aegis-desktop 1.0.12 → 1.0.14

package/lib/google-connect.js

@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
+'use strict';
+
+/**
+ * google-connect.js — the desktop's Google identity + Drive flow.
+ *
+ * Two distinct steps, run in this order because the second depends on the
+ * first having actually landed:
+ *
+ *   1. Sign in with Google (`client/google-signin.js`'s local round-trip) —
+ *      replaces this machine's saved AEGIS key with the one tied to that
+ *      Google identity, exactly as `aegiscode connect` already does for the
+ *      CLI (cli/src/connect.js). Desktop never had this wiring before this
+ *      file; the only Google sign-in that existed anywhere in this product
+ *      was the CLI's.
+ *   2. Connect Drive (`client/drive-connect.js`, which opens `/connect/drive`
+ *      in the system browser and polls `/api/drive/token`) — grants the
+ *      `drive.file` scope to WHICHEVER Google identity that browser's
+ *      consent screen uses. That is only the SAME account as step 1 if step
+ *      1 ran first on this machine: `/connect/drive`'s callback resolves an
+ *      account purely by Google identity, with no notion of "the account
+ *      this machine's API key already belongs to" — so connecting Drive
+ *      before signing in attaches the tokens to a DIFFERENT account than the
+ *      one this machine will poll, and the poll just times out.
+ *
+ *      "Signed in with Google" is NOT "has an API key". Every install
+ *      auto-provisions an anonymous device key, so a key always exists and an
+ *      `!apiKey` guard never fires. The only honest source for the real
+ *      question is the server's `google_linked` (users.google_id), carried on
+ *      `/api/drive/token` and surfaced as `status().googleLinked` — so
+ *      `connectDrive` refuses on that, and the renderer disables the button
+ *      from the same flag.
+ *
+ * Electron-free and fully injected — same shape as `account-key.js` next to
+ * it — so the whole flow runs under a test with a stub `aegis` client, a
+ * stub `googleSignIn`/`driveConnect`/`driveUpload`, and no browser, window or
+ * network.
+ */
+
+function createGoogleConnect({
+  aegis,
+  credentials,
+  persistKey,
+  openUrl,
+  googleSignIn,
+  driveConnect,
+  driveUpload,
+  onAccountChange,
+}) {
+  let signInInFlight = null;
+  let connectInFlight = null;
+  let lastSyncAt = null;
+  let lastSyncError = null;
+  // Did a Google round-trip complete in THIS process? That is first-hand
+  // evidence of a linked account and does not depend on the server reporting
+  // it — which older servers do not (see `status`).
+  let signedInViaGoogle = false;
+
+  /** Sign this machine in with Google, replacing whatever key it had. */
+  function signInWithGoogle() {
+    if (!signInInFlight) {
+      signInInFlight = (async () => {
+        try {
+          // Everything from here on (binding the local callback server,
+          // opening the browser, waiting for the round-trip) can fail, and
+          // every caller of this module — the IPC handler in main.js chief
+          // among them — is promised `{ ok, … }`/`{ ok: false, error }`,
+          // never a rejection. One try covers the whole flow instead of only
+          // the `session.wait()` half of it.
+          let session;
+          try {
+            session = await googleSignIn.startGoogleSignIn({ apiBase: aegis.apiBase });
+          } catch (e) {
+            return { ok: false, error: `could not start the local sign-in server — ${(e && e.message) || e}` };
+          }
+          const opened = Boolean(openUrl(session.url));
+          let result;
+          try {
+            result = await session.wait();
+          } catch (e) {
+            return { ok: false, opened, url: session.url, error: (e && e.message) || String(e) };
+          }
+          // Live client first: the very next call this process makes (e.g.
+          // the renderer asking for drive status right after this resolves)
+          // must see the new identity, not whatever key this process started
+          // with.
+          aegis.setApiKey(result.apiKey);
+          persistKey(result.apiKey);
+          if (result.memoryToken && credentials && typeof credentials.saveMemoryToken === 'function') {
+            try {
+              credentials.saveMemoryToken(result.memoryToken);
+            } catch {
+              /* best-effort — the account key itself is already saved */
+            }
+          }
+          // Before the notification, which is what makes the renderer re-read
+          // `status()` — otherwise that refresh races this assignment and
+          // reports the sign-in as not having happened.
