aegis-desktop 1.0.10 → 1.0.13

package/renderer/index.html

@@ -99,61 +99,100 @@
         <p class="hint" id="billing-hint"></p>
       </section>
 
-      <section class="card">
-        <h2>Model</h2>
-        <label for="class-select">Provider class</label>
-        <select id="class-select"></select>
-
-        <label for="model-select">Model</label>
-        <select id="model-select"></select>
-        <!-- Typed model tag. Hidden unless the local class has no list to pick
-             from: a daemon that is not running, or one that does not speak
-             Ollama's /api/tags (llama.cpp, LM Studio, vLLM). Those still serve
-             the OpenAI-compatible chat route, so a typed tag is a working path,
-             not a fallback that cannot send. Was a dead <input> left behind
-             when the custom-endpoint class was removed. -->
-        <input
-          type="text"
-          id="model-input"
-          placeholder="model tag — e.g. llama3.2:3b"
-          autocomplete="off"
-          spellcheck="false"
-          hidden
-        />
+      <!-- TWO cards, and the split is the point: a provider the relay's
+           catalog names is configured by a KEY alone, while a custom endpoint
+           is configured by an ADDRESS. They cannot share one row shape, which
+           is what this markup used to require.
 
-        <!-- The one budget control, for every class and every model.
-
-             It replaced a "Max tokens" dropdown (1k/4k/16k/64k/300k plus an
-             "adaptive" checkbox) that asked the user to state, up front, how
-             many tokens an answer would need. That cannot be known from the
-             prompt — it is a guess at the length of text nobody has written
-             yet — and the guess was wrong in both directions:
-
-               - the pooled AEGIS Cloud class sizes each call server-side from
-                 effort (aegis1 services/pool_brain.py pass_budgets:
-                 low/medium/high -> 16384/32768/65536 tokens total across the
-                 worker fan-out), and it reads a body max_tokens as a ceiling
-                 OVER that ladder, so the number on screen was never the
-                 budget the call ran on;
-               - a DeepSeek reasoning model (deepseek-flash, i.e. "Flash 4.1")
-                 bills hidden chain-of-thought against the same budget as its
-                 answer, so the dropdown's 4k default was spent before the
-                 first visible token and the turn came back empty — no error,
-                 no tool call, just a turn that "completed" with nothing.
-
-             So the budget is derived from this rung instead. The engine maps
-             low/medium/high to 8192/16384/32768 (EFFORT_TOKEN_BUDGET in
-             desktop/lib/local/engine.js, mirroring the upstream engine's
-             src/backend.js), "auto" leaves the choice to the server, and no
-             max_tokens is stated by this app at all. The row is always on
-             screen: with the dropdown gone there is nothing to swap it for. -->
-        <div class="budget-row" id="effort-row">
-          <label for="effort-select" title="Sizes the call's token budget. Output length cannot be predicted from the prompt, so the budget comes from this rung instead of a stated number.">Effort</label>
-          <select id="effort-select">
-            <option value="low">low</option>
-            <option value="medium">medium</option>
-            <option value="high" selected>high</option>
-          </select>
+             - #provider-paths-card (catalog): the class/model/effort bar, one
+               key row per provider `GET /api/v1/byok/providers` names, the
+               user's own model declarations, and the list of every route.
+             - #custom-provider-card: a base URL, a key and a model id for the
+               `custom` provider — a vendor this catalog does not name, or a
+               self-hosted OpenAI-compatible server. aegis1 reads that address
+               per request (`_byok_custom_base_url`), and no other provider
+               takes one, so its row cannot be a key row with a second field
+               bolted on: it is a different decision, and it gets its own card.
+
+           Before the split, `custom` came back from the catalog as an ordinary
+           key row with no base-URL field at all — a route that could be given a
+           key and then never dialed, since the server refuses a custom call
+           that names no address. Named here rather than in a code comment
