aegis-desktop 1.0.10 → 1.0.13

package/renderer/budget.js

@@ -89,16 +89,25 @@ const DEEPSEEK_REASONING_MODEL_RE = /^deepseek-(v4(\.\d+)?-(flash|pro)|flash|pro
 const EFFORT_TOKEN_BUDGET = { low: 8192, medium: 16384, high: 32768 };
 
 /**
- * DeepSeek native reasoning level per config rung. The field is
- * `reasoning_effort` (the API 200s and ignores a body key named `effort`), and
- * its enum — none|minimal|low|medium|high|xhigh|ultra|max — names every rung
- * of this knob, so the map is 1:1. Mirrors DEEPSEEK_EFFORT in
- * desktop/lib/local/engine.js, which mirrors the upstream engine's
- * src/backend.js — carried here so the no-drift guarantee for
- * DEEPSEEK_REASONING_MODEL_RE and EFFORT_TOKEN_BUDGET extends to the wire knob
- * too.
+ * DeepSeek native reasoning level per config rung.
+ *
+ * The field is `effort`, not `reasoning_effort`. Measured live 2026-10-21 on the
+ * surface this client actually reaches (the relay's
+ * `https://api.deepseek.com/anthropic` transport), interleaved paired samples,
+ * n=12, output tokens: absent 818 · low 772 · medium 836 · high 818 · max 1494.
+ * Only `max` separates from sending nothing, and `GET /models` reports
+ * `supported_levels: ["low","high","max"]` on both live ids — so `medium` is
+ * not a level these models have, and it is folded upward here rather than sent
+ * to be absorbed into the vendor's default (a 200 that changes nothing, which
+ * is the one failure this knob cannot surface). `max` stays unreachable: it is
+ * not a rung of this knob.
+ *
+ * Mirrors DEEPSEEK_EFFORT in desktop/lib/local/engine.js — carried here so the
+ * no-drift guarantee for DEEPSEEK_REASONING_MODEL_RE and EFFORT_TOKEN_BUDGET
+ * extends to the wire knob too. That guard was missing, which is how the two
+ * copies agreed on a field name that reached no vendor at all.
  */
-const DEEPSEEK_EFFORT = { low: 'low', medium: 'medium', high: 'high' };
+const DEEPSEEK_EFFORT = { low: 'low', medium: 'high', high: 'high' };
 
 /**
  * There is no longer a "class that requires a stated max_tokens".

