aegis-desktop 1.0.13 → 1.0.14

package/lib/google-connect.js

@@ -25,10 +25,15 @@
  *      account purely by Google identity, with no notion of "the account
  *      this machine's API key already belongs to" — so connecting Drive
  *      before signing in attaches the tokens to a DIFFERENT account than the
- *      one this machine will poll, and the poll just times out. `connectDrive`
- *      refuses outright when this machine has no key at all, but cannot
- *      detect "has a key, but it is an anonymous one" — that failure still
- *      surfaces, just later, as a timeout with the right wording.
+ *      one this machine will poll, and the poll just times out.
+ *
+ *      "Signed in with Google" is NOT "has an API key". Every install
+ *      auto-provisions an anonymous device key, so a key always exists and an
+ *      `!apiKey` guard never fires. The only honest source for the real
+ *      question is the server's `google_linked` (users.google_id), carried on
+ *      `/api/drive/token` and surfaced as `status().googleLinked` — so
+ *      `connectDrive` refuses on that, and the renderer disables the button
+ *      from the same flag.
  *
  * Electron-free and fully injected — same shape as `account-key.js` next to
  * it — so the whole flow runs under a test with a stub `aegis` client, a
@@ -50,6 +55,10 @@ function createGoogleConnect({
   let connectInFlight = null;
   let lastSyncAt = null;
   let lastSyncError = null;
+  // Did a Google round-trip complete in THIS process? That is first-hand
+  // evidence of a linked account and does not depend on the server reporting
+  // it — which older servers do not (see `status`).
+  let signedInViaGoogle = false;
 
   /** Sign this machine in with Google, replacing whatever key it had. */
   function signInWithGoogle() {
@@ -88,6 +97,10 @@ function createGoogleConnect({
               /* best-effort — the account key itself is already saved */
             }
           }
+          // Before the notification, which is what makes the renderer re-read
+          // `status()` — otherwise that refresh races this assignment and
+          // reports the sign-in as not having happened.
+          signedInViaGoogle = true;
           if (typeof onAccountChange === 'function') onAccountChange();
           return { ok: true, opened, url: session.url, username: result.username || null };
         } finally {
@@ -99,16 +112,41 @@ function createGoogleConnect({
   }
 
   /** Open `/connect/drive` and wait for this account to show connected. */
-  function connectDrive() {
+  async function connectDrive() {
     if (!aegis.apiKey) {
-      return Promise.resolve({
+      return {
         ok: false,
         error: 'sign in with Google first — this device has no AEGIS account key yet',
-      });
+      };
     }
     if (!connectInFlight) {
       connectInFlight = (async () => {
         try {
+          // The key exists but may be an anonymous device key. Ask the server
+          // whether this account is actually tied to a Google identity before
+          // opening a consent screen that would attach the tokens elsewhere.
+          // Inside the in-flight promise so a double click cannot open two
+          // consent tabs. If the status call fails, fall through: a transport
+          // blip must not be reported as "not signed in with Google".
+          let linked = true;
+          try {
+            const st = await driveConnect.driveStatus(aegis);
+            // Refuse only on a definite "not linked". A server that predates
+            // `google_linked` answers the same shape as an unlinked account,
+            // and refusing on that would make a real Google sign-in unable to
+            // ever connect Drive — the exact dead end this guard exists to
+            // prevent, only inverted.
+            linked = !(st.googleLinkedKnown && !st.googleLinked);
+          } catch {
+            /* unknown — let the flow try rather than misreport the reason */
+          }
+          if (!linked) {
+            return {
+              ok: false,
+              error: 'sign in with Google first — this account is not linked to a Google identity yet, '
+                + 'and connecting Drive now would attach it to a different account',
+            };
+          }
           const url = driveConnect.driveConnectUrl(aegis.apiBase);
           const opened = Boolean(openUrl(url));
           try {
@@ -125,11 +163,31 @@ function createGoogleConnect({
     return connectInFlight;
   }
 
