} with model ${model} — pick it under provider "byok", then the model.`);
+  await loadCustomProvider();
+  await loadSettings();
+  await loadModels(els.classSelect.value).catch(() => {});
+}
+
+/** Forget the custom endpoint: the key row, then every declared custom model. */
+async function removeCustomProvider() {
+  if (!els.customBaseUrl) return;
+  const say = (t) => { if (els.customStatus) els.customStatus.textContent = t; };
+  say('removing…');
+  let removedModels = 0;
+  try {
+    const report = await models.userModels.get();
+    const map = (report && report.map) || {};
+    const declared = Array.isArray(map[CUSTOM_PROVIDER]) ? map[CUSTOM_PROVIDER] : [];
+    for (const model of declared) {
+      await models.userModels.remove(CUSTOM_PROVIDER, model);
+      removedModels += 1;
+    }
+  } catch {
+    /* declarations already gone, or unreadable — the key removal still runs */
+  }
+  try {
+    await models.settings.remove(`byok:${CUSTOM_PROVIDER}`);
+  } catch (err) {
+    say(`remove failed: ${err && err.message ? err.message : err}`);
+    return;
+  }
+  if (els.customBaseUrl) els.customBaseUrl.value = '';
+  say(`removed the custom endpoint${removedModels ? ` and ${removedModels} declared model(s)` : ''}.`);
+  await loadCustomProvider();
+  await loadSettings();
+  await loadModels(els.classSelect.value).catch(() => {});
+}
+
 async function saveSetting(provider, key) {
   els.settingsHint.textContent = 'saving…';
   try {
@@ -5540,6 +6170,14 @@ async function init() {
   // File > Save as… / Export Session… — same "menu pings, renderer acts"
   // pattern as New Chat/Search above; both call exportSession() with the
   // format the menu label promised (see main.js buildAppMenu).
+  // View > Authorship Panel… — the sidebar card that used to open the φ(α)
+  // sheet is gone (sealing runs in the background), so the menu is the entry
+  // point. `fpPanel` is mount()'s handle, assigned below in init().
+  if (aegis.onMenuFingerprint) {
+    aegis.onMenuFingerprint(() => {
+      if (fpPanel && typeof fpPanel.open === 'function') fpPanel.open();
+    });
+  }
   if (aegis.onMenuExportMarkdown) aegis.onMenuExportMarkdown(() => exportSession('markdown'));
   if (aegis.onMenuExportJson) aegis.onMenuExportJson(() => exportSession('json'));
   // aegis:// deep link (main.js sendDeepLinkToWindow) — delivered once the
@@ -5562,6 +6200,20 @@ async function init() {
     }
   });
 
+  // The custom-provider card (#custom-provider-card). Its three fields are one
+  // decision, so Enter in any of them runs the same Save the button does.
+  if (els.customSave) els.customSave.addEventListener('click', saveCustomProvider);
+  if (els.customRemove) els.customRemove.addEventListener('click', removeCustomProvider);
+  for (const box of [els.customBaseUrl, els.customKey, els.customModel]) {
+    if (!box) continue;
+    box.addEventListener('keydown', (e) => {
+      if (e.key === 'Enter') {
+        e.preventDefault();
+        saveCustomProvider();
+      }
+    });
+  }
+
   // Billing actions in the Status card — see startBilling()/renderBillingError().
   els.upgradePlan.addEventListener('click', () => startBilling('upgrade'));
   els.topupBtn.addEventListener('click', () => startBilling('topup'));
@@ -5818,9 +6470,16 @@ async function init() {
 
     els.updateDownloadBtn.addEventListener('click', () => {
       els.updateDownloadBtn.disabled = true;
-      aegis.downloadUpdate().finally(() => {
-        els.updateDownloadBtn.disabled = false;
-      });
+      // The resolved value is the post-install state: render it as well as
+      // waiting for the push, so a channel whose installer finishes inside the
+      // invoke still repaints (and so a failure surfaces even if the push
+      // channel is not wired yet).
+      Promise.resolve(aegis.downloadUpdate())
+        .then((state) => { if (state && state.status) renderUpdateBanner(state); })
+        .catch(() => {})
+        .finally(() => {
+          els.updateDownloadBtn.disabled = false;
+        });
     });
 
     // The only place quitAndInstallUpdate is ever called — an explicit user
@@ -5869,6 +6528,16 @@ async function init() {
   // (a host that predates the IPC handlers) leaves the card on "checking…"
   // instead of crashing boot. Not awaited: the panel's first status read is a
   // filesystem stat, and the welcome panel must not wait on it.
+  // The provider reference card and the daily line. Both are `?`-guarded by
+  // their own module presence, so a window whose build predates these scripts
+  // boots normally instead of throwing on a missing global.
+  try {
+    mountProviderToolbar();
+  } catch (e) {
+    if (els.ptHint) els.ptHint.textContent = `provider list unavailable: ${(e && e.message) || e}`;
+  }
+  wireCompanion();
+
   if (window.aegisFingerprint) {
     try {
       fpPanel = window.aegisFingerprint.mount({ api: aegis });