+          signedInViaGoogle = true;
+          if (typeof onAccountChange === 'function') onAccountChange();
+          return { ok: true, opened, url: session.url, username: result.username || null };
+        } finally {
+          signInInFlight = null;
+        }
+      })();
+    }
+    return signInInFlight;
+  }
+
+  /** Open `/connect/drive` and wait for this account to show connected. */
+  async function connectDrive() {
+    if (!aegis.apiKey) {
+      return {
+        ok: false,
+        error: 'sign in with Google first — this device has no AEGIS account key yet',
+      };
+    }
+    if (!connectInFlight) {
+      connectInFlight = (async () => {
+        try {
+          // The key exists but may be an anonymous device key. Ask the server
+          // whether this account is actually tied to a Google identity before
+          // opening a consent screen that would attach the tokens elsewhere.
+          // Inside the in-flight promise so a double click cannot open two
+          // consent tabs. If the status call fails, fall through: a transport
+          // blip must not be reported as "not signed in with Google".
+          let linked = true;
+          try {
+            const st = await driveConnect.driveStatus(aegis);
+            // Refuse only on a definite "not linked". A server that predates
+            // `google_linked` answers the same shape as an unlinked account,
+            // and refusing on that would make a real Google sign-in unable to
+            // ever connect Drive — the exact dead end this guard exists to
+            // prevent, only inverted.
+            linked = !(st.googleLinkedKnown && !st.googleLinked);
+          } catch {
+            /* unknown — let the flow try rather than misreport the reason */
+          }
+          if (!linked) {
+            return {
+              ok: false,
+              error: 'sign in with Google first — this account is not linked to a Google identity yet, '
+                + 'and connecting Drive now would attach it to a different account',
+            };
+          }
+          const url = driveConnect.driveConnectUrl(aegis.apiBase);
+          const opened = Boolean(openUrl(url));
+          try {
+            const status = await driveConnect.waitForDriveConnected(aegis);
+            return { ok: true, opened, url, connected: status.connected, email: status.email };
+          } catch (e) {
+            return { ok: false, opened, url, error: (e && e.message) || String(e) };
+          }
+        } finally {
+          connectInFlight = null;
+        }
+      })();
+    }
+    return connectInFlight;
+  }
+
+  /**
+   * A one-shot read: signed in with Google, and if so, is Drive connected.
+   *
+   * `signedIn` is the server's `google_linked`, not "has an API key" — see
+   * the header. The old `apiKey ? true` form reported every anonymous
+   * auto-provisioned device as signed in, which both mislabelled the card
+   * ("signed in · Drive not connected yet" on a machine that never touched
+   * Google) and enabled Connect Drive ahead of the sign-in it depends on.
+   */
+  async function status() {
+    if (!aegis.apiKey) {
+      return { signedIn: false, googleLinked: false, googleLinkedKnown: true, connected: false, email: null };
+    }
+    const s = await driveConnect.driveStatus(aegis);
+    // A completed round-trip outranks a server that cannot answer: without
+    // this, signing in against a server that predates `google_linked` leaves
+    // the card reading "not signed in" forever, because the sign-in that just
+    // succeeded is the one thing the flag was supposed to prove.
+    const signedIn = s.googleLinked === true || signedInViaGoogle;
+    return {
+      signedIn,
+      ...s,
+      googleLinked: s.googleLinked === true || signedIn,
+      googleLinkedKnown: s.googleLinkedKnown || signedIn,
+    };
+  }
+
+  /** Pull this account's AEGIS cloud memory and back it up to Drive. */
+  async function syncMemoryNow() {
+    try {
+      const tokenInfo = await aegis.driveToken();
+      if (!tokenInfo || !tokenInfo.connected || !tokenInfo.access_token) {
+        throw new Error('Google Drive is not connected yet');
+      }
+      const pulled = await aegis.memoryPull(0);
+      const entries = (pulled && pulled.entries) || [];
+      const content = JSON.stringify({ exportedAt: new Date().toISOString(), entries }, null, 2);
+      const result = await driveUpload.uploadMemoryBackup(tokenInfo.access_token, content);
+      lastSyncAt = Date.now();
+      lastSyncError = null;
+      return {
+        ok: true,
+        count: entries.length,
+        fileId: result.fileId,
+        webViewLink: result.webViewLink,
+        updated: result.updated,
+        lastSyncAt,
+      };
+    } catch (e) {
+      lastSyncError = (e && e.message) || String(e);
+      return { ok: false, error: lastSyncError, lastSyncAt };
+    }
+  }
+
+  return {
+    signInWithGoogle,
+    connectDrive,
+    status,
+    syncMemoryNow,
+    state: () => ({ lastSyncAt, lastSyncError }),
+  };
+}
+
+module.exports = { createGoogleConnect };

package/lib/local/engine.js

@@ -167,6 +167,32 @@ function normalizeToolArgs(T, name, args, ctx) {
   return fn(name, args, ctx);
 }
 
+/**
+ * Is `dir` inside a git work tree? Walks up the way git itself does, so a turn
+ * running in a subdirectory of a repo is still told it is one.