package/renderer/companion.js

@@ -0,0 +1,225 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
+'use strict';
+
+/**
+ * companion.js — the one greeting the app writes to you, once a day.
+ *
+ * WHAT THIS IS NOT. It is not a notification, a pop-up, a badge, or anything
+ * that interrupts. It is one line in the sidebar that changes at most once per
+ * local day and can be dismissed for that day. A "daily reminder" that steals
+ * focus is a nag; the whole value here is that it is quiet enough to read.
+ *
+ * THE RULE THAT SHAPES EVERY MESSAGE: it may only say things this process
+ * actually knows. There is no engagement metric in this file, no invented
+ * streak, no "you usually work on Tuesdays". Every candidate message reads its
+ * facts from the `facts` object the caller passes, and a message whose facts
+ * are absent is not a candidate at all — it is never shown with a guess in the
+ * blank. That is why `pickMessage` returns `{ kind, ... }` rather than a
+ * pre-baked string: the copy is chosen by which facts exist, and each branch
+ * says exactly which ones it used.
+ *
+ * Determinism matters for the daily behaviour: the same local day and the same
+ * facts must select the same message, or a re-render (which happens on every
+ * status read) would flip the suggestion while the user is looking at it. The
+ * rotation between equally-valid tips is therefore seeded from the day key,
+ * never from Math.random().
+ *
+ * Pure: no DOM, no Electron, no fs, no clock of its own — `now` is passed in.
+ */
+
+/**
+ * The local calendar day, as YYYY-MM-DD.
+ *
+ * Local, not UTC, on purpose: "a daily reminder" means the user's day. A UTC
+ * key would roll the message over at 01:00 or 02:00 for most of Europe, which
+ * is the middle of the evening for the people most likely to be running this.
+ */
+function dayKey(now) {
+  const d = now instanceof Date ? now : new Date(now == null ? Date.now() : now);
+  if (Number.isNaN(d.getTime())) return '';
+  const p = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
+
+/** Whole local days between two timestamps; null when either is unusable. */
+function daysBetween(a, b) {
+  const t1 = a instanceof Date ? a.getTime() : Number(a);
+  const t2 = b instanceof Date ? b.getTime() : Number(b);
+  if (!Number.isFinite(t1) || !Number.isFinite(t2)) return null;
+  const d1 = new Date(t1); d1.setHours(0, 0, 0, 0);
+  const d2 = new Date(t2); d2.setHours(0, 0, 0, 0);
+  return Math.round((d2.getTime() - d1.getTime()) / 86400000);
+}
+
+/** Stable small hash, so tip rotation is deterministic per day. */
+function hash(s) {
+  let h = 2166136261;
+  const str = String(s);
+  for (let i = 0; i < str.length; i += 1) {
+    h ^= str.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+
+/**
+ * Tips that are TRUE OF THIS BUILD — each one names a real affordance. They are
+ * the fallback rotation once nothing needs attention; none of them is a "come
+ * back and use the app more" nudge, because that would be the app asking for
+ * the user's time rather than giving them something back.
+ */
+const TIPS = Object.freeze([
+  { id: 'effort', text: 'Effort sizes the call — low for quick edits, high when the answer has to be complete.' },
+  { id: 'tools', text: 'Turn on "confirm before running tools" in Tool approvals to see every command before it runs.' },
+  { id: 'quick', text: 'The Quick Launcher shortcut opens a prompt from anywhere — no need to switch windows.' },
+  { id: 'sessions', text: 'Sessions → Export writes the thread out as a file you keep, not something held in the app.' },
+  { id: 'queue', text: 'Queued tasks run on their own class — they can stay on Aegis Cloud while you work locally.' },
+  { id: 'memory', text: 'Memory entries are yours: the inspector shows the source and tags for every one.' },
+  { id: 'local', text: 'Local model needs no key and no network — useful for anything you would rather not send anywhere.' },
+]);
+
+/**
+ * Choose today's message.
+ *
+ * `facts` (all optional; each one absent merely removes its branch):
+ *   keyConfigured  {boolean} an AEGIS API key exists on this machine
+ *   modelCount     {number}  how many models the current class listed
+ *   lastTurnAt     {number}  epoch ms of the last finished turn, if any
+ *   firstSeenAt    {number}  epoch ms this install first ran
+ *   queuePending   {number}  unfinished queued tasks
+ *   memoryCount    {number}  memory entries visible in the inspector
+ *   providerNeedsKey {boolean} byok class has models but no provider key
+ *   updatePending  {string}  version string of a downloaded update, if any
+ *
+ * Returns `{ id, kind, text, usedFacts }` — `kind` is 'action' when the message
+ * points at something concrete to do and 'tip' when it is just the rotation.
+ */
+function pickMessage(facts, now) {
+  const f = facts && typeof facts === 'object' ? facts : {};
+  const day = dayKey(now);
+  const used = [];
+  const pick = (id, kind, text, keys) => ({
+    id,
+    kind,
+    text,
+    day,
+    usedFacts: keys.filter((k) => f[k] !== undefined && f[k] !== null),
+  });
+
+  // 1. An update that is downloaded and waiting is the single most actionable
+  //    thing the app can know: it is finished work sitting idle until restart.
+  if (typeof f.updatePending === 'string' && f.updatePending) {
+    return pick(
+      'update-ready',
+      'action',
+      `Update ${f.updatePending} is downloaded — restart when it suits you, it installs on quit.`,
+      ['updatePending'],
+    );
+  }
+
+  // 2. No key at all: the app can barely do anything, and the remedy is one
+  //    paste. Not an error message — a reminder is allowed to be the first
+  //    place the user hears it, so it is phrased as an invitation.
+  if (f.keyConfigured === false) {
+    return pick(
+      'connect',
+      'action',
+      'Paste your AEGIS API key in Status to run turns on Aegis Cloud — or pick Local model below for no key at all.',
+      ['keyConfigured'],
+    );
+  }
+
+  // 3. A provider class chosen with models listed but no provider key: the user
+  //    has already walked to the door and has not opened it.
+  if (f.providerNeedsKey === true) {
+    return pick(
+      'provider-key',
+      'action',
+      'Your provider class has models listed but no key saved — add one in Provider settings to use them.',
+      ['providerNeedsKey'],
+    );
+  }
+
+  // 4. Queued work still waiting. Counted, never estimated: "3 queued" is a
+  //    fact, "your queue is busy" would be a guess about progress.
+  if (typeof f.queuePending === 'number' && f.queuePending > 0) {
+    return pick(
+      'queue',
+      'action',
+      `${f.queuePending} queued task${f.queuePending === 1 ? '' : 's'} still waiting — the queue card runs ${f.queuePending === 1 ? 'it' : 'them'} on its own class.`,
+      ['queuePending'],
+    );
+  }
+
+  // 4b. Memory this install already holds. Documented in the facts list from
+  //     the day this file was written, but with no branch behind it — so a user
+  //     with twenty saved entries was told nothing about them and got a generic
+  //     tip instead. Counted exactly, and it points at the inspector, which is
+  //     the only place in the app where the provenance of each entry is shown.
+  if (typeof f.memoryCount === 'number' && f.memoryCount > 0) {
+    return pick(
+      'memory-held',
+      'action',
+      `${f.memoryCount} memory entr${f.memoryCount === 1 ? 'y is' : 'ies are'} already saved here — the inspector shows the source and tags for every one.`,
+      ['memoryCount'],
+    );
+  }
+
+  // 5. First-run, no key required path: say what the app is, once. Only on the
+  //    FIRST local day, so it does not become a permanent fixture.
+  const age = daysBetween(f.firstSeenAt, now);
+  if (age === 0 && f.lastTurnAt == null) {
+    return pick(
+      'first-day',
+      'tip',
+      'First day. Pick a class and a model in the Model card, then send a turn — everything else here is optional.',
+      ['firstSeenAt', 'lastTurnAt'],
+    );
+  }
+
+  // 6. A gap after real use. Reported only when there is a genuine last turn,
+  //    and only past a threshold where the observation is worth stating; below
+  //    it, nothing is said at all (fall through to the rotation).
+  const since = daysBetween(f.lastTurnAt, now);
+  if (since != null && since >= 3) {
+    return pick(
+      'returning',
+      'tip',
+      'Last turn was a few days ago — your sessions and queued tasks are still here.',
+      ['lastTurnAt'],
+    );
+  }
+
+  // 7. Nothing needs attention: rotate one true tip, seeded by the day so it is
+  //    stable for the whole day and different tomorrow.
+  const tip = TIPS[hash(day) % TIPS.length];
+  return pick(`tip-${tip.id}`, 'tip', tip.text, ['tipRotation']);
+}
+
+/** True when this message was already dismissed today. */
+function dismissedToday(dismissed, now) {
+  const d = dismissed && typeof dismissed === 'object' ? dismissed : null;
+  if (!d) return false;
+  return d.day === dayKey(now);
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = { pickMessage, dayKey, daysBetween, dismissedToday, TIPS };
+}
+
+// Also a page global, because index.html loads this file as a classic script
+// (`<script src="companion.js">`) and app.js reads window.aegisCompanion. The
+// module branch above is for Node (test/renderer-providers.test.mjs requires
+// the file directly); the two are mutually exclusive in practice — a classic
+// script has no `module` — so this cannot clobber the module export.
+if (typeof window !== 'undefined') {
+  (window.aegisCompanion = window.aegisCompanion || {}).pickMessage = pickMessage;
+  window.aegisCompanion.dayKey = dayKey;
+  window.aegisCompanion.daysBetween = daysBetween;
+  window.aegisCompanion.dismissedToday = dismissedToday;
+  window.aegisCompanion.TIPS = TIPS;
+}