-  /** A one-shot read: signed in, and if so, is Drive connected. */
+  /**
+   * A one-shot read: signed in with Google, and if so, is Drive connected.
+   *
+   * `signedIn` is the server's `google_linked`, not "has an API key" — see
+   * the header. The old `apiKey ? true` form reported every anonymous
+   * auto-provisioned device as signed in, which both mislabelled the card
+   * ("signed in · Drive not connected yet" on a machine that never touched
+   * Google) and enabled Connect Drive ahead of the sign-in it depends on.
+   */
   async function status() {
-    if (!aegis.apiKey) return { signedIn: false, connected: false, email: null };
+    if (!aegis.apiKey) {
+      return { signedIn: false, googleLinked: false, googleLinkedKnown: true, connected: false, email: null };
+    }
     const s = await driveConnect.driveStatus(aegis);
-    return { signedIn: true, ...s };
+    // A completed round-trip outranks a server that cannot answer: without
+    // this, signing in against a server that predates `google_linked` leaves
+    // the card reading "not signed in" forever, because the sign-in that just
+    // succeeded is the one thing the flag was supposed to prove.
+    const signedIn = s.googleLinked === true || signedInViaGoogle;
+    return {
+      signedIn,
+      ...s,
+      googleLinked: s.googleLinked === true || signedIn,
+      googleLinkedKnown: s.googleLinkedKnown || signedIn,
+    };
   }
 