+           because the arrangement of these two sections IS the fix.
+
+           Rows in the catalog card are painted by provider-toolbar.js from
+           providers.js; this markup is the container only.
+
+           Deliberately NOT in either list: the φ(α) seal (not a provider — it
+           publishes a record of a repo) and the autonomous fan-out (a property
+           of a turn on the pooled class, reaching no route the pooled row does
+           not already name). Asserted in test/renderer-providers.test.mjs. -->
+      <section class="card" id="provider-paths-card">
+        <h2>Model &amp; provider</h2>
+
+        <!-- The bar. Class first, then the model it offers, then the effort
+             rung, because that is the order the decision is made in and each
+             control is meaningless before the one to its left. -->
+        <div class="pt-toolbar" id="pt-toolbar">
+          <label class="pt-field" for="class-select">
+            <span>provider</span>
+            <select id="class-select"></select>
+          </label>
+
+          <label class="pt-field" for="model-select">
+            <span>model</span>
+            <select id="model-select"></select>
+          </label>
+
+          <!-- Typed model tag. Hidden unless the local class has no list to
+               pick from: a daemon that is not running, or one that does not
+               speak Ollama's /api/tags (llama.cpp, LM Studio, vLLM). Those
+               still serve the OpenAI-compatible chat route, so a typed tag is
+               a working path, not a fallback that cannot send. -->
+          <input
+            type="text"
+            id="model-input"
+            placeholder="model tag — e.g. llama3.2:3b"
+            autocomplete="off"
+            spellcheck="false"
+            hidden
+          />
+
+          <!-- The one budget control, for every class and every model.
+
+               It replaced a "Max tokens" dropdown (1k/4k/16k/64k/300k plus an
+               "adaptive" checkbox) that asked the user to state, up front, how
+               many tokens an answer would need. That cannot be known from the
+               prompt — it is a guess at the length of text nobody has written
+               yet — and the guess was wrong in both directions:
+
+                 - the pooled AEGIS Cloud class sizes each call server-side
+                   from effort (aegis1 services/pool_brain.py pass_budgets:
+                   low/medium/high -> 16384/32768/65536 tokens total across the
+                   worker fan-out), and it reads a body max_tokens as a ceiling
+                   OVER that ladder, so the number on screen was never the
+                   budget the call ran on;
+                 - a DeepSeek reasoning model (deepseek-flash, i.e. "Flash 4.1")
+                   bills hidden chain-of-thought against the same budget as its
+                   answer, so the dropdown's 4k default was spent before the
+                   first visible token and the turn came back empty — no error,
+                   no tool call, just a turn that "completed" with nothing.
+
+               So the budget is derived from this rung instead. The engine maps
+               low/medium/high to 8192/16384/32768 (EFFORT_TOKEN_BUDGET in
+               desktop/lib/local/engine.js, mirroring the upstream engine's
+               src/backend.js), "auto" leaves the choice to the server, and no
+               max_tokens is stated by this app at all. The control is always
+               on the bar: with the dropdown gone there is nothing to swap it
+               for. -->
+          <span class="budget-row" id="effort-row">
+            <label for="effort-select" title="Sizes the call's token budget. Output length cannot be predicted from the prompt, so the budget comes from this rung instead of a stated number.">effort</label>
+            <select id="effort-select">
+              <option value="low">low</option>
+              <option value="medium">medium</option>
+              <option value="high" selected>high</option>
+            </select>
+          </span>
         </div>
 
         <!-- What the rung above means for the model selected right now, in
@@ -182,13 +221,113 @@
             title="How many reasoning workers this turn fans out to. Every worker is a separate full model call on the same tier, so the turn costs roughly this number plus one times a normal one — higher is not automatically better."
           />
         </div>
-        <p class="hint" id="model-hint"></p>
-      </section>
 