package/renderer/fingerprint.css

@@ -54,6 +54,22 @@
   display: none;
 }
 
+/* Which of the three destinations a publish/backup goes to. A row of
+   buttons, not a <select>: `aria-pressed` on the active one is the whole
+   state fingerprint.js's paintVaultBackend() paints, and three named options
+   read faster than a dropdown you have to open to see the current one. */
+.fp-vault-backend {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  padding: 8px 16px 0;
+}
+
+.fp-backend-btn[aria-pressed='true'] {
+  border-color: var(--teal);
+  color: var(--teal);
+}
+
 .fp-controls {
   display: flex;
   flex-direction: column;

package/renderer/fingerprint.js

@@ -57,6 +57,9 @@
     keyTag: 'fp-key-tag',
     keyWarning: 'fp-key-warning',
     vaultTarget: 'fp-vault-target',
+    vaultBackendDrive: 'fp-vault-backend-drive',
+    vaultBackendCloud: 'fp-vault-backend-aegiscloud',
+    vaultBackendOff: 'fp-vault-backend-off',
     label: 'fp-label',
     publishOnMint: 'fp-publish-on-mint',
     autoSeal: 'fp-auto-seal',
@@ -75,6 +78,10 @@
     audit: 'fp-audit',
     vaultList: 'fp-vault-list',
     out: 'fp-out',
+    driveStatus: 'fp-drive-status',
+    driveSignIn: 'fp-drive-signin',
+    driveConnect: 'fp-drive-connect',
+    driveSyncNow: 'fp-drive-sync',
   };
 