   /** Pull this account's AEGIS cloud memory and back it up to Drive. */

package/lib/local/engine.js

@@ -745,6 +745,7 @@ const { offerableCatalog } = requireSharedBrain();
 const { withByokAdditions } = requireSharedByokCatalog();
 const {
   withUserModels,
+  unmatchedUserProviders,
   load: loadUserModels,
   addUserModel,
   removeUserModel,
@@ -1671,6 +1672,16 @@ function createLocalEngine({
       // it via `fee.require_balance` below.
       let providers = [];
       let fee = null;
+      // Did the CATALOG itself fail to arrive, as opposed to arriving empty?
+      // The two are different states and the picker must not confuse them: a
+      // 5xx / offline relay used to fall into the bare `catch` below and hand
+      // back `providers: []`, which reads on screen exactly like an account
+      // with nothing configured — while the user's provider row and their
+      // `models.json` declaration sat intact on disk. Reported instead, the
+      // same way the 'local' branch reports `listed: false` for a tag list
+      // that did not arrive.
+      let providersFailed = false;
+      let providersError = null;
       try {
         const data = await aegis.byokProviders();
         // The server's catalog, plus the ids it does not name but the vendor
@@ -1688,8 +1699,16 @@ function createLocalEngine({
         // Absent until the server publishes one, and the UI must then say
         // nothing rather than show a guess.
         fee = (data && data.fee) || null;
-      } catch {
+      } catch (err) {
+        // Keep the empty list (nothing to offer) but SAY why, so the renderer
+        // can distinguish "catalog unreachable" from "catalog said none". The
+        // message is carried rather than a boolean alone because the two cases
+        // need different copy: offline wants a retry, a server error wants the
+        // status. `err.message` is the transport's own text, already shaped
+        // elsewhere in this file.
         providers = [];
+        providersFailed = true;
+        providersError = (err && err.message) || String(err);
       }
       const models = [];
       for (const p of providers) {
@@ -1725,6 +1744,18 @@ function createLocalEngine({
         needsProviderKey: models.length > 0 && !models.some((m) => m.configured),
         needsAegisKey: !aegis.apiKey,
         fee,
+        // True only when the catalog did not arrive — never merely because it
+        // arrived with no providers. `withUserModels` never fabricates a
+        // provider, so this list is the same either side of the fold above.
+        providersFailed,
+        providersError,
+        // Declarations in `models.json` naming a provider the catalog does not
+        // list — a typo, or a provider renamed/dropped server-side. `withUserModels`
+        // deliberately does NOT invent a row for them (it would 401 on its first
+        // turn), but silence is the other wrong answer: the model stays in the
+        // file and the user is entitled to know the picker cannot show it.
+        // Carried as the ids alone; the renderer names them.
+        unmatchedProviders: unmatchedUserProviders(providers),
       };
     }
     if (cls === 'local') {
@@ -2444,6 +2475,32 @@ function createLocalEngine({
         const refusal = localT.remoteRefusal(cfg.baseURL || localT.DEFAULT_BASE);
         if (refusal) throw refusal;
       }
+      // `custom` is the mirror of `local`: both are rows whose payload is an
+      // ADDRESS rather than a credential, and both are unusable without it.
+      // They differ in what absence MEANS. A blank `local` row falls back to
+      // DEFAULT_BASE (the stock Ollama port) because there is exactly one
+      // sensible address to guess. A blank `custom` row has no default at all —
+      // the catalog descriptor pins none, so the server refuses the call with a
+      // bare 400 that says nothing about which half of the setup is missing.
+      //
+      // Caught here, before any byte goes out, so the message can name the
+      // command that fixes it. Reachable in practice: `/byok-key custom <key>`
+      // stores a key with no address, and the CLI explicitly trusts an
+      // unreachable catalog rather than refusing the id — so a user who typed
+      // the key first and the endpoint never has a row that looks configured.
+      // Keyed on the provider, not the class: every other byok provider's host
+      // is a server-side constant and needs no address from us.
+      if (cls === 'byok' && byokParts.provider === 'custom' && !(cfg.baseURL || '').trim()) {
+        const err = new Error(
+          'No endpoint saved for the "custom" provider — its key is on this machine but the address ' +
+            'it dials is not, and no default exists for a vendor AEGIS does not know. Fix: ' +
+            '/model-add custom <https-base-url> <api-key> <model-id> (writes both halves), or the ' +
+            'endpoint field in Settings › Provider (custom).'
+        );
+        err.status = 400;
+        err.code = 'custom_endpoint_missing';
+        throw err;
+      }
       const base = {
         cls, model, mode: payload && payload.mode, maxTokens, statedMaxTokens, autonomous, sessionId, signal, onDelta, cfg, apiKey, toolChoice,
         // The turn's working directory, computed above as `turnCwd` — `dispatch`
@@ -3024,6 +3081,22 @@ function createLocalEngine({
           });
         }
       }
+    } catch (e) {
+      // Stamp the stop at the one place it is known for certain.
+      //
+      // `cancel(sessionId)` aborts THIS turn's controller, and the in-flight
+      // transport unwinds as a rejection. The host has to tell that rejection
+      // apart from a genuine provider/transport failure before it can stop
+      // printing Ctrl-X as an application crash — and it used to guess from the
+      // message text, which is exactly how a real failure ("connection aborted
+      // by peer", "upstream aborted the connection") gets relabelled as a
+      // deliberate stop and leaves the user with a silently empty answer. The
+      // message is not evidence. This is: the signal reads aborted only because
+      // the user asked for it, so it cannot be confused with anything upstream
+      // did. Attached to the error object itself so it survives any rethrow,
+      // and read by `isAbortShapedError` in desktop/main.js.
+      if (signal.aborted && e && typeof e === 'object') e.aegisCancelled = true;
+      throw e;
     } finally {
       if (shell) shell.dispose();
       controllers.delete(sessionId);

package/lib/local/entitlement.js

@@ -203,9 +203,15 @@ function byokFeeLine(fee) {
   // default-off gate after it. Joined with ' — ' only when there IS a second
   // clause: a sentence-ending dash with nothing after it ("…provider's bill —.")
   // is what the first live run of this line actually printed.
+  //
+  // This rate is the deployment's published RATE, not a quote for the reader
+  // specifically — an Unlimited subscriber is waived from this fee entirely
+  // (billing_service.is_unlimited on aegis1), so the number above is what a
+  // Free-tier BYOK caller pays, not what everyone pays.
   const price = `Bring your own key: relayed through AEGIS, handled at `
     + `${ratePerMillion(inRate)} in / ${ratePerMillion(outRate)} out, `
-    + `on top of your provider's bill`;
+    + `on top of your provider's bill — no fee at all on Unlimited, `
+    + `and no fee at all during the free 1-month Unlimited trial`;
   let clause = '';
   if (f.require_account === true) {
     clause = 'and needs an AEGIS account key (X-AEGIS-Key) for the fee to be billed';