-      <section class="card">
-        <h2>Provider settings</h2>
+        <!-- The key for whatever the bar is pointed at. These rows are built by
+             loadSettings(): one for the local server's base URL (always — it
+             needs no key and no account), and one per provider the server's
+             catalog names, each saving to `byok:<id>`. The row for the class on
+             the bar is the one that matters, and it is here rather than in a
+             card of its own so "provider: byok:anthropic" and "paste the
+             Anthropic key" are never more than one glance apart.
+
+             `custom` is built here as a row like any other and then REMOVED by
+             loadSettings(), because the card below is where it is configured:
+             its address is a field the catalog rows do not have, and a row that
+             saved a key with nowhere to send it is the defect this split fixes.
+             See #custom-provider-card. -->
         <div id="settings-list"></div>
         <p class="hint" id="settings-hint"></p>
+        <p class="hint" id="model-hint"></p>
+
+        <div class="pt-bar">
+          <input
+            type="text"
+            id="pt-search"
+            placeholder="Filter providers, models, URLs…"
+            autocomplete="off"
+            spellcheck="false"
+          />
+          <button type="button" id="pt-refresh" class="ghost-btn">Refresh</button>
+        </div>
+        <p class="hint" id="pt-count"></p>
+        <ul class="pt-list" id="pt-list"></ul>
+        <p class="hint" id="pt-hint"></p>
+      </section>
+
+      <!-- A provider the relay's catalog does not name: an OpenAI-compatible
+           endpoint you run or subscribe to yourself. Separate from the catalog
+           card above because the two ask different things — this one needs an
+           ADDRESS as well as a key, and the model id it pins has to be declared
+           too (aegis1's `custom` descriptor pins no default_model, so the relay
+           catalog offers no custom model row for the picker to show).
+
+           What saving here writes, and why all three:
+             1. `byok:custom` in the settings store — the base URL aegis1 reads
+                per call (app.py `_byok_custom_base_url`: https only, no
+                loopback/private target) plus the vendor key;
+             2. the model id into the user-models file (`client/user-models.js`,
+                the same one the CLI's `/model-add` writes), because that file
+                is what `listModels('byok')` folds into the picker;
+             3. nothing else — no catalog row, no class of its own.
+
+           The three fields are one decision, so they share one card and one
+           Save: a saved key with no address is undialable, and an address with
+           no declared model is a route the picker cannot offer. -->
+      <section class="card" id="custom-provider-card">
+        <h2>Custom provider</h2>
+        <p class="hint" id="custom-hint">
+          Any OpenAI-compatible endpoint — vLLM, LiteLLM, a gateway, or a vendor
+          this build does not know. Saved as <code>byok:custom</code>.
+        </p>
+
+        <label class="pt-field" for="custom-base-url">
+          <span>base url (https://…)</span>
+          <input
+            type="text"
+            id="custom-base-url"
+            placeholder="https://my-vllm.example/v1"
+            autocomplete="off"
+            spellcheck="false"
+          />
+        </label>
+
+        <label class="pt-field" for="custom-key">
+          <span>api key</span>
+          <input
+            type="password"
+            id="custom-key"
+            placeholder="sk-…"
+            autocomplete="off"
+          />
+        </label>
+
+        <label class="pt-field" for="custom-model">
+          <span>model id</span>
+          <input
+            type="text"
+            id="custom-model"
+            placeholder="llama-3-70b"
+            autocomplete="off"
+            spellcheck="false"
+          />
+        </label>
+
+        <div class="api-key-row">
+          <button type="button" id="custom-save" class="ghost-btn">Save provider</button>
+          <button type="button" id="custom-remove" class="ghost-btn danger">Remove</button>
+        </div>
+        <p class="hint" id="custom-status"></p>
+      </section>
+
+      <!-- One line, once a local day, built only from facts this app actually
+           holds (companion.js). Dismissing it hides it until tomorrow; the
+           button is present in markup so the card never reflows on first paint. -->
+      <section class="card" id="companion-card" hidden>
+        <h2>Today</h2>
+        <p class="companion-line" id="companion-text"></p>
+        <div class="companion-row">
+          <button type="button" id="companion-dismiss" class="ghost-btn">Got it</button>
+        </div>
       </section>
 