   // ------------------------------------------------------------- formatting
@@ -136,6 +143,23 @@
     });
   }
 
+  /**
+   * The one-line summary of the Google Drive card — `desktop/lib/
+   * google-connect.js`'s `status()` shape, `{signedIn, connected, email}`.
+   *
+   * Three distinct states, because "not connected" means something different
+   * depending on whether this machine has signed in with Google at all:
+   * connecting Drive before signing in attaches the tokens to a different
+   * account than the one this machine polls (see google-connect.js's header
+   * comment), so the line has to say WHICH step is next, not just "no".
+   */
+  function driveLine(status) {
+    if (!status || status.ok === false) return (status && status.error) || 'unavailable';
+    if (!status.signedIn) return 'not signed in — sign in with Google first';
+    if (!status.connected) return 'signed in · Google Drive not connected yet';
+    return `Google Drive connected${status.email ? ` · ${status.email}` : ''}`;
+  }
+
   /** The anchor answer, kept as three separate claims on purpose: "the file is
    *  gone", "the file was replaced" and "the key that sealed it has moved on"
    *  are three different situations, and one boolean hides the interesting one
@@ -276,7 +300,19 @@
         warn.hidden = !w;
       }
       if (vt && s && s.vault) {
-        vt.textContent = `${dash(s.vault.remote)}:${dash(s.vault.recordsDir || s.vault.root)}`;
+        // The default backend is the account (`aegiscloud`), where "gdrive" is
+        // not where anything goes — printing `gdrive:AEGIS-AGPL/records` for a
+        // cloud publish would name a folder the record never touches. Say the
+        // backend for that case, and keep the remembered rclone target for the
+        // case where it IS a remote. 'off' names neither — nothing is resolved
+        // behind it (desktop/lib/fingerprint.js's status() short-circuits
+        // before ever calling vaultTarget()), so the line says so plainly
+        // rather than printing the leftover "–:–" two dashes would read as.
+        vt.textContent = s.vault.backend === 'off'
+          ? 'nothing — sync is off'
+          : s.vault.backend === 'aegiscloud'
+            ? `aegiscloud:${dash(s.vault.recordsDir)}`
+            : `${dash(s.vault.remote)}:${dash(s.vault.recordsDir || s.vault.root)}`;
       } else if (vt) {
         vt.textContent = '–';
       }
@@ -287,6 +323,90 @@
       if (kg) kg.textContent = s && s.configured ? 'Replace key…' : 'Mint key';
     }
 