+ *
+ * Returns `'git'`, `''` (definitely not a repo), or `null` when the probe could
+ * not answer — the caller omits the line rather than asserting "not a repo",
+ * because a wrong negative is exactly the kind of fact a model will act on.
+ */
+function detectVcs(dir) {
+  if (!dir) return null;
+  try {
+    const fs = require('node:fs');
+    const path = require('node:path');
+    let probe = path.resolve(String(dir));
+    for (let i = 0; i < 8; i += 1) {
+      if (fs.existsSync(path.join(probe, '.git'))) return 'git';
+      const up = path.dirname(probe);
+      if (up === probe) break;
+      probe = up;
+    }
+    return '';
+  } catch {
+    return null;
+  }
+}
+
 function hostEnv(base = {}, supplied = {}, payload = null) {
   const b = base || {};
   const s = supplied || {};
@@ -250,6 +276,16 @@ function hostEnv(base = {}, supplied = {}, payload = null) {
     // a `{ key, value }` facet, or a bare string.
     languages: pick('languages', b.languages),
     cwd: pick('cwd', cwd),
+    // Whether the turn's directory is a git work tree, probed once per turn.
+    // Measured reason: the work rules order the model to check prior work with
+    // `git log` before it starts, and a benchmark workspace (a temp dir holding
+    // three files) is NOT a repo. On every task the model dutifully spent its
+    // second round on `cd … && git log`, paid a failed exec, and carried the
+    // error text into every later round's prompt — one wasted round in seven,
+    // and a bigger prefix for the rest. The host already knew; this states it
+    // so the rule can say "skip the sources the workspace does not have" and
+    // mean something the model can act on without guessing.
+    vcs: pick('vcs', b.vcs != null ? b.vcs : detectVcs(cwd)),
     shell: pick('shell', shellName),
     shellKind: pick('shellKind', shellKind),
     roots: pick('roots', b.roots),
@@ -709,6 +745,7 @@ const { offerableCatalog } = requireSharedBrain();
 const { withByokAdditions } = requireSharedByokCatalog();
 const {
   withUserModels,
+  unmatchedUserProviders,
   load: loadUserModels,
   addUserModel,
   removeUserModel,
@@ -1635,6 +1672,16 @@ function createLocalEngine({
       // it via `fee.require_balance` below.
       let providers = [];
       let fee = null;
+      // Did the CATALOG itself fail to arrive, as opposed to arriving empty?
+      // The two are different states and the picker must not confuse them: a
+      // 5xx / offline relay used to fall into the bare `catch` below and hand
+      // back `providers: []`, which reads on screen exactly like an account
+      // with nothing configured — while the user's provider row and their
+      // `models.json` declaration sat intact on disk. Reported instead, the
+      // same way the 'local' branch reports `listed: false` for a tag list
+      // that did not arrive.
+      let providersFailed = false;
+      let providersError = null;
       try {
         const data = await aegis.byokProviders();
         // The server's catalog, plus the ids it does not name but the vendor
@@ -1652,8 +1699,16 @@ function createLocalEngine({
         // Absent until the server publishes one, and the UI must then say
         // nothing rather than show a guess.
         fee = (data && data.fee) || null;
-      } catch {
+      } catch (err) {
+        // Keep the empty list (nothing to offer) but SAY why, so the renderer
+        // can distinguish "catalog unreachable" from "catalog said none". The
+        // message is carried rather than a boolean alone because the two cases
+        // need different copy: offline wants a retry, a server error wants the
+        // status. `err.message` is the transport's own text, already shaped
+        // elsewhere in this file.
         providers = [];
+        providersFailed = true;
+        providersError = (err && err.message) || String(err);
       }
       const models = [];
       for (const p of providers) {
@@ -1689,6 +1744,18 @@ function createLocalEngine({
         needsProviderKey: models.length > 0 && !models.some((m) => m.configured),
         needsAegisKey: !aegis.apiKey,
         fee,
+        // True only when the catalog did not arrive — never merely because it
+        // arrived with no providers. `withUserModels` never fabricates a
+        // provider, so this list is the same either side of the fold above.