       <section class="card">
@@ -245,7 +384,7 @@
             type="button"
             class="card-title-btn"
             id="memory-open"
-            title="Open the memory inspector — every entry with its source, tags and topics"
+            title="Open the memory inspector — every entry with its source and tags"
           >
             <span>Memory</span>
             <span class="ctb-expand" aria-hidden="true">⤢</span>
@@ -273,13 +412,21 @@
         <p class="hint" id="memory-hint"></p>
       </section>
 
-      <section class="card">
-        <!-- The local autonomous work queue (desktop/lib/local/queue.js +
-             autonomous.js, exposed as window.queue). This card is the WHOLE
-             gate on it: a task runs only when one of the two buttons below is
-             clicked. There is no drain-at-startup and no interval anywhere in
-             app.js or main.js, because a drain spends real money on a real
-             model inside the folder named here.
+      <section class="card" id="queue-card" hidden>
+        <!-- HIDDEN ON PURPOSE (user request): the queue is a background worker
+             now, not a panel on the desktop. The card stays in the document
+             ONLY so the ids app.js and its tests already resolve keep existing —
+             `renderQueueState()`, `loadAutoState()` and the queue model pickers
+             paint into these nodes, and an absent node turns a paint into a
+             throw. Nothing here is visible, focusable or tab-reachable while
+             `hidden` is set, and no affordance offers to un-hide it.
+
+             The worker itself runs from the main process (desktop/lib/auto.js):
+             it drains pending tasks on its own cadence and seals a quiet
+             session, both switched on by default (settings.js
+             `__autoDrain`/`__autoMint`), so queueing a task and walking away is
+             the normal path. Turning either off is a settings-store write, not
+             a click on this card.
 
              The list below is state, not a transcript: the worker's own output
              arrives on queue:progress and is shown as a status line and each
@@ -361,7 +508,7 @@
         <label
           class="flow-toggle"
           for="queue-auto"
-          title="Drain pending tasks on a timer, with no click. Off by default. Each drain runs a full tool loop on a real model in the task's own checkout — the timer only ever drains tasks already in this queue, and main.js refuses the tick if another host (the CLI, a systemd worker) holds the lock."
+          title="Drain pending tasks on a timer, with no click. On by default (this switch only turns it off). Each drain runs a full tool loop on a real model in the task's own checkout — the timer only ever drains tasks already in this queue, and main.js refuses the tick if another host (the CLI, a systemd worker) holds the lock."
         >
           <input type="checkbox" id="queue-auto" />
           <span id="queue-auto-label">drain automatically</span>
@@ -380,8 +527,17 @@
         <div class="queue-upgrade" id="queue-upgrade"></div>
       </section>
 