+    /**
+     * The three backend buttons' pressed state.
+     *
+     * Deliberately read from `getVaultBackend` (the preference the user set),
+     * NOT from `status().vault.backend` (the resolved record-vault.js
+     * backend id): the preference vocabulary is 'aegiscloud' | 'drive' | 'off',
+     * the resolved one is 'aegiscloud' | 'rclone' | 'off' — a 'drive'
+     * preference resolves to 'rclone', so pressing "Google Drive" from status
+     * alone would never read back as pressed.
+     */
+    function paintVaultBackend(backend) {
+      const map = {
+        drive: el(IDS.vaultBackendDrive),
+        aegiscloud: el(IDS.vaultBackendCloud),
+        off: el(IDS.vaultBackendOff),
+      };
+      for (const [key, btn] of Object.entries(map)) {
+        if (btn) btn.setAttribute('aria-pressed', String(key === backend));
+      }
+    }
+
+    async function loadVaultBackend() {
+      const r = await call('getVaultBackend');
+      state.vaultBackend = r && r.backend ? r.backend : 'aegiscloud';
+      paintVaultBackend(state.vaultBackend);
+      return state.vaultBackend;
+    }
+
+    const doSetVaultBackend = (backend) =>
+      action(`vault: ${backend === 'drive' ? 'Google Drive' : backend === 'off' ? 'no sync' : 'AE'}`, async () => {
+        const r = await call('setVaultBackend', backend);
+        return r && r.backend ? { ok: true, ...r } : { ok: false, error: 'could not save that' };
+      }, {
+        // The "publishes to" line names the backend too, so both it and the
+        // three buttons must repaint the moment the preference changes — not
+        // just on the next open().
+        after: (r) => (r && r.ok ? refresh() : null),
+        say: (r) => (r.ok ? `vault backend set to ${dash(r.backend)}` : `could not save that: ${r.error}`),
+      });
+
+    /**
+     * Google Drive — memory backup (desktop/lib/google-connect.js, exposed
+     * over `aegis.driveSignIn`/`driveConnect`/`driveStatus`/`driveSyncMemory`).
+     *
+     * Distinct from the vault backend buttons above: those choose where a
+     * SEALED φ(α) RECORD is published (rclone or the account vault). This is
+     * the account's AEGIS CLOUD MEMORY, backed up to the user's own Drive
+     * through real Google OAuth — unrelated data, unrelated credential.
+     */
+    function paintDrive(status) {
+      const line = el(IDS.driveStatus);
+      if (line) line.textContent = driveLine(status);
+      const connectBtn = el(IDS.driveConnect);
+      if (connectBtn) connectBtn.disabled = Boolean(status && !status.signedIn);
+      const syncBtn = el(IDS.driveSyncNow);
+      if (syncBtn) syncBtn.disabled = Boolean(!status || !status.connected);
+    }
+
+    async function loadDriveStatus() {
+      const r = await call('driveStatus');
+      state.drive = r;
+      paintDrive(r);
+      return r;
+    }
+
+    const doDriveSignIn = () =>
+      action('sign in with Google', () => call('driveSignIn'), {
+        after: (r) => (r && r.ok ? loadDriveStatus() : null),
+        say: (r) => (r.ok ? `signed in${r.username ? ` as ${r.username}` : ''}` : `sign-in failed: ${r.error}`),
+      });
+
+    const doDriveConnect = () =>
+      action('connect Google Drive', () => call('driveConnect'), {
+        after: (r) => (r && r.ok ? loadDriveStatus() : null),
+        say: (r) => (r.ok ? `Google Drive connected${r.email ? ` · ${r.email}` : ''}` : `could not connect: ${r.error}`),
+      });
+
+    const doDriveSyncNow = () =>
+      action('back up memory to Drive', () => call('driveSyncMemory'), {
+        say: (r) => (r.ok
+          ? `backed up ${r.count} memory entr${r.count === 1 ? 'y' : 'ies'}${r.webViewLink ? ` → ${r.webViewLink}` : ''}`
+          : `backup failed: ${r.error}`),
+      });
+
     function paintVault(list) {
       const ul = el(IDS.vaultList);
       if (!ul) return;
@@ -312,6 +432,8 @@
       state.status = await call('fingerprintStatus');
       paintStatus();
       await loadAutoMint();
+      await loadVaultBackend();
+      await loadDriveStatus();
       return state.status;
     }
 
@@ -547,6 +669,12 @@
     bind(IDS.backup, 'click', doBackup);
     bind(IDS.vault, 'click', doVault);
     bind(IDS.audit, 'click', doAudit);
+    bind(IDS.vaultBackendDrive, 'click', () => doSetVaultBackend('drive'));
+    bind(IDS.vaultBackendCloud, 'click', () => doSetVaultBackend('aegiscloud'));
+    bind(IDS.vaultBackendOff, 'click', () => doSetVaultBackend('off'));
+    bind(IDS.driveSignIn, 'click', doDriveSignIn);
+    bind(IDS.driveConnect, 'click', doDriveConnect);
+    bind(IDS.driveSyncNow, 'click', doDriveSyncNow);
     // The auto-seal switch is the ONE control on this panel that can file a
     // record with nobody watching, so it is the one that must repaint from
     // main's answer rather than from the checkbox the user just clicked.
@@ -567,7 +695,12 @@
       state,
       // Exposed for the test and for app.js's on-demand repaint. Every one is
       // idempotent, so calling them from a console is safe.
-      actions: { doKeygen, doSeal, doSealNow, doVerify, doPublish, doAnchor, doBackup, doVault, doAudit },
+      actions: {
+        doKeygen, doSeal, doSealNow, doVerify, doPublish, doAnchor, doBackup, doVault, doAudit,
+        doSetVaultBackend, doDriveSignIn, doDriveConnect, doDriveSyncNow,
+      },
+      loadVaultBackend,
+      loadDriveStatus,
     };
   }
 
@@ -583,6 +716,7 @@
     auditVerdict,
     sealLine,
     autoMintLine,
+    driveLine,
     dash,
   };
 });