+        providersFailed,
+        providersError,
+        // Declarations in `models.json` naming a provider the catalog does not
+        // list — a typo, or a provider renamed/dropped server-side. `withUserModels`
+        // deliberately does NOT invent a row for them (it would 401 on its first
+        // turn), but silence is the other wrong answer: the model stays in the
+        // file and the user is entitled to know the picker cannot show it.
+        // Carried as the ids alone; the renderer names them.
+        unmatchedProviders: unmatchedUserProviders(providers),
       };
     }
     if (cls === 'local') {
@@ -2408,6 +2475,32 @@ function createLocalEngine({
         const refusal = localT.remoteRefusal(cfg.baseURL || localT.DEFAULT_BASE);
         if (refusal) throw refusal;
       }
+      // `custom` is the mirror of `local`: both are rows whose payload is an
+      // ADDRESS rather than a credential, and both are unusable without it.
+      // They differ in what absence MEANS. A blank `local` row falls back to
+      // DEFAULT_BASE (the stock Ollama port) because there is exactly one
+      // sensible address to guess. A blank `custom` row has no default at all —
+      // the catalog descriptor pins none, so the server refuses the call with a
+      // bare 400 that says nothing about which half of the setup is missing.
+      //
+      // Caught here, before any byte goes out, so the message can name the
+      // command that fixes it. Reachable in practice: `/byok-key custom <key>`
+      // stores a key with no address, and the CLI explicitly trusts an
+      // unreachable catalog rather than refusing the id — so a user who typed
+      // the key first and the endpoint never has a row that looks configured.
+      // Keyed on the provider, not the class: every other byok provider's host
+      // is a server-side constant and needs no address from us.
+      if (cls === 'byok' && byokParts.provider === 'custom' && !(cfg.baseURL || '').trim()) {
+        const err = new Error(
+          'No endpoint saved for the "custom" provider — its key is on this machine but the address ' +
+            'it dials is not, and no default exists for a vendor AEGIS does not know. Fix: ' +
+            '/model-add custom <https-base-url> <api-key> <model-id> (writes both halves), or the ' +
+            'endpoint field in Settings › Provider (custom).'
+        );
+        err.status = 400;
+        err.code = 'custom_endpoint_missing';
+        throw err;
+      }
       const base = {
         cls, model, mode: payload && payload.mode, maxTokens, statedMaxTokens, autonomous, sessionId, signal, onDelta, cfg, apiKey, toolChoice,
         // The turn's working directory, computed above as `turnCwd` — `dispatch`
@@ -2563,7 +2656,34 @@ function createLocalEngine({
       // dispatch is summed, including the truncation retry and the synthesis
       // re-dispatch: both are real, separately billed provider calls.
       const turnUsage = { calls: 0 };
-      const USAGE_FIELDS = ['input_tokens', 'output_tokens', 'prompt_tokens', 'completion_tokens', 'total_tokens'];
+      // The cache fields MUST be listed here, not just summed at the top level.
+      // DeepSeek reports its hit count as `prompt_cache_hit_tokens` and its
+      // miss count as `prompt_cache_miss_tokens`, and neither name was in this
+      // list — so every tool-using turn dropped them on the way out and handed
+      // its caller a usage object with no cache information at all. The CLI's
+      // `--json` republishes exactly this accumulator, `usageBuckets` then had
+      // nothing to read, and the published cost of an agentic run was priced
+      // entirely at the miss rate. Measured on the 3-task sweep: `cache_read: 0`
+      // on all three trials (tokens_in 210,904) while the row's own baseline
+      // showed 72,448 cached tokens. The same defect the CLI's per-turn readout
+      // was fixed for, here one layer below it.