-      <section class="card">
-        <!-- φ(α) — the authorship key and the sealed session records.
+      <section class="card" id="authorship-card" hidden>
+        <!-- HIDDEN ON PURPOSE (user request): sealing is a background worker
+             now. The authorship panel is still reachable — ⌘/Ctrl-K style menu
+             paths and `window.aegisFingerprint` are unchanged — but this entry
+             card no longer sits on the desktop and never prompts for a click.
+             Kept in the document for the same reason as the queue card above:
+             `fp-card-status` is painted by renderer/fingerprint.js and
+             `fp-open` is the panel's own open seam, and an absent node is a
+             silent no-op in one and a thrown paint in the other.
+
+             φ(α) — the authorship key and the sealed session records.
              The heading is the click target for the full panel, exactly like
              the Memory card (a <button> may only hold phrasing content, so the
              button goes inside the h2, never around it).
@@ -424,38 +580,20 @@
             <div class="title" id="chat-greeting">Hello</div>
           </div>
           <div class="sub" id="welcome-tagline">Your intent, AI automated.</div>
-          <div class="sub">
-            Ask anything — or start with one of these.
-          </div>
-          <div class="chat-quick-actions">
-            <button class="chat-quick-pill" type="button" data-quick="Write a ">
-              <span class="qp-ic">✎</span>Write code
-            </button>
-            <button class="chat-quick-pill" type="button" data-quick="Explain how ">
-              <span class="qp-ic">✦</span>Explain a concept
-            </button>
-            <button
-              class="chat-quick-pill"
-              type="button"
-              data-quick="Help me debug this error:&#10;&#10;"
-            >
-              <span class="qp-ic">🐛</span>Debug an error
-            </button>
-            <button
-              class="chat-quick-pill"
-              type="button"
-              data-quick="Compare two approaches to "
-            >
-              <span class="qp-ic">⇄</span>Weigh two options
-            </button>
-            <button
-              class="chat-quick-pill"
-              type="button"
-              data-quick="Help me plan "
-            >
-              <span class="qp-ic">⊞</span>Plan a project
-            </button>
-          </div>
+          <!-- One line, chosen from what this process actually knows about THIS
+               install — never a menu of canned topics. The five generic pills
+               that used to sit here ("Write code", "Explain a concept", …) were
+               the same list on every machine for every user: a topic menu is
+               not a welcome, it is a form to fill in. The line below is built
+               by welcomePersonalize() in app.js from the same fact-gated rules
+               as the sidebar's daily message (renderer/companion.js): an
+               update that is downloaded and waiting, a missing key with the one
+               concrete step, or memory entries this account already holds. When
+               no fact is present it rotates one true tip, seeded by the day;
+               when there is nothing to say at all it stays hidden rather than
+               guessing. `hidden` is in the markup so a render that never runs
+               shows nothing instead of an empty box. -->
+          <p class="sub welcome-personal" id="welcome-personal" hidden></p>
           <!-- Why AEGIS Desktop, and the ONE reason to pay.
                Phase 3 of docs/upgrade-conversion-plan.md. This block used to
                carry four competing bullets (local, your key, does the work,
@@ -585,7 +723,14 @@
           rows="2"
           placeholder="Message AEGIS… (Enter to send, Shift+Enter for a newline)"
         ></textarea>
-        <div class="composer-side">
+        <!-- The composer's control row: every switch that changes what this
+             send will do lives INSIDE the composer box, on one line under the
+             input, so the whole thing reads as one object with one focus ring.
+             Before this, the discovery toggle sat in a side rail and the tool
+             mode sat in a strip underneath the form — three surfaces around
+             one text field, and the mode chip (which changes whether tools run
+             unattended) was the furthest from the thing it governs. -->
+        <div class="composer-row">
           <label
             class="flow-toggle"
             for="explore-toggle"
@@ -597,26 +742,26 @@
             <input type="checkbox" id="explore-toggle" />
             <span>discovery lane</span>
           </label>
+          <!-- Mode chip: the same switch as Settings → Tool approvals, hoisted
+               next to the input so the current mode is readable while typing
+               and one click from the other. Painted from
+               renderConfirmMode()/renderAutoModeChip() in app.js, so the two
+               cannot disagree. type="button" so it never submits the form. -->
+          <button
+            type="button"
+            id="auto-mode-toggle"
+            class="mode-chip"
+            aria-pressed="false"
+            title="Auto mode lets the agent run exec, writeFile and editFile without asking. Click to switch, or set it in Settings → Tool approvals."
+          >
+            <span class="mode-dot" aria-hidden="true">●</span>
+            <span id="auto-mode-label">ask before tools</span>
+          </button>
+          <span class="hint" id="auto-mode-hint"></span>
+          <span class="composer-spacer"></span>
           <button type="submit" id="send">Send</button>
         </div>
       </form>
-      <!-- Mode strip: the same switch as Settings → Tool approvals, hoisted
-           directly under the chat bar so the current mode is readable while
-           typing and one click from the other. Both controls are painted from
-           renderConfirmMode() in app.js, so they cannot disagree. -->
-      <div class="composer-modes">
-        <button
-          type="button"
-          id="auto-mode-toggle"
-          class="mode-chip"
-          aria-pressed="false"
-          title="Auto mode lets the agent run exec, writeFile and editFile without asking. Click to switch, or set it in Settings → Tool approvals."
-        >
-          <span class="mode-dot" aria-hidden="true">●</span>
-          <span id="auto-mode-label">ask before tools</span>
-        </button>
-        <span class="hint" id="auto-mode-hint"></span>
-      </div>
     </section>
   </main>
 