+      const USAGE_FIELDS = [
+        'input_tokens', 'output_tokens', 'prompt_tokens', 'completion_tokens', 'total_tokens',
+        // Anthropic spelling (disjoint from its input count).
+        'cache_read_input_tokens', 'cache_creation_input_tokens',
+        // DeepSeek/OpenAI spelling (both SUBSETs of the prompt count, which is
+        // what `usageBuckets` detects and subtracts rather than double-billing).
+        'prompt_cache_hit_tokens', 'prompt_cache_miss_tokens',
+        // Hidden deliberation, which every provider here bills as OUTPUT but
+        // none of them split out for free. These were absent from the list
+        // while `reasoningTokensOf` (below) already knew how to read them, so
+        // the one place that could have separated "wrote more code" from
+        // "thought longer" threw the split away at the accumulator and handed
+        // its caller a single `output_tokens` with CoT folded in. A benchmark
+        // row could therefore see that a turn cost 1.9x another's output and
+        // still have no way to say which half moved.
+        'reasoning_tokens', 'thinking_tokens',
+      ];
       const addUsage = (res) => {
         const u = res && res.usage;
         if (!u || typeof u !== 'object') return;
@@ -2961,6 +3081,22 @@ function createLocalEngine({
           });
         }
       }
+    } catch (e) {
+      // Stamp the stop at the one place it is known for certain.
+      //
+      // `cancel(sessionId)` aborts THIS turn's controller, and the in-flight
+      // transport unwinds as a rejection. The host has to tell that rejection
+      // apart from a genuine provider/transport failure before it can stop
+      // printing Ctrl-X as an application crash — and it used to guess from the
+      // message text, which is exactly how a real failure ("connection aborted
+      // by peer", "upstream aborted the connection") gets relabelled as a
+      // deliberate stop and leaves the user with a silently empty answer. The
+      // message is not evidence. This is: the signal reads aborted only because
+      // the user asked for it, so it cannot be confused with anything upstream
+      // did. Attached to the error object itself so it survives any rethrow,
+      // and read by `isAbortShapedError` in desktop/main.js.
+      if (signal.aborted && e && typeof e === 'object') e.aegisCancelled = true;
+      throw e;
     } finally {
       if (shell) shell.dispose();
       controllers.delete(sessionId);

package/lib/local/entitlement.js

@@ -203,9 +203,15 @@ function byokFeeLine(fee) {
   // default-off gate after it. Joined with ' — ' only when there IS a second
   // clause: a sentence-ending dash with nothing after it ("…provider's bill —.")
   // is what the first live run of this line actually printed.
+  //
+  // This rate is the deployment's published RATE, not a quote for the reader
+  // specifically — an Unlimited subscriber is waived from this fee entirely
+  // (billing_service.is_unlimited on aegis1), so the number above is what a
+  // Free-tier BYOK caller pays, not what everyone pays.
   const price = `Bring your own key: relayed through AEGIS, handled at `
     + `${ratePerMillion(inRate)} in / ${ratePerMillion(outRate)} out, `
-    + `on top of your provider's bill`;
+    + `on top of your provider's bill — no fee at all on Unlimited, `
+    + `and no fee at all during the free 1-month Unlimited trial`;
   let clause = '';
   if (f.require_account === true) {
     clause = 'and needs an AEGIS account key (X-AEGIS-Key) for the fee to be billed';

package/lib/local/prompt.js

@@ -30,50 +30,62 @@
 
 /** Identity + work rules. Ported from the upstream engine reference. */
 const MAIN_CHAT_PROMPT =
-  `You are Aegiscodex, a terminal coding assistant that works in the user's repository. ` +
-  `Help with software engineering tasks: read and reason about code, write and edit files, ` +
-  `run shell commands, and investigate bugs. Work rules:\n` +
+  `You are Aegiscodex, a terminal coding assistant working in the user's repository: read and ` +
+  `reason about code, write and edit files, run shell commands, investigate bugs. Work rules:\n` +
+  `- Output is billed by the token and is the largest line on the bill, so spend it where it is ` +
+  `  read. Before a tool call, one short sentence on what you are about to find out. Do NOT ` +
+  `  restate file contents, diffs, command output or test results the user can already see. ` +
+  `  Finish with the answer in a few lines — expand only when asked to explain, or when the ` +
+  `  change's correctness depends on a detail the user must check.\n` +
+  `- Batch independent tool calls into ONE turn: read several files, or grep for several ` +
+  `  patterns, at once, or use one exec command that does the whole job. Every round ` +
+  `  re-sends the prefix and bills fresh output; one call per round is the expensive shape.\n` +
   `- Use tools silently. A one-line reason is enough; do not narrate your plan as a story. ` +
   `- Never claim what a tool found or what a command returned before the tool actually runs. ` +
   `  Report only the results you really received. ` +
-  `- Before you start a fix or feature the user asks for, check whether they have asked for ` +
-  `  it before and whether it was already delivered: look in recalled memory, ` +
-  `  ~/.aegiscode/queue.jsonl, PLAN.md/notes, and \`git log\` for the same demand. If it was ` +
-  `  resolved before and the problem is back, report how it was resolved (the commit, file, or ` +
-  `  mechanism that fixed it) and why it regressed, then fix the cause — never re-fix blind as ` +
-  `  if the request were new. If it was never met, say so plainly before starting. ` +
-  `- Match the response to the request. A greeting, a question about something you already ` +
-  `  know, or a request for an opinion is answered in plain words with NO tools. Only reach ` +
-  `  for a tool when the answer genuinely depends on something in this repo or on this ` +
-  `  machine. "hey" is not a task.\n` +
+  `- Before starting a fix or feature, check whether they have asked for it before and whether ` +
+  `  it was delivered: recalled memory, \`queue.jsonl\`, \`PLAN.md\`/notes and \`git log\` — ` +
+  `  ONE batched command over sources that exist: if the Environment block says this ` +
+  `  directory has no version control, skip it. ` +
+  `  If it was resolved before and the problem is back, report how it was resolved and ` +
+  `  why it regressed, then fix the cause — never re-fix blind as if it were new. ` +
+  `  If it was never met, say so plainly before starting. ` +
+  `- Match the response to the request. A greeting, a question you already know the answer to, ` +
+  `  or a request for an opinion is answered in plain words with NO tools. Reach for a tool ` +
+  `  only when the answer depends on something in this repo or on this machine. ` +
+  `  "hey" is not a task.\n` +
   `- WHEN THE USER HAS ASKED FOR WORK: act, don't just inspect. After at most 2 rounds of ` +
   `  reading or exploration, start making changes with writeFile or editFile. Reconnaissance ` +
-  `  is not progress — implement, then verify. This rule is about HOW to carry out a task you ` +
-  `  were given; it is never a reason to invent one. Never write or modify a file the user ` +
+  `  is not progress — implement, then verify. This is about HOW to carry out a task you were ` +
+  `  given; it is never a reason to invent one. Never write or modify a file the user ` +
   `  did not ask you to touch.\n` +
-  `- Zero tolerance for stalling: once the target file/cause is identified and only the edit ` +
-  `  remains, make it in the same turn. Never end a turn with an empty or no-op response, or a ` +
-  `  "let me continue"/"I'll now…" placeholder when the user says continue — that is not an ` +
-  `  answer and it wastes their turn. This has been flagged as non-compliance before; treat it ` +
-  `  as a hard rule. ` +
-  `- When you have what you need, stop using tools and give a concise, direct answer to the ` +
-  `  user's question. Never end your turn with an intention like "Let me check…" or "I'll now…" ` +
-  `  — that is not an answer. ` +
+  `- Zero tolerance for stalling: once the cause is identified and only the edit remains, make ` +
+  `  it in the same turn. Never end a turn with an empty or no-op response, or a "let me ` +
+  `  continue"/"I'll now…" placeholder when the user says continue — that wastes their turn. ` +
+  `  This has been flagged as non-compliance before; treat it as a hard rule. ` +
+  `- When you have what you need, stop using tools and give a concise, direct answer. Never ` +
+  `  end a turn with an intention like "Let me check…" — that is not an answer. ` +
   `- When a focused multi-step sub-task can be delegated, use the task tool to spawn a ` +
-  `  specialist subagent rather than doing everything inline. ` +
+  `  specialist subagent rather than doing it inline. ` +
   `- If the user references a workflow you don't recognize, inspect the repo/scripts for that ` +
-  `  mechanism before acting — don't assume it means inline work.`;
+  `  mechanism before acting.`;
 
-/** The tools the desktop actually advertises (kept in step with tools.js). */
+/**
+ * The tool line: what each tool is, and the two facts a schema cannot carry.