@@ -645,7 +790,7 @@
         <input
           type="text"
           id="memory-overlay-query"
-          placeholder="Filter by text, tag, topic or source…"
+          placeholder="Filter by text, tag or source…"
           autocomplete="off"
         />
         <button type="submit">Filter</button>
@@ -698,6 +843,22 @@
         <div class="fp-row"><span class="fp-k">key file</span><span class="fp-v" id="fp-key-path">–</span></div>
         <div class="fp-row"><span class="fp-k">publishes to</span><span class="fp-v" id="fp-vault-target">–</span></div>
       </div>
+
+      <!-- Where a publish/backup goes. Three named destinations, not a
+           dropdown: `aria-pressed` on the active one is the whole state, so
+           fingerprint.js's paintVaultBackend() is one loop over three buttons
+           rather than a <select> whose value can drift from main's answer. -->
+      <div class="fp-vault-backend" id="fp-vault-backend" role="group" aria-label="where records are published">
+        <button type="button" id="fp-vault-backend-drive" class="ghost-btn fp-backend-btn" aria-pressed="false">
+          Google Drive
+        </button>
+        <button type="button" id="fp-vault-backend-aegiscloud" class="ghost-btn fp-backend-btn" aria-pressed="false">
+          AE
+        </button>
+        <button type="button" id="fp-vault-backend-off" class="ghost-btn fp-backend-btn" aria-pressed="false">
+          No sync
+        </button>
+      </div>
       <p class="fp-warn" id="fp-key-warning" hidden></p>
 
       <div class="fp-controls">
@@ -739,7 +900,7 @@
         <label
           class="flow-toggle"
           for="fp-auto-seal"
-          title="Seal this session as a φ(α) record once it has been quiet for 90 seconds. Off by default. The seal happens whether or not anyone is watching, but publishing to the vault stays a separate checkbox."
+          title="Seal this session as a φ(α) record once it has been quiet for 90 seconds. On by default (this switch only turns it off). The seal happens whether or not anyone is watching, but publishing to the vault stays a separate checkbox."
         >
           <input type="checkbox" id="fp-auto-seal" />
           <span id="fp-auto-seal-label">seal automatically when the session goes quiet</span>
@@ -766,6 +927,23 @@
 
       <ul class="fp-vault-list" id="fp-vault-list"></ul>
 
+      <!-- Google Drive — memory backup. Unrelated to the vault above: that
+           publishes a sealed φ(α) RECORD; this backs up the account's AEGIS
+           CLOUD MEMORY to the user's own Drive through real Google OAuth
+           (desktop/lib/google-connect.js). Two buttons because connecting
+           Drive is only coherent once this machine has signed in with the
+           SAME Google identity — see that file's header comment — so
+           "Connect Drive" stays disabled (fingerprint.js paintDrive()) until
+           sign-in has actually landed. -->
+      <div class="fp-controls">
+        <div class="fp-row"><span class="fp-k">Google Drive</span><span class="fp-v" id="fp-drive-status">–</span></div>
+        <div class="fp-actions">
+          <button type="button" id="fp-drive-signin" class="ghost-btn">Sign in with Google</button>
+          <button type="button" id="fp-drive-connect" class="ghost-btn" disabled>Connect Drive</button>
+          <button type="button" id="fp-drive-sync" class="ghost-btn" disabled>Back up memory now</button>
+        </div>
+      </div>
+
       <div class="fp-out" id="fp-out">Ready. The key is never displayed.</div>
     </div>
   </div>
@@ -856,6 +1034,9 @@
     </div>
   </div>
 
+  <script src="providers.js"></script>
+  <script src="provider-toolbar.js"></script>
+  <script src="companion.js"></script>
   <script src="budget.js"></script>
   <script src="usage.js"></script>
   <script src="stream-policy.js"></script>