+ *
+ * It used to restate the path rule in full — absolute, `~` expansion, relative
+ * resolution — which `PATH_ARG_DESC` already says once per path argument in nine
+ * schemas. That duplication is what `d01068b` unwound from the schemas; this is
+ * the other end of it. What stays is the part no schema carries: the
+ * platform-specific example (the one form a model gets wrong) and the persistent
+ * shell, which is a property of the session rather than an argument.
+ */
 const TOOL_LINE =
-  'Tools: readFile, writeFile, editFile, listDir, glob, grep, exec, task. Paths are absolute and ' +
-  'must be written in the form THIS machine uses — read the platform and home directory in the ' +
-  'Environment block below and use them: on win32 that means C:\\Users\\you\\Desktop\\file.txt, ' +
-  'not /home/you/Desktop/file.txt or /tmp/file.txt. "~" and "~/…" mean the home directory and are ' +
-  'expanded for you; a relative path resolves against the working directory. ' +
-  'exec runs in a persistent shell session on this machine — cd and exported env vars carry ' +
-  'across calls within the turn, like a real terminal. task spawns a specialist subagent ' +
-  '(its own tool loop, same model) for a focused, self-contained piece of work.';
+  'Tools: readFile, writeFile, editFile, listDir, glob, grep, exec, task. Paths are absolute ' +
+  'in the form THIS machine uses (see the Environment block): on win32 that means ' +
+  'C:\\Users\\you\\Desktop\\file.txt, not /home/you/Desktop/file.txt or /tmp/file.txt. ' +
+  'exec runs in a persistent shell session — cd and exported env vars carry across calls ' +
+  'within the turn. task spawns a specialist subagent (its own tool loop, same model).';
 
 /**
  * One durable-language entry as a sentence fragment, accepting the three shapes
@@ -109,6 +121,7 @@ function environmentPreamble(env = {}) {
     localeName,
     languages,
     cwd,
+    vcs,
     shell,
     shellKind,
     roots,
@@ -164,8 +177,7 @@ function environmentPreamble(env = {}) {
   if (desktopdir) {
     bits.push(
       `desktop directory: ${desktopdir} — use this exact path when the user says "my desktop"; ` +
-        'do NOT build it yourself from the home directory, because it is not always a folder ' +
-        'called "Desktop" there',
+        'do NOT build it yourself from the home directory',
     );
   }
   // Same failure mode as the desktop line, one directory over, and reported
@@ -176,13 +188,31 @@ function environmentPreamble(env = {}) {
   // missing path cannot tell a typo from an empty directory.
   if (dataDir) {
     bits.push(
-      `AEGIS data directory: ${dataDir} — this is the store itself (config, sessions, ` +
+      `AEGIS data directory: ${dataDir} — the store itself (config, sessions, ` +
         'credentials, queue). Use this exact path; do NOT append it to the home directory ' +
         'yourself, because a dropped separator ("C:\\Users\\you.aegiscode") names a path that ' +
         'does not exist and looks like an empty directory rather than a mistake',
     );
   }
   if (cwd) bits.push(`working directory: ${cwd}`);
+  // The version-control fact, which turns the work rules' "check whether this
+  // was already delivered" from a guess into a decision. Measured: in a temp
+  // workspace with no `.git`, the model still ran `git log` on its second round
+  // of all three tasks, spent a round on a guaranteed failure, and carried the
+  // error into the rest of the turn. Stated only when the host actually probed
+  // (`null`/`undefined` means "could not tell", and silence beats a wrong fact).
+  if (vcs === 'git') {
+    bits.push(
+      `version control: this directory IS inside a git work tree, so \`git log\`, ` +
+        '`git diff` and `git status` are usable for checking what was already done',
+    );
+  } else if (vcs === '') {
+    bits.push(
+      `version control: this directory is NOT a git repository and has no history to ` +
+        'consult — do NOT run `git log`, `git diff`, `git blame` or `git status`; they ' +
+        'fail here and cost a round. Read the files that exist instead',
+    );
+  }
   if (shell) bits.push(`exec shell: ${shell}${shellKind ? ` (${shellKind})` : ''}`);
   if (model) bits.push(`model: ${model}`);
   if (appVersion) bits.push(`AEGIS Desktop ${appVersion}`);